>lastlog is a *sparse* file that only records the last login of each user >at a fixed offset in the file (indexed by uid). If you have a user with a >large uid, the file will appear huge, but ls -s will show the true size. > >Log rotation will not help at all. True enough. I must say that I find this to be of dubious utility. I suppose it's faster, but how many people look at lastlog so often that it needs to be as fast as possible? Even in the good old days when Linux was a baby penguin and real men wrote code on Hazeltine terminals, one called lastlog at most a few times in a day, mostly to see if friends had been on. Surely a hash file makes more sense? Oh well, maybe I'll send someone some email... -- Sharp tools prevent accidents, and foster intent. http://www.hacksaw.org -- http://www.privatecircus.com -- KB1FVD
