lastlog is a *sparse* file that only records the last login of each user at a fixed offset in the file (indexed by uid). If you have a user with a large uid, the file will appear huge, but ls -s will show the true size.
Log rotation will not help at all.
True enough.
I must say that I find this to be of dubious utility. I suppose it's faster, but how many people look at lastlog so often that it needs to be as fast as possible? Even in the good old days when Linux was a baby penguin and real men wrote code on Hazeltine terminals, one called lastlog at most a few times in a day, mostly to see if friends had been on.
Surely a hash file makes more sense?
The way sparse files work means that it *is* effectively a hashed database, with all the clever stuff done at filesystem level. This is how *nix systems have done this sort of thing for aeons...
Paul.
