>>>>> "GH" == George Hare <hare.george@xxxxxxxxx> writes: GH> ls -l /var/log/lastlog produces - 1 root root 1254130450140. Can I GH> skip the scan of /var/log or are there security issues involved GH> here? /var/log/lastlog just stores the last login time of each user, in a rather naive format. 64-bit machines support a very large number of user IDs (32 bits worth), and this makes the file incredibly huge (1.2TB). These days I don't think lastlog is used for much other than printing last login time when you login. It should probably go away, or at least be converted to a more resonable format. I believe the master bug is https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146214 , but it's not public. Another relevant bug is https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163273 . See also the thread at https://www.redhat.com/archives/fedora-test-list/2005-June/msg00308.html - J<
