Hacksaw wrote:
>lastlog is a *sparse* file that only records the last login of
each user
>at a fixed offset in the file (indexed by uid). If you have a user with a
>large uid, the file will appear huge, but ls -s will show the true size.
>
>Log rotation will not help at all.
True enough.
I must say that I find this to be of dubious utility. I suppose it's faster,
but how many people look at lastlog so often that it needs to be as fast as
possible? Even in the good old days when Linux was a baby penguin and real men
wrote code on Hazeltine terminals, one called lastlog at most a few times in a
day, mostly to see if friends had been on.
Surely a hash file makes more sense?
The way sparse files work means that it *is* effectively a hashed
database, with all the clever stuff done at filesystem level. This is
how *nix systems have done this sort of thing for aeons...
Paul.