Re: [CentOS] Interesting faillog files.

Semih Gokalp wrote:

yes i did it before.

du /var/log/message

28 /var/log/faillog

but

ls -al /var/log/

-rw------- 1 root root 137438953440 Oct 24 17:37 faillog

but why it is different ?

As already has been said: It's a sparse file with holes in it. As to why it has to be that big: Space is reserved for every user id which can possibly log in, depending on the *highest* uid which has ever logged in onto your system. You are on a 64bit system (I'm good, ain't I?) and you or some process has used a login shell with the user nfsnobody, which is UID_MAX - 1 on most, if not all, unix systems.

And that one has the id 4294967294, which means that there is some space reserved for all the other 4294967293 users which are below that uid.

Cheers,

Ralph