topic Re: How can I figure out why my lastlog directory is huge? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-can-I-figure-out-why-my-lastlog-directory-is-huge/m-p/353917#M166519 <P>The file should not be that big. Period.</P> <P>You can't reduce the size without deleting all the data. If you want to delete all the data, don't delete the file, because your system will keep it open and it will stay the same size until you reboot. You can delete the contents of the file with the following command:</P> <PRE><CODE>cp /dev/null &gt;/var/log/lastlog </CODE></PRE> Mon, 07 Aug 2017 21:21:48 GMT cpetterborg 2017-08-07T21:21:48Z How can I figure out why my lastlog directory is huge? https://community.splunk.com/t5/Splunk-Search/How-can-I-figure-out-why-my-lastlog-directory-is-huge/m-p/353916#M166518 <P>Hi guys,</P> <P>Why is my lastlog directory so huge?</P> <PRE><CODE>-rw-r--r--. 1 root root **216G** Aug 7 17:35 lastlog </CODE></PRE> <P>What can I do to reduce it?</P> <P>Thanks</P> Mon, 07 Aug 2017 20:38:19 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-figure-out-why-my-lastlog-directory-is-huge/m-p/353916#M166518 wvalente 2017-08-07T20:38:19Z Re: How can I figure out why my lastlog directory is huge? https://community.splunk.com/t5/Splunk-Search/How-can-I-figure-out-why-my-lastlog-directory-is-huge/m-p/353917#M166519 <P>The file should not be that big. Period.</P> <P>You can't reduce the size without deleting all the data. If you want to delete all the data, don't delete the file, because your system will keep it open and it will stay the same size until you reboot. You can delete the contents of the file with the following command:</P> <PRE><CODE>cp /dev/null &gt;/var/log/lastlog </CODE></PRE> Mon, 07 Aug 2017 21:21:48 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-figure-out-why-my-lastlog-directory-is-huge/m-p/353917#M166519 cpetterborg 2017-08-07T21:21:48Z Re: How can I figure out why my lastlog directory is huge? https://community.splunk.com/t5/Splunk-Search/How-can-I-figure-out-why-my-lastlog-directory-is-huge/m-p/353918#M166520 <P>I believe that lastlog is a sparse file see <A href="http://www.noah.org/wiki/Lastlog_is_gigantic">http://www.noah.org/wiki/Lastlog_is_gigantic</A></P> Tue, 08 Aug 2017 09:41:53 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-figure-out-why-my-lastlog-directory-is-huge/m-p/353918#M166520 dshakespeare_sp 2017-08-08T09:41:53Z