Interesting faillog files.

10-24-2008, 01:17 PM

Hi all CentOS users,

I looked /var/log/messages log file and i realize something in
"messages" files like below;

---
Oct 24 04:02:42 cube2 kernel: Buffer I/O error on device sdc, logical block 1545
---

"sdc" is my storage and i switched off storage at 6 PM.

and when i checked messages log file,I saw faillog under /var/log
directory like below:

-rw------- 1 root root 137438953440 Oct 24 15:39 faillog

its ~136 GB but my disk table size like below:

/dev/md1 497G 19G 453G 4% /
/dev/md3 157G 15G 134G 10% /backup
/dev/md0 243M 21M 210M 9% /boot
tmpfs 32G 0 32G 0% /dev/shm
/dev/sdc 805G 25G 739G 4% /mnt/sdc

Where is ~136 GB faillog file ? I tried force fsck but no error i have.

but i worried,Something is wrong ? I have a error about disk ?

If you help me,I will be happy.

--
Iyi calismalar.Basarilar...
Semih Gokalp
Istanbul/Turkiye
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

10-24-2008, 01:27 PM

Semih Gokalp wrote:
...
> -rw------- 1 root root 137438953440 Oct 24 15:39 faillog

This is a file with "holes" in it, try

du /var/log/faillog

to get the size on disk.

Mogens

--
Mogens Kjaer, Carlsberg A/S, Computer Department
Gamle Carlsberg Vej 10, DK-2500 Valby, Denmark
Phone: +45 33 27 53 25, Mobile: +45 22 12 53 25
Email: mk@crc.dk Homepage: http://www.crc.dk
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

10-24-2008, 03:11 PM

yes i did it before.

du /var/log/message

28 /var/log/faillog

but

ls -al /var/log/

-rw------- 1 root root 137438953440 Oct 24 17:37 faillog

but why it is different ?

2008/10/24 Mogens Kjaer <mk@crc.dk>:
> Semih Gokalp wrote:
> ...
>> -rw------- 1 root root 137438953440 Oct 24 15:39 faillog
>
> This is a file with "holes" in it, try
>
> du /var/log/faillog
>
> to get the size on disk.
>
> Mogens
>
> --
> Mogens Kjaer, Carlsberg A/S, Computer Department
> Gamle Carlsberg Vej 10, DK-2500 Valby, Denmark
> Phone: +45 33 27 53 25, Mobile: +45 22 12 53 25
> Email: mk@crc.dk Homepage: http://www.crc.dk
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>

--
Iyi calismalar.Basarilar...
Semih Gokalp
Istanbul/Turkiye
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

10-24-2008, 03:14 PM

Semih Gokalp wrote:

yes i did it before.

du /var/log/message

28 /var/log/faillog

but

ls -al /var/log/

-rw------- 1 root root 137438953440 Oct 24 17:37 faillog

but why it is different ?

It is a sparse file. It has holes in it.
Only a few blocks are actually allocated.

It is not an error.

Mogens

--
Mogens Kjaer, Carlsberg A/S, Computer Department
Gamle Carlsberg Vej 10, DK-2500 Valby, Denmark
Phone: +45 33 27 53 25, Fax: +45 33 27 47 08
Email: mk@crc.dk Homepage: http://www.crc.dk
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

10-24-2008, 03:15 PM

On Fri, Oct 24, 2008 at 06:11:29PM +0300, Semih Gokalp enlightened us:
> yes i did it before.
>
> du /var/log/message
>
> 28 /var/log/faillog
>
> but
>
> ls -al /var/log/
>
> -rw------- 1 root root 137438953440 Oct 24 17:37 faillog
>
> but why it is different ?
>

It is what is called a "sparse file". Google should be able to tell you the
details.

Matt

P.S. Please do not top post.

--
Matt Hyclak
Systems and Operations
Office of Information Technology
Ohio University
(740) 593-1222
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

10-24-2008, 03:26 PM

Thanks all for help.

Thanks again.

2008/10/24 Mogens Kjaer <mk@crc.dk>:
> Semih Gokalp wrote:
>>
>> yes i did it before.
>>
>> du /var/log/message
>>
>> 28 /var/log/faillog
>>
>> but
>>
>> ls -al /var/log/
>>
>> -rw------- 1 root root 137438953440 Oct 24 17:37 faillog
>>
>> but why it is different ?
>
> It is a sparse file. It has holes in it.
> Only a few blocks are actually allocated.
>
> It is not an error.
>
> Mogens
>
> --
> Mogens Kjaer, Carlsberg A/S, Computer Department
> Gamle Carlsberg Vej 10, DK-2500 Valby, Denmark
> Phone: +45 33 27 53 25, Fax: +45 33 27 47 08
> Email: mk@crc.dk Homepage: http://www.crc.dk
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>

--
Iyi calismalar.Basarilar...
Semih Gokalp
Istanbul/Turkiye
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

10-27-2008, 07:26 AM

Semih Gokalp wrote:
> yes i did it before.
>
> du /var/log/message
>
> 28 /var/log/faillog
>
> but
>
> ls -al /var/log/
>
> -rw------- 1 root root 137438953440 Oct 24 17:37 faillog
>
> but why it is different ?

As already has been said: It's a sparse file with holes in it. As to why
it has to be that big: Space is reserved for every user id which can
possibly log in, depending on the *highest* uid which has ever logged in
onto your system. You are on a 64bit system (I'm good, ain't I?) and you
or some process has used a login shell with the user nfsnobody, which is
UID_MAX - 1 on most, if not all, unix systems.

And that one has the id 4294967294, which means that there is some space
reserved for all the other 4294967293 users which are below that uid.

Cheers,

Ralph
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos