[clue] MOAR WTF!

[Aaron D. Johnson]

David L. Willson writes:

> And while I'm on my "things that have happened, that couldn't have"
> page...
> 
> $ ls -l lastlog 
> -rw-r--r-- 1 root root 180038565560 May 4 13:37 lastlog 
> sudavidw at pdacdb01:7//var/log 13:45:12 
> $ ls -sh lastlog 
> 76K lastlog 
> sudavidw at pdacdb01:7//var/log 13:45:18 
> $ ls -s lastlog 
> 76 lastlog 

[...]

BEGIN excerpt from lastlog(8) man page on a Debian 6.0 machine: 

NOTE
       The lastlog file is a database which contains info on the last
       login of each user. You should not rotate it.  It is a sparse
       file, so its size on the disk is usually much smaller than the
       one shown by "ls -l" (which can indicate a really big file if
       you have in passwd users with a high UID). You can display its
       real size with "ls -s".

END excerpt

I would imagine that your "tail lastlog" process isn't so much hung as
too busy eating an enormous amount of zeros.  Sparse files are neat,
but can certainly lead to WTF moments.

- Aaron