This is affecting Ubuntu 20.04 with sssd integration to AD. I am seeing massive lastlog files because of what appears to be the use of very high UID's being assigned to AD users when they log in.
-rw-rw-r-- 1 root utmp 88943346292 Jan 6 16:50 lastlog Oliver -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to pam in Ubuntu. https://bugs.launchpad.net/bugs/1707645 Title: system with high numbered uids has huge sparse /var/log/lastlog Status in pam package in Ubuntu: Confirmed Status in shadow package in Ubuntu: Confirmed Status in util-linux package in Ubuntu: Confirmed Bug description: I was investigating the use of a single high UID user (ie, 2000000000) and discovered that /var/log/lastlog grew to an enormously large sparse file: $ ls -lh /var/log/lastlog -rw-rw-r-- 1 root utmp 544G Jul 27 12:35 /var/log/lastlog The file is actually quite small though: $ ls -lh --size /var/log/lastlog 56K -rw-rw-r-- 1 root utmp 544G Jul 27 12:35 /var/log/lastlog On a standalone system, this is possibly not a problem since it is highly unlikely that a system will have 2 billion users, but this is confirmed to wreak havoc on rsync backups. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pam/+bug/1707645/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp