lastlog command prints the last login times for system accounts. Login information is read from the file /var/log/lastlog.

To print the last login of all the users:

# lastlog 

To print the records of specified days older:

# lastlog -b 10
# lastlog --before 10 

To print the logs more recent that specified days:

# lastlog -t 20
# lastlog --time 20 

To print the last login records of specified login:

# lastlog -u mike
# lastlog --user mike 

Why is the /var/log/lastlog file so large?

The lastlog file is reporting to be ~1.2TB in size. This file is large since it contains information regarding the last login for all users. The UID of nfsnobody on 64 bit systems is 4294967294 or 2^32-2, with 256kB per UID.

This file is what we call a sparse file. A sparse file is a file that contains unallocated blocks or “empty space”, as it implies, it does not actually take up filesystem space.

[root@LIN-HREL8 ~]# du -sh /var/log/lastlog
40K     /var/log/lastlog
[root@LIN-HREL8 ~]# ls -lh /var/log/lastlog
-rw-rw-r--. 1 root utmp 327G Nov 21 14:06 /var/log/lastlog
[root@LIN-HREL8 ~]# df -h /var
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/rhel-var  5.0G  2.4G  2.7G  47% /var

This file can potential give problems during backup, so ignore it.