0 Lastlog size is huge ….

/var/lastlog show the huge size from ls output.

This does not make sense because df only show used size last than 1G

It turns out, the du would give more accurate size.

It is because the lastlog file is sparse file, it contain many empty space . Using –s option in the ls would show the actual size instead of pre allocated size.