Clamav stops in /var/log

[Jason L Tibbitts III]

>>>>> "GH" == George Hare <hare.george at gmail.com> writes:

GH> ls -l /var/log/lastlog produces - 1 root root 1254130450140. Can I
GH> skip the scan of /var/log or are there security issues involved
GH> here?

/var/log/lastlog just stores the last login time of each user, in a
rather naive format.  64-bit machines support a very large number of
user IDs (32 bits worth), and this makes the file incredibly huge
(1.2TB).

These days I don't think lastlog is used for much other than printing
last login time when you login.  It should probably go away, or at
least be converted to a more resonable format.

I believe the master bug is
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146214 , but it's
not public.  Another relevant bug is
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163273 .

See also the thread at
https://www.redhat.com/archives/fedora-test-list/2005-June/msg00308.html

 - J<