It can be completely expected if sparse files exist, and /var has one of the common ones, /var/log/lastlog
lastlog - reports the most recent login of all users or of a given user
It is a sparse file, so its size on the disk is usually much smaller than the one shown by " ls -l " (which can indicate a really big file if you have in passwd users with a high UID). You can display its real size with " ls -s ".
This may or may not be what’s going on. I note that du has an option that will get size with holes included:
–apparent-size
… it may be larger due to holes in (‘sparse’) files
Duplicati would back up the holes, but unless file extension calls for no compression, they compress well.
For more about this, Google search for:
“/var/log/lastlog” “size”
or
“/var/log/lastlog” “backup”
or
“/var/log/lastlog” “exclude”
Assuming this means a direct image of the blocks without interpretation as a filesystem, that should work.
You can backup the images to get versions if you like, however they might not block-deduplicate very well.
EDIT 1:
Here’s how to put a 100 GB file on my 19 GB (3 GB left) file system with roughly zero impact on its space:
$ df -h /
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 19G 15G 3.0G 84% /
$ dd if=/dev/zero of=sparse_file conv=sparse bs=1M count=102400
102400+0 records in
102400+0 records out
107374182400 bytes (107 GB, 100 GiB) copied, 60.1291 s, 1.8 GB/s
$ df -h /
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 19G 15G 3.0G 84% /
$ du -h sparse_file
0 sparse_file
$ du -h --apparent-size sparse_file
100G sparse_file
$
EDIT 2:
If the du
with and without --apparent-size shows a possible sparse file situation, it’s possible to find files.
How to find all the sparse files in Linux