2

Today I found a lot of log files empty, these were:

/var/log/auth.log
/var/log/syslog
/var/log/daemon.log
/var/log/kern.log
/var/log/mail.log
/var/log/user.log
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/messages

First, it made me wonder if I had been hacked and someone had been deleting their traces. But looking around the web for clues and searching for suspicious activity, I didn't find any.

I decided to try and restart rsyslog. And what do you think? The logs are coming in again, actually showing me someone is trying to brute-force SSH users. So I turned off password login for sshd.

So, my question is: Does rsyslog sometimes hang, and stop logging?

Could this be a logrotate issue? The syslog.1 files and similar have log data.

1 Answer 1

3

That's due to what logrotate does. It's kinda like a log files janitor, moves them, compresses and caches. You can also consider changing SSH server's port, I run mine on 44 instead of 22 and that keeps people from doing stupid scans :)

1
  • Thank you, the issue is that the log moving must have hung up, since I ended with empty log files.
    – ringe
    May 10, 2012 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .