Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Today I found a lot of log files empty, these were:

/var/log/auth.log
/var/log/syslog
/var/log/daemon.log
/var/log/kern.log
/var/log/mail.log
/var/log/user.log
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/messages

First, it made me wonder if I had been hacked and someone had been deleting their traces. But looking around the web for clues and searching for suspicious activity, I didn't find any.

I decided to try and restart rsyslog. And what do you think? The logs are coming in again, actually showing me someone is trying to brute-force SSH users. So I turned off password login for sshd.

So, my question is: Does rsyslog sometimes hang, and stop logging?

Could this be a logrotate issue? The syslog.1 files and similar have log data.

share|improve this question
add comment

1 Answer 1

That's due to what logrotate does. It's kinda like a log files janitor, moves them, compresses and caches. You can also consider changing SSH server's port, I run mine on 44 instead of 22 and that keeps people from doing stupid scans :)

share|improve this answer
    
Thank you, the issue is that the log moving must have hung up, since I ended with empty log files. –  ringe May 10 '12 at 18:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.