Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today I found a lot of log files empty, these were:


First, it made me wonder if I had been hacked and someone had been deleting their traces. But looking around the web for clues and searching for suspicious activity, I didn't find any.

I decided to try and restart rsyslog. And what do you think? The logs are coming in again, actually showing me someone is trying to brute-force SSH users. So I turned off password login for sshd.

So, my question is: Does rsyslog sometimes hang, and stop logging?

Could this be a logrotate issue? The syslog.1 files and similar have log data.

share|improve this question

That's due to what logrotate does. It's kinda like a log files janitor, moves them, compresses and caches. You can also consider changing SSH server's port, I run mine on 44 instead of 22 and that keeps people from doing stupid scans :)

share|improve this answer
Thank you, the issue is that the log moving must have hung up, since I ended with empty log files. – ringe May 10 '12 at 18:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.