Tag Info

New answers tagged

0

Read man 3 syslog to see how programs send stuff towards the logs, less /etc/rsyslog.conf /etc/rsyslog.d/* to see how messages are distributed to log files, and man rsyslog.conf to understand the output from the previous command.


4

The output of apt-cache policy rsyslog says, rsyslog isn't installed on your system, therefore sudo apt-get install rsyslog


1

This looks like repeated attempts to log in as the root user via ssh, whether it's a real person or a bot is not clear, or particularly relevant. Reverse checking the IP shows that it's coming from Russia. It's not a good idea to be able to ssh into your system as root for precisely this reason. Of course, if you've already denied access, or not activated ...


1

Robots trying to guess your password. When you have public IP and running service on open port, they are trying all the time. If you are not specially targeted and have reasonably strong passwords or disabled password authentication, they are harmless. It is just eating your processor time. You can fight with this by hiding your service to different port, ...


1

grep "mail.addres@example.org" filename.log will print all lines containing mail.addres@example.org


2

Simple answer, using awk awk '/mail\.addres@example\.org/' file.log


2

All dpkg history is stored in /var/log/dpkg.log If you specifically want apt-get history, you'll find it in . /var/log/apt/history.log


0

I am unable to comment, so this is in the form of an answer: sudo chown root:root /usr/lib/cups/notifier/dbus might help, now that you have the permissions right. Who is user 1 on your system? If you don't know how the permissions/ownership of the file were changed from the default, the problem might be the tip of an iceberg. If so, reinstalling would be ...


1

Don't reinvent the wheel - badly. Use auditing. Tracking who accesses what files is exactly what auditing is for. A good link to get started is here. Auditing goals By using a powerful audit framework, the system can track many event types to monitor and audit the system. Examples include: Audit file access and modification See ...


6

Using iwatch iwatch o_O is a realtime filesystem monitoring program using inotify and a working local mail service For a better obscurity you should change the mail address and start the deamon as root, or something else … :) sudo apt-get install iwatch Create a configuration file with the name iwatch.xml <?xml version="1.0" ?> <!DOCTYPE ...


3

Using find The following solution works not with deleted files and, if you have not set noatime in your fstab, eg: defaults,noatime Using find after you have your account back. find ~ -atime -1 means, accessed less than 1 day. Or a combination: find ~ -atime 1 -atime -2 means 1-2 days ago from man find -atime n File was last ...


0

The output is not logged as matter of course. If it's out of your buffer (ie you have the window open still and can scroll back up), or you've closed the terminal, it's gone. Sorry. In the future, there are a couple of techniques for logging entire bash sessions.



Top 50 recent answers are included