1

I have an ssh server running with ubuntu 18.04.
It is online for about a week now.

Yesterday I found out that ssh servers get attacked every single minute :(

Now i've enabled fail2ban and I have a very strong root and a very strong user password.

But of course, I still get attacked.

How big can the auth.log file get? Is there something like a limit, or will it get so big that my server gets slower? Thanks for your help and stay heathy!

Improve this question

1 Answer 1

Reset to default
4

Your Ubuntu system rotates logs to prevent them from growing to enormous size with ancient data.

Logfiles get rotated by the logrotate service. Default is weekly, and that is configurable in /etc/logrotate/ . Older logs are compressed, then eventually deleted.

  • See man logrotate and man logrotate.conf

Here's an example of what rotated logs look like:

$ ls -lh /var/log | grep auth
-rw-r-----  1 syslog    adm      46K Jul  3 07:30 auth.log
-rw-r-----  1 syslog    adm     108K Jun 30 09:32 auth.log.1
-rw-r-----  1 syslog    adm     5.5K Jun 21 15:01 auth.log.2.gz
-rw-r-----  1 syslog    adm     6.3K Jun 14 07:27 auth.log.3.gz
-rw-r-----  1 syslog    adm     7.6K Jun  7 08:58 auth.log.4.gz
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .