2

Today I found a lot of log files empty, these were:

/var/log/auth.log
/var/log/syslog
/var/log/daemon.log
/var/log/kern.log
/var/log/mail.log
/var/log/user.log
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/messages

First, it made me wonder if I had been hacked and someone had been deleting their traces. But looking around the web for clues and searching for suspicious activity, I didn't find any.

I decided to try and restart rsyslog. And what do you think? The logs are coming in again, actually showing me someone is trying to brute-force SSH users. So I turned off password login for sshd.

So, my question is: Does rsyslog sometimes hang, and stop logging?

Could this be a logrotate issue? The syslog.1 files and similar have log data.

1 Answer 1

3

That's due to what logrotate does. It's kinda like a log files janitor, moves them, compresses and caches. You can also consider changing SSH server's port, I run mine on 44 instead of 22 and that keeps people from doing stupid scans :)

1
  • Thank you, the issue is that the log moving must have hung up, since I ended with empty log files.
    – ringe
    May 10, 2012 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.