Arch Linux

deconstrained

Member

Registered: 2008-03-31

Posts: 49

Frequency of /var/log/auth.log purges (question answered)

I check /var/log/auth.log almost daily for break-in attempts - always unsuccessful (knock on wood) thanks do DenyHosts. However, I recently found that the log had been emptied!

Being a little paranoid as I usually am, I thought at first that someone had broken in and was trying to cover their tracks. But then I realized it was November 1...

Is /var/log/auth.log cleared monthly? How can I control how often it is cleared, if at all?

Last edited by deconstrained (2009-11-01 17:06:36)

vacant

Member

From: downstairs

Registered: 2004-11-05

Posts: 816

Re: Frequency of /var/log/auth.log purges (question answered)

As root
Check /etc/logrotate.d/ Mine is cleared in syslog-ng
Check /etc/cron.* to find out how often logrotate is run
run crontab -l

robertp

Member

From: Warszawa, Poland

Registered: 2007-09-11

Posts: 123

Re: Frequency of /var/log/auth.log purges (question answered)

I agree with vacant. And you can run this command to see your earlier auth.log files:

ls -la /var/log/auth.log*

If you care about log files then you should definitely read more about logrotate, cron, anacron and syslog.

deconstrained

Member

Registered: 2008-03-31

Posts: 49

Re: Frequency of /var/log/auth.log purges (question answered)

Thanks!