You are not logged in.
I check /var/log/auth.log almost daily for break-in attempts - always unsuccessful (knock on wood) thanks do DenyHosts. However, I recently found that the log had been emptied!
Being a little paranoid as I usually am, I thought at first that someone had broken in and was trying to cover their tracks. But then I realized it was November 1...
Is /var/log/auth.log cleared monthly? How can I control how often it is cleared, if at all?
Last edited by deconstrained (2009-11-01 17:06:36)
Offline
As root
Check /etc/logrotate.d/ Mine is cleared in syslog-ng
Check /etc/cron.* to find out how often logrotate is run
run crontab -l
Offline
I agree with vacant. And you can run this command to see your earlier auth.log files:
ls -la /var/log/auth.log*
If you care about log files then you should definitely read more about logrotate, cron, anacron and syslog.
Offline
Thanks!
Offline