LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 02-14-2008, 05:25 PM   #1
anubis2k7
LQ Newbie
 
Registered: Feb 2008
Posts: 6

Rep: Reputation: 0
Gap in logs


Hi,

I am attempting to analyze logs on a fedora box. This machine is controlled remotely via SSH, and I would like to be able to view all users that have successfully logged in.

I have looked at the logs contained in /var/log, specifically "secure", "secure.1", "secure.2..." as well as wtmp and wtmp.1 (via last -f) however there is a gap in the logs.

The gap in the logs doesn't quite match. The wtmp.1 log ends at Jan 30 and ends at Feb 12 (wtmp).

The gap in the secure logs starts at Feb 4th and ends on the 12th. The log that should contain all the logins is secure.2, and it only has 3 login records.

Is there anyway to recover this gap?

thnx
 
Old 02-14-2008, 07:19 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Let's define the scope first. Do you suspect tampering?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
2 second gap in banshee vertigo88x Linux - Software 0 02-04-2008 07:23 PM
Gimp Gap cuco76 Linux - Software 5 07-18-2007 10:56 AM
K3B - no 2 sec gap _Lukes Linux - Software 3 02-23-2007 09:03 AM
Gap in partition sequence OK? dhave Linux - General 2 11-05-2004 06:29 AM
2 second gap with sound playback nickybarlow Linux - Software 2 07-21-2004 10:21 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:07 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration