Visit Jeremy's Blog.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 02-09-2007, 10:34 PM   #1
LQ Newbie
Registered: Dec 2003
Location: New Zealand
Distribution: Fedora 9, 10 live CD
Posts: 23

Rep: Reputation: 15
security log FC5 stops running -howto restart?

Checking logs I find that Fedora 5 security log has stopped running. Can it be restarted from the command line? Other logs and message log are running up to today.
Old 02-10-2007, 12:59 AM   #2
Registered: Aug 2004
Location: India
Distribution: Redhat 9.0,FC3,FC5,FC10
Posts: 257

Rep: Reputation: 30
Hey Cirman,
How do you understand that the security log has stopped? Do you see something in your other logs that syslog has stopped?

Also you mention that the other logs are running properly. That means syslog looks to be running properly.Where are you looking to confirm this?

Please post the output of the following commands here:

who -r
cat /etc/syslog.conf
ps aux | grep syslog
chkconfig --list | grep syslog
By default I believe a lot of the security logs get logged to /var/log/secure. So each time say you log in to your box you should get a line in /var/log/secure , something like this:

[root@snort log]# grep secure /etc/syslog.conf
authpriv.*                                              /var/log/secure
[root@snort log]# grep secure /etc/syslog.conf
authpriv.*                                              /var/log/secure
[root@snort log]# ll /var/log/secure*
-rw-------    1 root     root           98 Feb 10 12:19 /var/log/secure
-rw-------    1 root     root          192 Feb  3 17:49 /var/log/secure.1
-rw-------    1 root     root          982 Jan 27 18:14 /var/log/secure.2
-rw-------    1 root     root          175 Jan 20 12:51 /var/log/secure.3
-rw-------    1 root     root            0 Jan  7 04:02 /var/log/secure.4
[root@snort log]# cat /var/log/secure
Feb 10 12:19:15 snort sshd[27158]: Accepted password for root from port 1482 ssh2
[root@snort log]#
Are you getting anything like this? If not you might want to try and restart syslog from the command line using:
service syslog restart
and see if that helps.

Post back if you're still having problems.

Old 02-10-2007, 02:51 PM   #3
LQ Newbie
Registered: Dec 2003
Location: New Zealand
Distribution: Fedora 9, 10 live CD
Posts: 23

Original Poster
Rep: Reputation: 15
security log FC5 - stopped?

Thanks for your reply Arvind. I am guessing it has stopped - there have been no entries since 13 January 2007, yet prior to that date an entry appeared on a regular basis - sometimes more than one a day. It is the same with syslog which has entries appearing every day. I just suspected I had been hacked an a vital log stopped from outside.... Some of the entries I see do not mean very much too me yet, but I am making progress having successfully stopped pinging to my desktop and getting a full 'stealth report' from for what it is worth. I just go to Administration link and open 'systems log' tab - I then see the text in a panel. That is not using the Command line but desktop graphic interface.



Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
FC5 Install stops after anaconda loads... avaleriu Fedora - Installation 3 11-14-2006 01:14 AM
FC5 restart httpd stops mysql dradept Linux - Newbie 2 11-12-2006 03:10 AM
howto start ntpdate after restart ? cccc Debian 4 08-13-2006 06:57 PM
HOWTo restart downloading with wget ashwin_cse Red Hat 5 08-26-2004 10:07 AM
How to restart the group security? explorer1979 Linux - Security 0 09-02-2001 10:17 PM

All times are GMT -5. The time now is 09:11 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration