LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices

Reply
 
Search this Thread
Old 12-13-2004, 07:58 AM   #1
Phathead
Member
 
Registered: Sep 2003
Distribution: Slackware 10.1, Slamd64 10.1, IpCop 1.4
Posts: 125

Rep: Reputation: 15
/var/log/messages empty


I noticed this morning that /var/log/messages is empty. The last file is /var/log/messages.3 which was written on Nov 22 at 13:48.

How do I get the logs back?
 
Old 12-13-2004, 08:14 AM   #2
mikeyt_333
Member
 
Registered: Jun 2001
Location: Up in the clouds
Distribution: Fedora et al.
Posts: 353

Rep: Reputation: 30
Sounds like syslog isn't running, do a "ps ax | grep syslog" and see what comes up. Then, if the syslog daemon isn't there, restart it and see if it comes back.
 
Old 12-13-2004, 08:26 AM   #3
Phathead
Member
 
Registered: Sep 2003
Distribution: Slackware 10.1, Slamd64 10.1, IpCop 1.4
Posts: 125

Original Poster
Rep: Reputation: 15
Okay, that was it. Thanks for the help.

Should I be concerned? syslogd isn't something I would stop, but I see no evidence of an intruder entering. Of course, anyone with privilages to stop syslogd could also cover their tracks.

What should I look for?
 
Old 12-13-2004, 08:37 AM   #4
mikeyt_333
Member
 
Registered: Jun 2001
Location: Up in the clouds
Distribution: Fedora et al.
Posts: 353

Rep: Reputation: 30
I'm not the best to field this. But do you have tripwire installed? Or some other form of checksum information for the drive? With syslog down, there really is no way to tell. Check your /etc/passwd for any usernames, do a netstat -l for any open ports, run nessus on your box from a remote box, do a dmesg and see if that shows anything. Do you have a firewall on the box? Dmesg will have iptables info. That's just a start, hopefully somebody else can send you in the right direction. One thing, if this is a production box, you should already have a plan or concept of how you will determine an intrusion, maybe now is the time to document your steps and be ready for next time. Good luck!

Mike.
 
Old 12-13-2004, 09:26 AM   #5
Phathead
Member
 
Registered: Sep 2003
Distribution: Slackware 10.1, Slamd64 10.1, IpCop 1.4
Posts: 125

Original Poster
Rep: Reputation: 15
Looks like a false alarm. Turns out syslogd crashed when /var/log/syslog reached 2.0 GB. So, no intruder, but I have another mystery. My syslog.3 file is filled with lines like this:

Code:
Nov 22 13:52:27 Nimitz inetd[2163]: /usr/sbin/famd: exit status 0x1
Nov 22 13:52:27 Nimitz inetd[31722]: execv /usr/sbin/famd: No such file or directory
Looks like dropline gnome strikes again. Dropline stopped working for me, so I did an uninstall, which borked my whole system. I should have just started over at that point, but instead I just used swaret to get X and KDE back. Now I'm regretting that again because fam was a dropline package, and the entry in /etc/inet.d remained after the uninstall.

This isn't what I'd call a production box. Just my home PC. It's protected by an IPCop firewall, so I'm pretty confident no one is getting in, but the missing log files really made me worried.

Thanks for your help.
 
Old 12-13-2004, 11:43 AM   #6
ringwraith
Senior Member
 
Registered: Sep 2003
Location: Indiana
Distribution: Slackware-current
Posts: 1,244

Rep: Reputation: 47
That is one of the problems with dropline that bothers me. It is pretty tough to remove it without reformatting.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
/var/log/messages is empty, and also dmesg shows nothing beagle2 Linux - General 5 11-08-2005 08:12 AM
Redirecting the kernel messages to file other than /var/log/messages jyotika_b83 Linux - General 3 04-28-2005 06:39 PM
From where am i getting error messages to /var/log/messages? prabhuacsp Programming 3 02-16-2005 08:59 AM
From where am i getting error messages to /var/log/messages? prabhuacsp Linux - Networking 1 02-16-2005 12:34 AM
/var/log/messages full of these messages. Should I be concerned? mdavis Linux - Security 5 04-16-2004 10:08 AM


All times are GMT -5. The time now is 03:10 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration