LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-09-2005, 02:10 PM   #1
lmmix
Member
 
Registered: Feb 2005
Distribution: debian sid, blfs 6.0
Posts: 41

Rep: Reputation: 15
can i delete syslogd, klogd?


Hi,

usually, i don't read log file(/var/log/*), but in aptitude, it marked as "Priority: important".
i don't see it's usage.

i just worry about writing useless log file that hurt my HDD,
can i delete it?

Thanks for reading.
 
Old 03-09-2005, 02:57 PM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
it marked what?
 
Old 03-09-2005, 06:09 PM   #3
TruckStuff
Member
 
Registered: Apr 2002
Posts: 498

Rep: Reputation: 30
Ehhh.. I've never seen a "useless" log file, but that's just me.

At any rate, you shouldn't touch those processes. In all likelyhood you will break and/or severly cripple your system. Not a good way to end the day.
 
Old 03-10-2005, 07:50 AM   #4
lmmix
Member
 
Registered: Feb 2005
Distribution: debian sid, blfs 6.0
Posts: 41

Original Poster
Rep: Reputation: 15
hmm your reply trigger my curiosity.
ok i will give it a try. see how it going without syslogd, klogd.

--
PS: well, after rebooting, nothing failed, more noiseless
Quote:
xxx@debian:~$ su
Password:
debian:/home/xxx# aptitude
(Reading database ... xxx files and directories currently installed.)
Removing klogd ...
Stopping kernel log daemon: klogd.
Purging configuration files for klogd ...
Removing sysklogd ...
Stopping system log daemon: syslogd.
Purging configuration files for sysklogd ...
Press return to continue.
PPS: keeping update or know everything about the software/hardware make log file useless.
PPPS: oh my computer isn't server or something.

Last edited by lmmix; 03-10-2005 at 08:12 AM.
 
Old 03-10-2005, 08:11 AM   #5
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
IMO, that is a real mistake. Your logs are basically your eyes and ears when it comes to security. You should be reviewing them on a regular basis in order to spot the kind of anomalies that can be an indicator of someone attempting to break into your system. They're also critical for diagnosis hardware and software problems. If you find reading them to be overwhelming, try using something like logwatch to mail you summaries of important log events. But completely removing your logging mechanisms is a big mistake. Plus the disk activity required for logging is nothing compared to the usage of swap or /tmp. If your log files are just getting overly large, use logrotate.
 
Old 03-10-2005, 08:15 AM   #6
lmmix
Member
 
Registered: Feb 2005
Distribution: debian sid, blfs 6.0
Posts: 41

Original Poster
Rep: Reputation: 15
i hate logrotate-cron-anacron. don't ask me why.

unless owned or used by nasty ppl, i am fine with non-log-daemon system.
--
cat /dev/null > /var/log/*

PS: honestly, i never ever have seen the log files, and i will do so. When there is hardware/software problems, always i can figured it out.

PPS: i knew ssh or similar server style apps(*almost* them with the help of aptitude), like i said my computer is "public personal", and it ain't for the server. and guess what? did i installed "ssh"??

PPPS: now these days.., big brother laughing at astaro

Last edited by lmmix; 03-10-2005 at 08:36 AM.
 
Old 03-10-2005, 08:24 AM   #7
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
The point is to be able to spot break-in attempts or the information gathering before a compromise occurs. A good example is the sshbruteforce tool. Someone could try username/password combos 24-7 and you wouldn't have the slightest idea.
 
Old 03-10-2005, 08:51 AM   #8
TruckStuff
Member
 
Registered: Apr 2002
Posts: 498

Rep: Reputation: 30
Quote:
Originally posted by lmmix
unless owned or used by nasty ppl, i am fine with non-log-daemon system.
How in the world would you know if you got owned if you don't have any logging facility?? If you don't want to read logs, use windows.
 
Old 03-10-2005, 04:00 PM   #9
lmmix
Member
 
Registered: Feb 2005
Distribution: debian sid, blfs 6.0
Posts: 41

Original Poster
Rep: Reputation: 15
always, there is another way to do something, open your eyes.

--
 
Old 03-10-2005, 05:12 PM   #10
TruckStuff
Member
 
Registered: Apr 2002
Posts: 498

Rep: Reputation: 30
I'd prefer to do it the easy way rather than stitching my eyes shut completely.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
syslogd question tgo Linux - Security 5 09-25-2005 05:48 PM
klogd - how to use full version sceadu Linux - General 0 04-22-2005 09:16 AM
Tried to delete file as root but it says I don't have permission to delete it! beejayzed Mandriva 23 03-12-2004 02:46 AM
syslogd ????????????????????? lub0 Linux - General 2 09-23-2003 08:17 AM
Syslogd hypnoparadise Slackware 3 09-05-2003 12:45 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 03:43 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration