logs aren't updating

psychofurryewok · 11-02-2004, 01:24 AM

Hey, none of my logs, besides http logs, have updated since mid october. Don't know what's going on...any suggestions? I'm running slackware 10, got all the latest updates on the stuff I use and no suspicious activities in the logs before that point, doesn't seem like the system has been compromised. Didn't know whether to put this in security or here...suggestions though?

SirSlappy · 11-22-2004, 02:43 AM

well, if the system was compromised and they stopped the logger, of course you don't see any suspicious activity in the logs before then. Those logs might not even be your real logs.

check out /etc/login.defs to make sure that stuff is intact.
Then do..

ps -ax | grep syslogd

It should return that it is there. I not, we know why it's not logging anymore.

eelriver · 11-22-2004, 04:51 AM

Check to make sure that none of your logs are at the 2G limit. Once that happens, no more logging. Make sure to checke all logs produced by syslog, ie. var/log/messages, /var/log/syslog and /var/log/debug.
If so, edit /etc/logrotate.conf to rotate more often. To empty log files and still save correct permission information run

Code:

cat /dev/null > /var/log/messages

Repeat on other oversized logs as needed.

psychofurryewok · 11-22-2004, 10:51 AM

Looks like some logs passed the 2gig limit. Awesome, thanks for your help guys.

SirSlappy · 11-22-2004, 05:15 PM

ahh.. Nice information. I didn't know that.

Go get 'em Eel

:-)