Re: Strange events...
On Sun, 26 Aug 2001, Matteo Sgalaberni wrote:
>Hello! This morning I cheked mail and I found a strange message by
>logcheck from a my server...
>
>Unusual System Events
>=-=-=-=-=-=-=-=-=-=-=
>***************
>*** WARNING ***: Log file /var/log/mail.log is smaller than last time checked!
>*************** This could indicate tampering.
>
[snip]
Did you received the logcheck warning in the logcheck message sent in the
7am hour for the previous hour? It's quite possible that you have a machine
doing what one of mine is doing: On Sundays, one of the logs gets rotated
twice. The logfile gets rotated once for a weekly cron job and then
rotated again for a daily cron job (or maybe the other way around). You
might check into that and find that your machine has not been compromised
at all... :)
--
David R. Sowder
Network Manager/Lead Software Technician
Southwestern Adventist University
http://www2.swau.edu/~davids/ Primary Email Address: davids@swau.edu
Reply to: