Re: Strange events...
On Sun, Aug 26, 2001 at 09:04:09AM -0500, David Sowder wrote:
> Did you received the logcheck warning in the logcheck message sent in the
> 7am hour for the previous hour? It's quite possible that you have a machine
> doing what one of mine is doing: On Sundays, one of the logs gets rotated
> twice. The logfile gets rotated once for a weekly cron job and then
> rotated again for a daily cron job (or maybe the other way around). You
> might check into that and find that your machine has not been compromised
> at all... :)
Yes, you're right. I hadn't been rooted but I'm still too paranoid.
The crontabbed logrotate have made some zero length file that have been mis-interpreted by logcheck.
I've spent about 5 hours to figure it out that it wasn't a remote attack but just a logrotate or crontabbed script probelm.
Best regards!
Matteo
--
Matteo Sgalaberni | Web : http://www.sgala.com
-- | E-Mail : matteo@sgala.com
System and Application Engineer |
-------------------------------------------------------------------------------
Reply to: