Dave Sherohman wrote: > Has anything strange been happening in testing/woody's logging facilities > lately? > > In the last week, one of my machines has two days where the archived syslog > is completely empty (not even a "--MARK--") and this morning I found a > warning that auth.log was smaller than it had been the last time it was > checked. I'm inclined to think that someone managed to break into this > system, but first I want to check on whether there are any alternate > explanations which won't require me to wipe the drive and reinstall. >
Running Sid or Woody? Log daemon changed lately, try looking for sysklogd or klogd or both... Andrea
