Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have denyhosts running on my server to block IPs that repeated fail to login over ssh, for example brute force style attacks. I can see that entries in the auth.log file have not been updated in the hosts.deny file for some time. How can I check what's going wrong and fix denyhosts to get it to update from the auth.log file.

I have tried restarting rsyslog and denyhosts but this doesn't solve the problem.

The contents of auth.log seem to be getting rotated to auth.log.1 instead, so when I switch the contents of these two files then denyhosts can read the auth.log properly.

I am running ubuntu 12.04 LTS.

share|improve this question
Not really giving us a lot to go on here, are you? – HopelessN00b Nov 19 '12 at 11:59
What other information would help? – niallhaslam Nov 19 '12 at 14:57

It seems that there was a conflict between logrotate and denyhosts accessing the auth.log file. This can be checked by running lsof on auth.log. Stopping denyhosts and then restarting rsyslog flushed the lock on the file and then restarting denyhosts - as a temporary fix.

Will update if I work out a permanent fix without having to constantly restart these services.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.