I have denyhosts running on my server to block IPs that repeated fail to login over ssh, for example brute force style attacks. I can see that entries in the auth.log file have not been updated in the hosts.deny file for some time. How can I check what's going wrong and fix denyhosts to get it to update from the auth.log file.
I have tried restarting rsyslog and denyhosts but this doesn't solve the problem.
The contents of auth.log seem to be getting rotated to auth.log.1 instead, so when I switch the contents of these two files then denyhosts can read the auth.log properly.
I am running ubuntu 12.04 LTS.