Tag Info

New answers tagged

0

Figured it out. Found I could verify syslog-ng working with a simple logger 'testing syslog-ng' syslog-ng successfully logged the message to /var/log/messages. This told me that the problem was nothing was coming from sshd. Went "back to the beginning" and pinged the host name of the target box from my source box. Found out that the IP address of the ...


0

on the remote box, try running ssh with the -vvv option to get verbose output from the client. That might help to resolve the issue.


0

You can trigger an action for identified messages as explained here. In Suricata you can find an example of use.


0

Yea, install EPEL6 and then install the syslog-ng package from that repo: http://dl.fedoraproject.org/pub/epel/6/x86_64/repoview/syslog-ng.html


0

You're misunderstanding how filters are applied. While this filter and log line does exactly what you're asking them to, they don't affect the other log commands that you have elsewhere in your config. Instead of directing this filter to /dev/null, you should use it to exclude messages matching the filter in the filter statement for the regular cron log. ...


2

Yes, your VPS is always under attack. But no, that's not what this log entry shows. This is legitimate activity. It's anacron, running the daily /etc/cron.daily/lighttpd job, as you saw. In the (corrected) lighttpd cron script, you can see that the script is running su www-data, and the log file shows root changing user to www-data.



Top 50 recent answers are included