My system is CentOS 6.1, /var/log directory was gone, what are the possible problems? I created a new /var/log, and 6 hours later it was gone again.
Is there any system log that I can inspect?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Looks like your server is compromised. I would recommend to check the following:
Immediately disable root logins. Each and everything requiring superuser privilege should be run using sudo. commands executed via sudo are logged with the username and other details at syslog or you can define the log path in /etc/sudoers. I recommend to log it outside /var/log since your /var/log is vanishing.
As a final measure you can rename /bin/rm to /bin/myrm or something else and tell trusted users to use it instead of rm. This way rouge scripts executing rm will not be able to do anything.