Re: [TCLUG:15173] www.isd197.k12.mn.us 03/26/00:05.01 system check(fwd)

[Mark K <mkroska@readynetgo.com>]

A syslog restart that many times in a row at that time of day and on a
Sunday suggests a logrotate.  Check the /var/log directory and verify that
the old maillong, secure, xferlog and bootlog have been moved to *.1
respectivly (i.e.: maillog.1 and a new maillog starting at 4:02am is in
it's place)  The settings for logrotate should be in /etc/ and the time of
the even is part of the cron schedule.

Hope this helps,
Mark

> Hey everyone,
> 
> I'm finally getting disciplined enough to check the system logs on my Web
> server more regularly. Actually, I've installed a little prgram called
> logcheck that reports unusual events to me hourly. The output below is one
> such report. Most of the time it's telling me about ftp connections, su-ing
> to root, etc., but this caught my eye. Why would syslogd be restarting?
> 
> Unusual System Events
> =-=-=-=-=-=-=-=-=-=-=
> Mar 26 04:02:02 www syslogd 1.3-3: restart.
> Mar 26 04:02:02 www syslogd 1.3-3: restart.
> Mar 26 04:02:02 www syslogd 1.3-3: restart.
> Mar 26 04:02:02 www syslogd 1.3-3: restart.

-- 
________________________________________________________
ReadyNET Go!, Inc.  -  Building your Business on the net
________________________________________________________
 
Mark J. Kroska
MIS Director

320.656.0765 Voice
888.447.3239 Toll Free
320.203.7052 Fax
http://www.readynetgo.com
mailto:mkroska@readynetgo.com
________________________________________________________