From owner-freebsd-questions@FreeBSD.ORG Wed Mar 9 14:24:29 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 98ACF16A4CE for ; Wed, 9 Mar 2005 14:24:29 +0000 (GMT) Received: from sccmmhc92.asp.att.net (sccmmhc92.asp.att.net [204.127.203.212]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5081D43D54 for ; Wed, 9 Mar 2005 14:24:29 +0000 (GMT) (envelope-from david.fleck@mchsi.com) Received: from grond (12-216-7-29.client.mchsi.com[12.216.7.29]) by sccmmhc92.asp.att.net (sccmmhc92) with SMTP id <20050309142428m92003apc0e>; Wed, 9 Mar 2005 14:24:28 +0000 Date: Wed, 9 Mar 2005 08:24:27 -0600 (CST) From: David Fleck Sender: dcf@grond.sourballs.org To: Mark In-Reply-To: <200503091024.j29AOsEp004882@asarian-host.net> Message-ID: <20050309082001.G98716@grond.sourballs.org> References: <200503091024.j29AOsEp004882@asarian-host.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed cc: 'FreeBSD-Questions Questions' Subject: Re: Auth.log date issue? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2005 14:24:29 -0000 On Wed, 9 Mar 2005, Mark wrote: > Which is curious, as the IP address no longer has a machine on it. Then I > checked, and after a while I suddenly noticed /var/log/auth.log was dated > March 8, 2004! Apparently, the security script just checks the date, but > not the year? Is it supposed to work this way? It gave me a good scare, > all for nothing. :) The exact same thing happened to me a few months ago. I think the script is written with the assumption that the auth.log will be rotated at least once a year; but if you don't have a lot of authorization activity, it can easily go beyond that without rotating, because the default for newsyslog.conf is to only rotate auth.log when it gets beyond a certain size. Just add a time for auth.log to rotate, and this will go away. (rotates auth.log once a month) /var/log/auth.log 600 7 256 $M1D0 Z -- David Fleck david.fleck@mchsi.com