From owner-freebsd-questions@freebsd.org Thu Feb 11 20:35:09 2016 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6A928AA5B94 for ; Thu, 11 Feb 2016 20:35:09 +0000 (UTC) (envelope-from vsasjason@gmail.com) Received: from mail-wm0-x230.google.com (mail-wm0-x230.google.com [IPv6:2a00:1450:400c:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id EE674E61 for ; Thu, 11 Feb 2016 20:35:08 +0000 (UTC) (envelope-from vsasjason@gmail.com) Received: by mail-wm0-x230.google.com with SMTP id g62so37338015wme.0 for ; Thu, 11 Feb 2016 12:35:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=gSBEJRDp/oxkEZTVO220m9GdtElLO268l4tUoU6Qxnw=; b=XdqLe1JHenvfW1vPzwmDKuj9PFYsGOoGORcetU6euCoWiXk8RjdSBi2VNk3IYrjpd4 U472CrU8ljdSqzl4ZzBW/cxx5hgSVWMES+Nx/sQ8VImmT/wHuG3ov5RekTkaDAyVMd9J ut9aDdVwT3eaADy1Xm4uzOABE4yfthvclwicmZamocDA4HibW/qzu2QsVlUbsmiBpqCb JoC/QA1Vyy800RfwmVzoLP3B0NPqyECRebECyzniGtf15MAbjFJdvasW9Yts1Ey6jxYd gDBEayMb9JPFl4GY+ivsL0x74AniUC1Ttb0HU/Y07LnTNETEMRQB+X7GMHSiD048d4Ao 14cA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=gSBEJRDp/oxkEZTVO220m9GdtElLO268l4tUoU6Qxnw=; b=J3pHS5+bq0TURnDturv9RgSDAOLd3qh/Zl9JN71yFpuGP3xrtjMwU3nE4Ab+450xqp UZ7z5CDiQ/n0rLkkhWG8nyOIB09OkbQPfUNqfzjYEKmTrBH7Ge4OtoDCv3mF+vvRT5p4 lqQqfKpXzpNbOZUTo4k5proT0JkQeM7OHfZ3PYgtAU08yutxUFNjbeXRN55fusulK5KQ xTpP9/HBv3Yp7d91XrpntFY+ktoXN9NoBkdDr756zZSukVqZ1okTGQBdc7+SGTlZZOIL vM//beVy35pQvgu0zSNblqueoz9F6a0tWsaUJv5sIpYpYaQJ7jWtmkmiOqK732+DlxxS I+Yg== X-Gm-Message-State: AG10YORo497xjMPsC/ZBfF+nA31nt2P75u64j4qKcFZzw3awvYJqAIE56qwk4PhpODpCSsqtWkU+00mrJXVfpQ== MIME-Version: 1.0 X-Received: by 10.194.111.232 with SMTP id il8mr56282472wjb.150.1455222907477; Thu, 11 Feb 2016 12:35:07 -0800 (PST) Received: by 10.194.246.73 with HTTP; Thu, 11 Feb 2016 12:35:07 -0800 (PST) Received: by 10.194.246.73 with HTTP; Thu, 11 Feb 2016 12:35:07 -0800 (PST) In-Reply-To: <20160211133751.a58f4c0981a0c2af16762766@3dresearch.com> References: <20160211133751.a58f4c0981a0c2af16762766@3dresearch.com> Date: Thu, 11 Feb 2016 22:35:07 +0200 Message-ID: Subject: Re: /var/log/auth.log missing From: Anton Sayetsky To: Janos Dohanics Cc: FreeBSD Questions Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Feb 2016 20:35:09 -0000 11 =D1=84=D0=B5=D0=B2=D1=80. 2016 =D0=B3. 20:47 =D0=BF=D0=BE=D0=BB=D1=8C=D0= =B7=D0=BE=D0=B2=D0=B0=D1=82=D0=B5=D0=BB=D1=8C "Janos Dohanics" =D0=BD=D0=B0=D0=BF=D0=B8=D1=81=D0=B0=D0=BB: > > Hello List, > > Just discovered that on one of my boxes (FreeBSD 9.3-STABLE #0 > r286291) /var/log/auth.log is missing. > > /etc/syslog.conf: > > # $FreeBSD: stable/9/etc/syslog.conf 238473 2012-07-15 10:55:43Z > # brueffer $ > # > # [commented stuff] > # Consult the syslog.conf(5) manpage. > +10.10.10.2 > local0.* /var/log/pfsense.log > +* > *.err;kern.warning;auth.notice;mail.crit /dev/console > *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages > security.* /var/log/security > #auth.info;authpriv.info /var/log/auth.log > auth.debug;authpriv.info /var/log/auth.log > mail.info /var/log/maillog > lpr.info /var/log/lpd-errs > ftp.info /var/log/xferlog > cron.* /var/log/cron > *.=3Ddebug /var/log/debug.log > *.emerg * > # uncomment this to log all writes to /dev/console > # [commented stuff] > # > # Cyrus > local6.debug /var/log/local6.log > !ppp > *.* /var/log/ppp.log > !* > > /etc/periodic.conf: > > monthly_statistics_enable=3D"YES" > monthly_statistics_report_devices=3D"YES" > monthly_statistics_report_ports=3D"YES" > daily_clean_hoststat_enable=3D"NO" > daily_status_mail_rejects_enable=3D"NO" > daily_status_include_submit_mailq=3D"NO" > daily_submit_queuerun=3D"NO" > # 406.status-gmirror > daily_status_gmirror_enable=3D"YES" > > I have restarted syslogd, however, no /var/log/auth.log, even though I > took actions such as ssh login which should trigger entries > in /var/log/auth.log. > > How can I fix this problem? # install -o root -g wheel -m 600 /dev/null /var/log/auth.log && service syslogd reload > Any guess what might have caused /var/log/auth.log not be created? Someone deleted it.