/var/log/auth.log missing

[Anton Sayetsky]

11 февр. 2016 г. 20:47 пользователь "Janos Dohanics" <web at 3dresearch.com>
написал:
>
> Hello List,
>
> Just discovered that on one of my boxes (FreeBSD 9.3-STABLE #0
> r286291) /var/log/auth.log is missing.
>
> /etc/syslog.conf:
>
> # $FreeBSD: stable/9/etc/syslog.conf 238473 2012-07-15 10:55:43Z
> # brueffer $
> #
> #       [commented stuff]
> #       Consult the syslog.conf(5) manpage.
> +10.10.10.2
> local0.*                                        /var/log/pfsense.log
> +*
> *.err;kern.warning;auth.notice;mail.crit                /dev/console
> *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err
 /var/log/messages
> security.*                                      /var/log/security
> #auth.info;authpriv.info                                /var/log/auth.log
> auth.debug;authpriv.info                                /var/log/auth.log
> mail.info                                       /var/log/maillog
> lpr.info                                        /var/log/lpd-errs
> ftp.info                                        /var/log/xferlog
> cron.*                                          /var/log/cron
> *.=debug                                        /var/log/debug.log
> *.emerg                                         *
> # uncomment this to log all writes to /dev/console
> # [commented stuff]
> #
> # Cyrus
> local6.debug                                    /var/log/local6.log
> !ppp
> *.*                                             /var/log/ppp.log
> !*
>
> /etc/periodic.conf:
>
> monthly_statistics_enable="YES"
> monthly_statistics_report_devices="YES"
> monthly_statistics_report_ports="YES"
> daily_clean_hoststat_enable="NO"
> daily_status_mail_rejects_enable="NO"
> daily_status_include_submit_mailq="NO"
> daily_submit_queuerun="NO"
> # 406.status-gmirror
> daily_status_gmirror_enable="YES"
>
> I have restarted syslogd, however, no /var/log/auth.log, even though I
> took actions such as ssh login which should trigger entries
> in /var/log/auth.log.
>
> How can I fix this problem?
# install -o root -g wheel -m 600 /dev/null /var/log/auth.log && service
syslogd reload

> Any guess what might have caused /var/log/auth.log not be created?
Someone deleted it.