[NTLUG:Discuss] on /var/log/secure files and "last"

[Doug Shaw]

Kelly Scroggins wrote:

> I knew the file will "split" but the files are identical.  I was under the
> impression that the second, third, etc. files would continue the logging process
> sequentially.
> 
> I've checked the syslog process and it's running.  I'll try the last command

The files split because of "logrotate."  So far as I'm aware that ability is
not a part of syslog.  logrotate can be configured to rotate your log files
based on various criteria.

Check /etc/syslog.conf; if syslog is running then has syslog.conf been
changed?  If it no longer tells syslog to put its security information into
/var/log/secure (or analogous files) then the fact that it is running means
nothing.

And last but not less (pun intended), "last" does not pull its information
from the lastlog, it uses wtmp.  "man last"  If I am wrong, I'm certain that
someone will correct me (please).

Doug