Managing rootsh Logs

• Session logs are kept at /var/log/rootsh.archive in a compressed format.

• Where possible archive the logs to a different platform or to more persistent media.

• Setup syslog.conf to define where auth.alert messages (remember we called ''logger") should go.

• Add a ''skulking" cron job to avoid space problems and use logrotate for the syslog.