On Tue, 2006-06-27 at 16:00 -0400, Sam Drinkard wrote:
William L. Maltby wrote:
<snip>
There is no way this machine could be compromised from outside. It just can't happen. Plenty of i-nodes, plenty of disk space, no quotas, all the lock files are correct, directory perms are OK, file perms are OK, etc. It may be time to reboot anyhow and see if it comes back, or if something pops up during the reboot -- hang the run -- I need the log files to make sure some other software is working, and it appears that the logging for it is bombed too, even tho it's got it's own logging facility, it does use syslog to write. Have tried with and without it active, and no joy.
There's gotta be something strange.. now that I think about it, my daily log got really short sometime back, but don't remember exactly when. I assumed it was due to stopping a lot of processes. Hmmm.... someone tell me what processes besides syslog and dbus are required for it.. I may have stepped on my thingy myself!
The last thing I can think of, barring kernel problems or compromise...
[wild-bill@wlmlfs08 ~]$ ls -dl /var/log drwxr-xr-x 22 root root 4096 Jun 25 04:02 /var/log
<snip sig stuff>