[CentOS] secure file not updating

Sat Dec 13 14:44:02 UTC 2008
Mike -- EMAIL IGNORED <m_d_berger_1900 at yahoo.com>

On Fri, 12 Dec 2008 22:43:46 -0600, Barry Brimer wrote:

>> On my Centos 5 server, the secure file has not updated since Dec 10. 
>> This despite the fact that I run an sshd server that I access many
>> times per day.  Most peculiar is the fact that a swatch monitor that I
>> run on the secure file catches plenty of lines.  It is as if when
>> swatch catches a line in the file, the line is removed from the file
>> and the modification date is set back.  Hard to believe.  Any ideas?
> What is the output of "lsattr /var/log/secure"?  Do you have SELinux
> enabled, and are there any corresponding lines in
> /var/log/audit/audit.log?

# lsattr /var/log/secure
------------- /var/log/secure

selinux is disabled

/var/log/audit/audit.log appears to have lines describing a login
I did a few minutes ago, and its modification date is correct.

# ls -l /var/log/secure
-rw------- 1 root root 18950 Dec 10 12:38 /var/log/secure

# date
Sat Dec 13 09:42:36 EST 2008

I remain mystified.