While looking at my /var/log/messages, I've seen the following entry:


Nov 16 04:44:17 linode sshd[9213]: Accepted password for ducky from 69.65.46.113 port 2053 ssh2
Nov 16 04:44:17 linode sshd[9215]: lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
Nov 16 04:44:17 linode sshd[9215]: lastlog_openseek: /var/log/lastlog is not a file or directory!
Nov 16 04:44:18 linode sshd[9213]: lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
Nov 16 04:44:18 linode sshd[9213]: lastlog_openseek: /var/log/lastlog is not a file or directory!



Does that mean I was stupid enough and somehow got rooted? Or is it simply that the file wasn't created because there was a log rotation and it was waiting until someone logged in/logged out. I'm using Slackware

_________________
Acid-Duck@IRC [EFNet]
erik.godin At n0sp4m.sympatico.ca

I don't think its anything to worry about. I get the same thing in my LogWatch message every day with RedHat 9. If you study the times I think you'll find those errors come up every time you log into your own Linode with SSH.

I've seen some queries about this in the RH newsgroups. There is something not configured quite right so SSH can't write to /var/log/lastlog even though it exists and there doesn't seem to be an obvious permissions problem.

Does anyone know how to fix this? I'd like to know how to clean up the logs.

Ross

Now I've looked into it further, and there's a file which is /etc/logrotate.conf . In that file, I have the following:


# create new (empty) log files after rotating old ones:
create

# uncomment this if you want your log files compressed:
#compress

# some packages install log rotation information in this directory:
include /etc/logrotate.d

# Rotate /var/log/wtmp:
/var/log/wtmp {
monthly
create 0664 root root
rotate 1
}


I would of thought that's enough, it seems the conf informs the OS it should create a new file once the logs have been rotated. And no I don't get that message evertime I log in/log out, I think it's more of a problem with my log rotations, since i've verified mesages, messages.1, messages.2 and they all have that error message. Any suggestions?

_________________
Acid-Duck@IRC [EFNet]

erik.godin At n0sp4m.sympatico.ca