On Mon, 26 Feb 2001, Robbert Hamburg wrote:
> Hello,
>
> Tonight we had a server attack. We want to analyze the server logs to see if
> we can find out who logged in at what time. However the logs seems to be
> gone or perhaps we are looking in the wrong dir of the server. Can someone
> please tell me were to look ???
> Is there anyway to report the hack or something ?? Nothing was really
> damaged only one site was brought down.
> Thanks in advance.
/var/log/*
If the logs are gone, they were deleted. This is fairly common during
crack attacks.
_______________________________________________
cobalt-security mailing list
[EMAIL PROTECTED]
http://list.cobalt.com/mailman/listinfo/cobalt-security
