On Fri, 2010-02-12 at 10:34 -0700, j...@actionline.com wrote: > . > craig last wrote: > > echo "----- \n Marking my place in the logs \n -----" \ >> /var/log/secure > echo "----- \n Marking my place in the logs \n -----" \ >> /var/log/messages > then try to login, then look at the logs - after the marks you just made. > > Here's the result: > > For secure: > ----- \n Marking my place in the logs \n ----- > Feb 12 10:24:01 localhost crond[24469]: pam_unix(crond:session): session > opened for user root by (uid=0) > Feb 12 10:24:01 localhost crond[24469]: pam_unix(crond:session): session > closed for user root > Feb 12 10:25:01 localhost crond[24552]: pam_unix(crond:session): session > opened for user root by (uid=0) > Feb 12 10:25:01 localhost crond[24552]: pam_unix(crond:session): session > closed for user root > > For messages: > ----- \n Marking my place in the logs \n ----- > Feb 12 10:24:01 localhost crond[24470]: (root) CMD ( > /usr/share/msec/promisc_check.sh) > Feb 12 10:24:43 localhost sshd[24518]: Failed password for joe from > 192.168.0.68 port 34485 ssh2 > Feb 12 10:24:46 localhost last message repeated 2 times > Feb 12 10:25:01 localhost crond[24553]: (root) CMD ( > /usr/share/msec/promisc_check.sh) ---- Failed password for joe from 192.168.0.68
seems pretty clear to me Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. --------------------------------------------------- PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us To subscribe, unsubscribe, or to change your mail settings: http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
