Re: Possible hack? Logs clear & syslogd restarted...need help!

From: Bit Twister (BitTwister_at_localhost.localdomain)
Date: 02/01/04


Date: Sun, 01 Feb 2004 17:51:43 GMT

On 1 Feb 2004 09:40:54 -0800, Robert wrote:
>
> Is there a reason why these are clear? I never empty these manually.
> Is there something that does this automatically or am I being
> paranoid?

I'll bet you left your system on overnight and /etc/cron.daily had a
chance to run. In that directory you might find something like
logrotate which said since it is Sunday, I'll rotate the logs.

If not, you might look on http://www.chkrootkit.org/ for code to see if root
kits have been installed.

You also can do a
    rpm -Va | grep '..5' > /tmp/verify
to see what has changed on the system.
   man rpm
to understand /tmp/verify contents.