Bug 106978 - "daily run" incorrectly assumes auth.log is rolled more than once a year
Summary: "daily run" incorrectly assumes auth.log is rolled more than once a year
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: conf (show other bugs)
Version: 5.4-RELEASE
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-12-20 14:10 UTC by Edward Speyer
Modified: 2007-07-19 14:00 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Edward Speyer 2006-12-20 14:10:18 UTC 
I got a warning today ("Dec 20", 2006) about someone trying to break into
my system on "Dec 19".  I was very confused by this until I realised that
the log lines in question were from "Dec 19" 2005, not "Dec 19" 2006.

I'm guessing the problem here is that the log checkers don't account for
the fact that logs don't necessarily roll more than once a year.  My
auth.log happens to be less than the default rolling size (100k:
newsyslog.conf) because this machine is a stable webserver.

I only mention this bug because it's rather bad practice to give admins
these false alarms!  Especially with stuff from auth.log!

Fix: 

Log checkers need to be cleverer about remembering which log lines they've
seen before...

..or syslog should include the year in date stamps!
Comment 1 Remko Lodder freebsd_committer freebsd_triage 2006-12-20 14:54:28 UTC 
Responsible Changed
From-To: freebsd-bugs->freebsd-rc

reassign to rc team
Comment 2 Doug Barton freebsd_committer freebsd_triage 2007-02-20 18:52:49 UTC 
Responsible Changed
From-To: freebsd-rc->freebsd-bugs


periodic != rc.d
Comment 3 Gavin Atkinson freebsd_committer freebsd_triage 2007-07-19 13:59:27 UTC 
State Changed
From-To: open->closed

Duplicate of conf/70715