[Bug 1059854] Re: auth.log is empty

[nick parlante]

Thanks for looking in to it Peter. Sorry for the confusion, but I did
not install syslog-ng. I left the machine with the default. Digging
around, I now see that rsyslogd is the default. Syslog-ng is what
poppped up in the package auto-complete when I typed "syslog" so I
thought, incorrectly, that's what ubuntu was using.

I suspect the problem is some sort of installer bug or race condition
here the auth.log file gets created with the wrong owner. Googling
around, you can see forum threads where people have this symptom of
auth.log staying empty now and then going back years.

This bug can at least document how to check for the problem and fix it:

/var/log/auth.log should be owned by "syslog" (not "messagebus"), so doing an ls -l should look like this
ls -l /var/log/auth.log
-rw-r----- 1 syslog adm 30310 Oct  2 12:17 /var/log/auth.log

If it is not owned by syslog, fix it like this:
sudo chown syslog /var/log/auth.log

I'll see if I can figure out how to submit a test case for it.


** Package changed: syslog-ng (Ubuntu) => rsyslog (Ubuntu)

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rsyslog in Ubuntu.
https://bugs.launchpad.net/bugs/1059854

Title:
  auth.log is empty

Status in “rsyslog” package in Ubuntu:
  New

Bug description:
  On a fresh 12.04 64 bit machine in the default state + sshd installed,
  the auth.log file remained empty, when normally it would fill up with
  sshd hacking attempts. The sshd_config was left at its default, which
  should record login failures.

  I have figured out a workaround, which is probably a good clue about
  the underlying bug.

  It turns out that the permissions of auth.log were:  messagebus
  (owner) adm (group)

  doing a

  sudo chown syslog /etc/auth.log

  fixed the problem instantly, with failed logins now going to the file
  as expected. I don't know if this "fix" will survive log rotation.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1059854/+subscriptions