In my Raspberry Pi running Debian, I have a simple script to output the IPs which have successfully logged into the system via SSH.

It's like this:

egrep 'Accepted password|Accepted publickey' /var/log/auth.log | grep -Eo  
'[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort -u

The last time I checked it, it seemed to had been logging since the first day and the list was getting pretty big. However I checked today and was surprised to see that it only contained a few lines. After checking /var/log/auth.log it seems it's being logging only since yesterday.

I don't recall doing anything to rsyslogd or anything that might have caused it to start logging again from some point. What can cause this kind of behavior?

EDIT: It seems that there is a /var/log/auth.log.1 file too which contains the rest of the data.I easily modified my script, but still wonder why that happened.


Log files are rotated & aged off. Not sure of the specifics of this log on this OS - but the tool used is "logrotate", which should have an entry for secure in /etc/logrotate.conf or /etc/logrotate.d/

  • Ok, I think I get it.But, it seems that the old log goes from Jan 31 (strange,since I got it on Feb 14 I think) to Apr 2,and there doesn't seem to be any rule which rotates them like that.Maybe it's according to the size (the old one is 8,9M).My /etc/logrotate.conf: and /etc/logrotate.d/rsyslog – user2859982 Apr 4 '15 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.