I have a question regarding log files on a Debian box.
I'm running a low volume PHP server, so most log files are small. However,
daemon) are huge, even with log rotation.
2000K auth.log 600K fail2ban.log 200K daemon.log 5K dpkg.log 5K mail.log 5K alternatives.log 1K user.log 1K kern.log 1K php7.0-fpm.log
fail2ban contains only lots of lines with
INFO/NOTICE [sshd] Found (IP) and
auth contains various lines with
user unknown and
Failed password, presumably from automated attacks.
(SSH on the server has password logins turned off and is only accessible by RSA keys.)
I can't be reading through
auth.log manually, and failed login attempts seems like information of no value, since it's happening all the time (and did fail), so how do I relate to these two files?
Can I configure them to contain less information? Is there a way to aggregate all the failures? Is there anything in them at all that would identify a more serious or actual break-in?
Or should I just ignore the log files and focus on general system hardening, and accept that the log files unfortunately will have a lot of noise in this day and age?