When I tail -f my /var/secure log file the data in it is about 3 hours behind the current time. This only happens when someone attacks this particular server and the secure log files blows up with attempts. Eventually the log file will catch up when the attacks stop.

I have plenty of memory and CPU on the system. Here is lsof

rsyslogd 25935 root 8w REG 253,1 8786717 269791 /var/log/secure

It seems like rsyslogd is having buffering issues but im not sure how to fix this and it bothers me. I have mitigated the attacks so this doesn't happen very often but I would love to know why this happens.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.