- POP user authentication
- FTP user authentication
- SSH logins
- Potentially malicious ethernet packets - Apache + CGI activity

PREREQUISITES: logrotate

last updated: Apr. 2005

Set log rotation:

cat > /etc/logrotate.conf << "EOF"
weekly
rotate 4
create
include /etc/logrotate.d

/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}
EOF

chmod 644 /etc/logrotate.conf 

set syslog logrotations:

cat > /etc/logrotate.d/syslog << "EOF"
/var/log/firewall
/var/log/cron 
/var/log/debug 
/var/log/maillog 
/var/log/mail.notice
/var/log/messages 
/var/log/secure 
/var/log/spooler 
/var/log/syslog {
    sharedscripts
    postrotate
 /bin/kill -HUP `cat /var/run/syslogd.pid 2>/dev/null` 2>/dev/null || true
    endscript
}
EOF

Manually run logrotate to check for errors:

/usr/sbin/logrotate /etc/logrotate.conf

logrotate in Slackware runs daily by default:

/etc/cron.daily/logrotate

cat > /etc/cron.daily/logrotate << "EOF"
#!/bin/sh
/usr/sbin/logrotate /etc/logrotate.conf
EOF

chmod 755 /etc/cron.daily/logrotate