On Fri, 2010-02-12 at 10:34 -0700, joe@actionline.com wrote:
> .
> craig last wrote:
> 
> echo "----- \n Marking my place in the logs \n -----" \  >> /var/log/secure
> echo "----- \n Marking my place in the logs \n -----" \  >> /var/log/messages
> then try to login, then look at the logs - after the marks you just made.
> 
> Here's the result:
> 
> For secure:
> ----- \n Marking my place in the logs \n -----
> Feb 12 10:24:01 localhost crond[24469]: pam_unix(crond:session): session
> opened for user root by (uid=0)
> Feb 12 10:24:01 localhost crond[24469]: pam_unix(crond:session): session
> closed for user root
> Feb 12 10:25:01 localhost crond[24552]: pam_unix(crond:session): session
> opened for user root by (uid=0)
> Feb 12 10:25:01 localhost crond[24552]: pam_unix(crond:session): session
> closed for user root
> 
> For messages:
> ----- \n Marking my place in the logs \n -----
> Feb 12 10:24:01 localhost crond[24470]: (root) CMD (  
> /usr/share/msec/promisc_check.sh)
> Feb 12 10:24:43 localhost sshd[24518]: Failed password for joe from
> 192.168.0.68 port 34485 ssh2
> Feb 12 10:24:46 localhost last message repeated 2 times
> Feb 12 10:25:01 localhost crond[24553]: (root) CMD (  
> /usr/share/msec/promisc_check.sh)
----
Failed password for joe from 192.168.0.68

seems pretty clear to me

Craig


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss