Portal Home > Knowledgebase > Articles Database > MC LOG (Midnight commander )
MC LOG (Midnight commander )
| Posted by jestin_virtual, 10-10-2009, 06:15 AM |
| HELLO !
would you please let me know how to check the log of MC(Midnight commander ) !
Thank You
|
| Posted by 040Hosting, 10-10-2009, 07:07 AM |
| afaik mc does not have its own logs (you can enable it for ftp with the -l command line though) but other as that it is just a file-management application; why would it have logs ?
|
| Posted by jestin_virtual, 10-10-2009, 07:17 AM |
| i have Cpanel SERVER including 5 sites and based on cpanel
i think someone has deleted the logs because when i`m using LAST Command server showd the ip`s which connected from 1st of OCT and not before that !!
i checked "history command" the command works well and has not been removed but i couldn`t see anything which proofed someone has removed the log that`s why i wanted check the MC Log
|
| Posted by 040Hosting, 10-10-2009, 07:30 AM |
| In that case you would have seen in your .bash_history file of root that someone started mc; but mc itself does not have a log as far as i know.
|
| Posted by jestin_virtual, 10-10-2009, 07:47 AM |
| Hi , please let me know how to use ".bash_history"
|
| Posted by Dan_EZPZ, 10-10-2009, 08:33 AM |
| Type -
It should show you what was last run inside SSH.
|
| Posted by jestin_virtual, 10-10-2009, 09:26 AM |
| All command in history have entered by me !
just i`m afraid how my "Last Command" has showed ftom 1st OCt
someone should removed that !
|
| Posted by jestin_virtual, 10-10-2009, 09:31 AM |
| let me know how to check the History including DATE , i mean i want to see the DATE of the history also
|
| Posted by jestin_virtual, 10-10-2009, 04:12 PM |
| Hello !
i have 10 websites based on WHM , we are not selling share hosting and using server only for our company`s websites
i have never removed my Logs and i didn`t update Apache for long time !
when i check the "Last "Command all logs has started from 1st-Oct is it mean someone has access to our server and he has deleted the Logs ? (using this server since 2006)
However , history has not removed and i couldn`t find any command which could deleted my logs ,
it might be problem ? of course i couldn`t find anything in history but they could use MC to remove something
just let me know how to "Last" logs could be deleted !!
Thank You
|
| Posted by 040Hosting, 10-10-2009, 04:51 PM |
| Seems your second post about this issue; i misread your first post; last history will be cleared every month, mostlikely because you use a logrotation script; this is perfectly normal.
Most likely you got to check : /etc/logrotate.conf
and find the monthly clean of wtmp
|
| Posted by 040Hosting, 10-10-2009, 04:51 PM |
| So it was a duplicate post; answer and reason can be found here http://www.webhostingtalk.com/showthread.php?t=896307
|
| Posted by madaboutlinux, 10-10-2009, 05:41 PM |
| Right, what "040hosting" have said is true. By default logs are set to rotate to save the disk space on the server. You will have to check the log rotation configuration file at /etc/logrotate.conf and see how are they scheduled to rotate. The log files that are set to rotate is specified under the /etc/logrotate.d/ directory.
|
| Posted by jestin_virtual, 10-11-2009, 12:04 PM |
| Dear Sir ,
My History command works well / the problem is "Last" Command
-- please check the below setting :
[root@server /]# cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
#compress
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}
# system-specific logs may be also be configured here.
[root@server /]#
|
| Posted by Steven, 10-11-2009, 12:14 PM |
| Meh.
On centos for example... It does not rotate.
You could have been root exploited via a kernel exploit + a php exploit. That would not show up in your history.
What kernel are you running?
BTW:
wtmp begins Sat Dec 13 04:13:21 2008
Default install. No rotation.
|
| Posted by jestin_virtual, 10-11-2009, 12:37 PM |
| using this server for 3 years but i`m upgrading kernel and another software(s) every month
i sent you the file , that could be rotate ?
|
| Posted by Steven, 10-11-2009, 01:07 PM |
| There was a recent exploit did you patch for it?
That file you pasted is not the rotate file. The rotate file for specific logs is stored in /etc/logrotate.d
|
| Posted by 040Hosting, 10-11-2009, 02:24 PM |
| This is partly true; the logrotate.conf file is used but on default centos installations it has specified a minimum filesize (1M) which obivously is not filled after one month. But the configuration the OP shows has not set this minimum file size and therefor rotating it every single month.
A simple man of logrotate would show you that this configuration file is used by default.
If the OP simply ads : minsize 1M it will not rotate that often anymore.
Just to show: In /etc/cron.daily logrotate will be executed once a day containing the following:
Last edited by 040Hosting; 10-11-2009 at 02:28 PM.
Reason: added clarification
|
| Posted by MikeDVB, 10-11-2009, 02:56 PM |
| Default for CentOS5 on all of my machines...:
From /etc/logrotate.conf
# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
minsize 1M
create 0664 root utmp
rotate 1
}
|
| Posted by jestin_virtual, 10-11-2009, 05:37 PM |
| Dear , Logs aren`t important for me , i wanted to know why my logs have removed ,
so you think my log are deleted 1st of each month ?
|
| Posted by madaboutlinux, 10-11-2009, 06:04 PM |
| See the last part of the /etc/logrotate.conf file you forwarded in your previous post i.e. the part which states
# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}
The 'last' command shows the output from the file "/var/log/wtmp" which is set to rotate every month and a backup will also be saved as /var/log/wtmp.1.gz which contains the last months logs.
If you wish to save more logs, just edit the /etc/logrotate.conf file and set "rotate" to some higher value.
Just FYI, no one removed your logs, it's the default settings that rotates them every month.
Last edited by madaboutlinux; 10-11-2009 at 06:07 PM.
|
| Posted by 040Hosting, 10-12-2009, 01:46 AM |
| I think I wrote down quite clearly why your logs are removed (by logrotate); and that they are not deleted by any third party (by any hacker or bad script).
If you are not familiar with administrating your own linux machine it might be a good idea to get yourself a managed service which might be better suiting you, so you do not have to worry about these things.
|
Add to Favourites 
Print this Article
Also Read
Shared Hosting
Shared Hosting
