<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><span class=""></span><span class="">Danke, Markus. Ich bin schon bei chkrootkit gelandet. Zwar kein Treffer (und das heißt noch nichts) aber im Moment loggt rsyslogd gar nichts, außer dem</span><div class=""><span class="">Hochfahren des kernels. Danach ist nichts mehr im syslog. Bin kurz vor einer Neuinstallation des Systems.<br class=""><br class=""></span><span class=""><font face="Courier" class=""># /etc/rsyslog.conf configuration file for rsyslog<br class="">#<br class=""># For more information install rsyslog-doc and see<br class=""># /usr/share/doc/rsyslog-doc/html/configuration/index.html<br class="">#<br class=""># Default logging rules can be found in /etc/rsyslog.d/50-default.conf<br class=""><br class=""><br class="">#################<br class="">#### MODULES ####<br class="">#################<br class=""><br class="">module(load="imuxsock") # provides support for local system logging<br class="">#module(load="immark") # provides --MARK-- message capability<br class=""><br class=""># provides UDP syslog reception<br class="">#module(load="imudp")<br class="">#input(type="imudp" port="514")<br class=""><br class=""># provides TCP syslog reception<br class="">#module(load="imtcp")<br class="">#input(type="imtcp" port="514")<br class=""><br class=""># provides kernel logging support and enable non-kernel klog messages<br class="">module(load="imklog" permitnonkernelfacility="on")<br class=""><br class="">###########################<br class="">#### GLOBAL DIRECTIVES ####<br class="">###########################<br class=""><br class="">#<br class=""># Use traditional timestamp format.<br class=""># To enable high precision timestamps, comment out the following line.<br class="">#<br class="">$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat<br class=""><br class=""># Filter duplicated messages<br class="">$RepeatedMsgReduction on<br class=""><br class="">#<br class=""># Set the default permissions for all log files.<br class="">#<br class="">$FileOwner syslog<br class="">$FileGroup adm<br class="">$FileCreateMode 0640<br class="">$DirCreateMode 0755<br class="">$Umask 0022<br class="">$PrivDropToUser syslog<br class="">$PrivDropToGroup syslog<br class=""><br class="">#<br class=""># Where to place spool and state files<br class="">#<br class="">$WorkDirectory /var/spool/rsyslog<br class=""><br class="">#<br class=""># Include all config files in /etc/rsyslog.d/<br class="">#<br class="">$IncludeConfig /etc/rsyslog.d/*.conf<br class=""></font><br class="">und /etc/rsyslog.d/50-default.conf:</span><div class=""><span class=""><br class=""></span></div><span class=""><font face="Courier" class=""># Default rules for rsyslog.<br class="">#<br class=""># For more information see rsyslog.conf(5) and /etc/rsyslog.conf<br class=""><br class="">#<br class=""># First some standard log files. Log by facility.<br class="">#<br class="">auth,authpriv.* /var/log/auth.log<br class="">*.*;auth,authpriv.none -/var/log/syslog<br class="">#cron.* /var/log/cron.log<br class="">#daemon.* -/var/log/daemon.log<br class="">kern.* -/var/log/kern.log<br class="">#lpr.* -/var/log/lpr.log<br class="">mail.* -/var/log/mail.log<br class="">#user.* -/var/log/user.log<br class=""><br class="">#<br class=""># Logging for the mail system. Split it up so that<br class=""># it is easy to write scripts to parse these files.<br class="">#<br class="">#<a href="http://mail.info" class="">mail.info</a> -/var/log/<a href="http://mail.info" class="">mail.info</a><br class="">#mail.warn -/var/log/mail.warn<br class="">mail.err /var/log/mail.err<br class=""><br class="">#<br class=""># Some "catch-all" log files.<br class="">#<br class="">#*.=debug;\<br class=""># auth,authpriv.none;\<br class=""># news.none;mail.none -/var/log/debug<br class="">#*.=info;*.=notice;*.=warn;\<br class=""># auth,authpriv.none;\<br class=""># cron,daemon.none;\<br class=""># mail,news.none -/var/log/messages<br class=""><br class="">#<br class=""># Emergencies are sent to everybody logged in.<br class="">#<br class="">*.emerg :omusrmsg:*<br class=""><br class="">#<br class=""># I like to have messages displayed on the console, but only on a virtual<br class=""># console I usually leave idle.<br class="">#<br class="">#daemon,mail.*;\<br class=""># news.=crit;news.=err;news.=notice;\<br class=""># *.=debug;*.=info;\<br class=""># *.=notice;*.=warn /dev/tty8<br class=""></font><br class=""><blockquote type="cite" class="">Am 04.10.2023 um 17:58 schrieb Markus Winkler <<a href="mailto:ml@irmawi.de" class="">ml@irmawi.de</a>>:<br class=""><br class="">Hallo Christoph,<br class=""><br class="">ich habe hier kein Ubuntu zum Nachschauen, aber:<br class=""><br class="">On 04.10.23 14:58, Christoph Kukulies wrote:<br class=""><blockquote type="cite" class="">/etc/rsyslog.d/50-defaults:<br class=""></blockquote><br class="">existiert da eigentlich eine /etc/rsyslog.conf und wenn ja, wie sieht die aus?<br class=""><br class="">Damit Rsyslog die Postfix-Logs _nicht_ (zusätzlich) nach /var/log/syslog schreibt, müsstest Du das hier:<br class=""><br class=""><blockquote type="cite" class="">*.*;auth,authpriv.none -/var/log/syslog<br class=""></blockquote><br class="">in:<br class=""><br class="">*.*;auth,authpriv.none,mail.none -/var/log/syslog<br class=""><br class="">ändern. Mache ich bei Debian jedenfalls immer so, weil ich in /var/log/syslog keine Logs von Postfix haben will.<br class=""><br class="">Viele Grüße<br class="">Markus<br class=""></blockquote><br class=""></span></div></body></html>