/usr/lib/tiger/doc/logfiles.txt is in tiger 1:3.2.3-12.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 | %logf001f
The log file "wtmp" should exist to show an audit trail of which user has
logged into the server. This file is accessed by the command "last".
It might not exist due to a system configuration error or an
intruder that has tried to cover this tracks by removing it.
%logf002f
The log file "btmp" should exist to log a list of bad logins.
This file is accessed using the command "lastb".
It might not exist due to a system configuration error or an
intruder that has tried to cover this tracks by removing it.
%logf003f
The log file "lastlog" should exist to show a user's most recent login
session on the server. This file is accessed by the command "lastlog".
It might not exist due to a system configuration error or an
intruder that has tried to cover this tracks by removing it.
%logf004f
The log file "utmp" should exist so that a list of current users on the
server can be listed. This is accessed by the command "who".
It might not exist due to a system configuration error or an
intruder that has tried to cover this tracks by removing it.
%logf005f
The log file does not have proper permissions set. It is recommended that
you change the permissions to those suggested for these file.
%logf005w
There are no umask entries in the configuration file. It is recommended
that there are umask entries set in the configuration file.
%logf006f
The log file "loginlog" should exist to show a user login attempts
on the server.
It might not exist due to a system configuration error or an
intruder that has tried to cover this tracks by removing it.
%logf007f
The log file "messages" should exist to show a trace of the system logs
(including reboots and kernel messages), it is also often used by the
syslog daemon to log information. The contents of the "messages" logfile
depends upon the configuration of the syslog.conf and varies by
distribution and/or system administrator preference.
It might not exist if you have configured your system to use a
different file for logging or if an intruder has tried to cover
his tracks by removing it since the messages file might contain
bad login attempts from local users and remote hosts.
|