secure 2.3 GB file under /var/log

[DeepanshuSood1]

Hi,

I have one Virtual log collector running on v 10.4.0.2 and what i observed in that VLC, that there is one file which is being created under /var/log/ and the file name is secure and it have a size of more 2.3 GB, which i have deleted many times, but after some time it again gets appeared at the same location which is slowing down the vlc.

And below are some line of logs which are in the file if if i look into it.

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug1: user sftp matched group list uploads at line 159

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug3: match found

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug3: reprocess config:160 setting ChrootDirectory /var/netwitness/logcollector/upload_chroot

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug3: reprocess config:161 setting X11Forwarding no

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug3: reprocess config:162 setting AllowTcpForwarding no

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug3: reprocess config:163 setting PasswordAuthentication no

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug3: auth_shadow_acctexpired: today 17022 sp_expire -1 days left -17023

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug3: account expiration disabled

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug3: mm_request_send entering: type 8

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug2: monitor_read: 7 used once, disabling now

Aug  9 06:58:14 NCORP-VLC-01 sshd[14558]: debug3: mm_request_receive entering

Aug  9 06:58:14 NCORP-VLC-01 sshd[14560]: debug2: input_userauth_request: setting up authctxt for sftp

Aug  9 06:58:14 NCORP-VLC-01 sshd[14560]: debug3: mm_inform_authserv entering

Aug  9 06:58:14 NCORP-VLC-01 sshd[14560]: debug3: mm_request_send entering: type 3

Aug  9 06:58:14 NCORP-VLC-01 sshd[14560]: debug3: mm_inform_authrole entering

Aug  9 06:58:14 NCORP-VLC-01 sshd[14560]: debug3: mm_request_send entering: type 4

Aug  9 06:58:14 NCORP-VLC-01 sshd[14560]: debug3: mm_auth2_read_banner entering

Aug  9 06:58:14 NCORP-VLC-01 sshd[14560]: debug3: mm_request_send entering: type 9

Aug  9 06:58:14 NCORP-VLC-01 sshd[14560]: debug3: mm_request_receive_expect entering: type

So I am just wondering that why the logs are being generating and how to get rid from them.

Kindly advise. Thanks.

Regards,

Deepanshu Sood.

[KhaledGamal]

Hi Sood,

This is due to that debug logs are written to the /var/log/secure file. Debug logs are often not a good idea to keep on. Please send me the content of the "/etc/rsyslog.conf" so I can check.

Best regards

Khaled

[DeepanshuSood1]

Hi,

Thanks Khaled for your response.

I have actually checked it from my end for troubleshooting, but now also I have checked the file and found nothing in it.

There is no IP address is added in the file.

Below is the output.

#$ActionQueueType LinkedList   # run asynchronously

#$ActionResumeRetryCount -1    # infinite retries if host is down

# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

#*.* @@remote-host:514

# ### end of the forwarding rule ###

[root@NCORP-VLC-01 yum.repos.d]#

[root@NCORP-VLC-01 yum.repos.d]#

Regards,

Deepanshu Sood.

[KhaledGamal]

Hi Sood,

In the rsyslog.conf file you should find an entry like the below:-

# The authpriv file has restricted access.

authpriv.*                                              /var/log/secure

Change it to

# The authpriv file has restricted access.

authpriv.info                                              /var/log/secure

then restart the rsyslog service and check what happens.

Also another thing to check is the sshd configuration in /etc/ssh/sshd_config

LogLevel INFO

Make sure that it is either commented out or left as INFO not DEBUG.

The main issue you have in the secure logs is that there are debug logs there which are a lot and fills up the file quickly. You need to check how the debug logs were enabled and then disable them. Most likely it would be one of the 2 methods above.

Best regards

Khaled

[DeepanshuSood1]

Khaled I have checked both the ways.

1st way outcome

I have changed to the below and then restarted the service but when i check the time of the file it was the latest after doing the changes and the restart of the service also.

# The authpriv file has restricted access.

authpriv.info                                              /var/log/secure

2nd way outcome

I have check /etc/ssh/sshd_config and under it LogLevel INFO

It's already info not debug.

Note: But one thing i have noticed that when i stop the rsyslog service the file modification get stopped and the file get stopped updating.

But i am not sure that what impact would be if i keep the service disable, bcuz under /etc/ssh/sshd_config what I can see that there are some configuration exist for the file reader collection.

# SFTP server settings added for NwLogCollector

StrictModes no

Subsystem sftp internal-sftp

Match User sftp

    AllowTCPForwarding no

    PasswordAuthentication no

    X11Forwarding no

    ForceCommand internal-sftp

    ChrootDirectory /var/netwitness/logcollector

Match Group uploads

    ChrootDirectory /var/netwitness/logcollector/upload_chroot

    X11Forwarding no

    AllowTcpForwarding no

    PasswordAuthentication no

[root@NCORP-VLC-01 log]#

Please suggest what to do?

Regards,

Deepanshu Sood.

[KhaledGamal]

Hi Sood,

If I understand you correctly, When you stop the rsyslog service, the secure file doesn't get modified. If this is the case then this means that the change you did on the rsyslog configuration file will  help and will prevent debug logs from being written to the file.

Make sure that you restarted the rssylog service by the below command:-

service rsyslog restart

Then monitor to check if the size of the secure file gets big frequently again.

Hope this helps

Best regards

Khaled

[DeepanshuSood1]

I mean before doing any change on any file,

for a try i have stopped the rsyslog service after that the file modification gets stopped.

But After the above, i started the service again and then I followed your suggested steps and make changes in the file and then restarted the service but the file modification is still going on.

[KhaledGamal]

Are there any debug logs still?

If there is, send me the whole rsyslog.conf file.

Best regards

Khaled

[DeepanshuSood1]

sent the attachment at your email address.

[KhaledGamal]

The file seems OK.

Is the debug logs still present in the secure logs?