Strange log entry

[Scott E Smith]

I got the following message in my syslog early yesterday .....
Jun 18 00:52:46 hostname root: Hey, look I'm logged on as root at the console. Not good...
Jun 18 00:52:47 hostname root:
Jun 18 00:52:53 hostname root: d

Does anyone have any ideas on what this might be?

[John Poff · Accepted solution]

Hello,

It looks like someone logged in as root and used the 'logger' command to leave you a message in syslog. Not good. If you don't know who did it you'd better start checking to see if your system has been compromised.

You can write messages to syslog.log via the logger command, and it records your hostname and your user id. I hope everything is ok for you.

JP

[PIYUSH D. PATEL]

Hi,

This certainly means that somebody has logged in into your system with root login. Have you given the root access to anybody.

Then he has used the logger command to pass this message to your syslog.log file

Piyush

[Jeff Schussele]

Hi Scott,

I'd suspect that someone left the console logged in as root & someone came along & ran the logger command which allows root to make syslog entries. The "d" was *probably* a failed ctrl-d that got logged.....

The other scenario is that someone has the root PW & su'd up & made those entries - again using logger.

Note these didn't necessarily have to be done from the console....syslog doesn't log tty info.

In either case, you need to lock this box down some more. Looks like that was the *purpose* of this exercise.

Rgds,
Jeff

[Victor_5]

I never see that before in syslog, obviously it is not wrote by system, the first thing I can do, if I were you, is change password right away, and try to find the root cause if you can.

[Thomas D. Harrison]

A suggestion or two.

last -R root | more ==> to see where root was logged in from during this time period.

view /var/adm/sulog ==> to see who might have su'd to root.

Of course, if you find that the id HACKER su'd to root you could try last -R HACKER | more

Good luck!

Thom