I have my pi opened to the internet for ssh access and to be more secure, I turned off password authentication and only allowed for key-based SSH. I logged into my pi earlier to check some things and I checked the /var/log/auth.log to look at the activity, but everything before today was flushed or deleted. Is this something that happens as a result of some process, maybe an update? Or is it possible that someone ssh'd into my pi and cleared the logs to cover their tracks? I've only had it open to the internet for maybe 2 weeks and I use RSA keys to log in to it, so it seems unlikely that it'd be broken so quickly. Just want to be sure I don't have to go into damage control mode.


This is a general Linux question; not Pi specific and should be asked on https://unix.stackexchange.com/ BUT is simple to answer.

Linux rotates logs on a regular basis. You should find auth.log.1 and earlier logs in auth.log.n.gz

It is possible to configure the rollover, but most have 6 or 12 compressed logs on a weekly or monthly basis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.