Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just out of curiosity, what if the root user by mistakenly stops/starts any service and tried to remove those traces from the log files and save those log files. Then how can we ensure that our log file is trusted. Is there any way where even the root(superuser) also cant edit/modify the contents of the /var/log/* files.

share|improve this question
up vote 3 down vote accepted

No, there isn't. root can do everything.

You can set up syslogd to log to a different machine in addition to /var/log, or set up a cron job on that other machine to regularly copy the log files over (e.g. by issuing an rsync every minute).

You can also limit the rights you hand out to different users in your sudo configuration, but that doesn't protect against cases where restricting access is too cumbersome or people who manage to work around the restrictions anyway.

share|improve this answer
Actually with SELinux you can prevent root from modifying files inside /var/log. Of course root can disable SELinux on next reboot. – Olli Feb 10 '11 at 17:23
You can use chattr to make certain files appendable only, but root can also undo this. More useful on FreeBSD, where even root is prevented from doing some things unless in single user mode. – Rich Homolka Feb 10 '11 at 17:46
Many Thanks --Maneesh – maneeshshetty Feb 11 '11 at 19:08

As a historical note, way back in the dark ages, before fast networks and large amounts of storage, we used an analogue, write-once, tamper-evident storage system. This was a dedicated dot-matrix printer with a box of green-bar fan-fold paper behind a locked door. The boot sequence of | / - \, interspersed with the backspace character, left some interesting holes on the paper.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .