3 ms·
I'm struggling to think of any circumstances where "log fatigue" might be a thing. File sizes aren't an issue because auth logs take up such a negligible amoun
by laumars 10y ago
I'm struggling to think of any circumstances where "log fatigue" might be a thing.
File sizes aren't an issue because auth logs take up such a negligible amount of space compared to the storage capacities we have at our disposal these days. But if your box is really that low capacity then stream your logs to a logging server (or push them to remote storage when you do your log rotate). Realistically you should be shipping your log files anyway.
Performance isn't really an issue either as larger auth logs isn't going to make sshd perform any better or worse.
There isn't really even a strong argument for the human readability impact as those logs should generally be parsed by robots instead of humans. Be it alerting systems like Nagios, reporting tools like Splunk, or firewall management services like fail2ban; in all cases you wouldn't typically be reading the auth logs in vi unless something has gone very wrong.
So I say just keep sshd listening on 22 and instead ensure your system is properly hardened (IP whitelists, SSH keys, etc) with automated processes in place that monitor the logs so you don't have to. Or better yet, don't expose SSH at all.
- laumars 10y agoI've been down voted a few times here. Interested to know why. Any care to elaborate on which bit they disagree with please
- IAmGraydon 10y agoNo idea in your case, but this place is merciless when it comes to any misinformation. That means that downvotes come easy, but that's also one of the things I like about HN.
- laumars 10y agoThat would be fine if any the people down voting were exempt from being misinformed themselves and took the time to explain why they disagreed with the comments they were down voting. But in this case I've been hardening Linux and UNIX servers professionally for years and yet still am completely in the dark about what it was that people disagreed with in my advice. The down vote itself doesn't really bother me so much as the inability for misinformation to be corrected - be that my own error or whoever (which is why I always make a point of replying to people rather than down voting).
- teddyh 10y agoFor the record, I agree with you, but you can probably get to better understand people who don’t by reading this old HN thread and article: https://news.ycombinator.com/item?id=6616019 https://news.ycombinator.com/item?id=6616019