In my Raspberry Pi running Debian, I have a simple script to output the IPs which have successfully logged into the system via SSH.It's like this:  #!/bin/bashegrep 'Accepted password|Accepted publickey' /var/log/auth.log | grep -Eo  '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort -uThe last time I checked it, it seemed to had been logging since the first day and the list was getting pretty big.However I checked today and was surprised to see that it only contained a few lines.After checking /var/log/auth.log it seems it's being logging only since yesterday.I don't recall doing anything to rsyslogd or anything that might have caused it to start logging again from some point.What can cause this kind of behavior?EDIT: It seems that there is a /var/log/auth.log.1 file too which contains the rest of the data.I easily modified my script, but still wonder why that happened.
What can cause auth.log to start over again?
debian;logs;rsyslog