/var/log/messages

[AndyII]

seems as of yesterday, the log stopped recording root logins, and I dont see any un authorized attempts either, somehow I think something has changed .
Other things are recorded so I know it partly

 

[scsi]

They usually are not in /var/log/messages. Check other logs in /var/logs

or else make sure that syslogd is still running

 

[AndyII]

Guess my daughter figured I was done typing and hit "Submit: lol
anyways syslogd: Already running.
I did restart it the other day as noting was showing at all,

Now this is the log I view a lot and see all the ssh tries, but as of today, there are none, been all morning pouring over all the log types, like secure, secure1..., messages, messages1....., searching google

just found something I am not sure about, in etc/security, there is a file there called access, this seems very odd to me