>>>>>> "Lex" == Lex Wennmacher <wennmach@geo.Uni-Koeln.DE> writes:
>    Lex> A hacker managed to break in into your system and even
>    Lex> managed to become root.  As a first step, he tries to cover
>    Lex> up his traces by changing the system log files
>    Lex> /var/log/authlog, /var/log/lastlog, and /var/log/wtmp. No
>    Lex> chance, the are sappnd.
>
>  Understood, but how does newsyslog work in this case?

easy.  it doesn't.  you'd have to have newsyslog running out of rc at
boot time.  along with something to rescind the sappnd flag and put it
back after newsyslog was done with those files.

and you'd have to reboot regularly to deal with log files getting
large.

it's a trade-off, simply put.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."