Forum Discussion

ujjawalm's avatar
ujjawalm
Copper Contributor
Jun 30, 2020
Solved

Analysis of host data detected a large number of system log files being removed

Analysis of host data detected a large number of system log files being removed, Suspicious Command Line : rm -f /var/log/sa/sa18 We are receiving these alerts in Azure Security Center, and post checking the logs on the server we found that: 1.) This is general working logic of system to remove old sar logs older than one month. So it is expected that system will delete old logs accordingly. 2.) Why we started receiving such alerts just few days back when this OS functionality is from day 1.
  • tal_rosler's avatar
    tal_rosler
    Jul 05, 2020

    Hi ujjawalm ,

    Those alerts are result of a known temporal error in our system caused Azure Security Center to trigger alerts that shouldn't be triggered. The issue was mitigated successfully - you shouldn’t get such alerts anymore. I am very sorry for the inconvenient it caused – please feel free to ignore those alerts.

     

    Thanks,

     

    Tal Rosler,

    Product Manager, Azure Security Center.

2 Replies

  • tal_rosler's avatar
    tal_rosler
    Icon for Microsoft rankMicrosoft
    Jul 05, 2020

    Hi ujjawalm ,

    Those alerts are result of a known temporal error in our system caused Azure Security Center to trigger alerts that shouldn't be triggered. The issue was mitigated successfully - you shouldn’t get such alerts anymore. I am very sorry for the inconvenient it caused – please feel free to ignore those alerts.

     

    Thanks,

     

    Tal Rosler,

    Product Manager, Azure Security Center.

Resources