Analysis of host data detected a large number of system log files being removed

[ujjawalm]

Analysis of host data detected a large number of system log files being removed, Suspicious Command Line : rm -f /var/log/sa/sa18 We are receiving these alerts in Azure Security Center, and post checking the logs on the server we found that: 1.) This is general working logic of system to remove old sar logs older than one month. So it is expected that system will delete old logs accordingly. 2.) Why we started receiving such alerts just few days back when this OS functionality is from day 1.

[#2 · Accepted solution]

Hi @ujjawalm ,

Those alerts are result of a known temporal error in our system caused Azure Security Center to trigger alerts that shouldn't be triggered. The issue was mitigated successfully - you shouldn’t get such alerts anymore. I am very sorry for the inconvenient it caused – please feel free to ignore those alerts.

Thanks,

Tal Rosler,

Product Manager, Azure Security Center.

[#3]

Thanks @tal_rosler