My /var/log/auth.log grows at a very high rate. This is mainly due to the fact I have a service check that runs every 5 seconds. It makes sure that all the servers are online by checking that the appropriate port is open. By default, ssh logs any connect to the authentication file, including each of… http://www.drque.net/?ArticleNumber=6434#_6434