3 Replies Latest reply on Oct 1, 2015 2:06 PM by Bill Robinson

    rscd.log log file has been tampered

    Joe Piotrowski

      We have an 8.6 Windows agent installed on 2008 R2 server with Secure log files (enabled) and Logging of remote keystrokes (enabled).


      When I run a bllogman list --verify against a server it returns this:


      host% bllogman list --verify servername

      Logfile(s) for host servername with status:

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log () --> Inconsistent

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log1 () --> Consistent

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log2 () --> Unknown

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log3 () --> Inconsistent

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log4 () --> Consistent

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log5 () --> Inconsistent

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log6 () --> Consistent

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log7 () --> Consistent

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log8 () --> Unknown

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log9 () --> Consistent

      /C/Program Files/BMC Software/BladeLogic/RSCD/rscd.log10 () --> Consistent


      When I attempt to run a compliance job against that server I only see this in the logs:

      fb267e23d2a3f61c58f7 0000013264 09/28/15 15:37:39.489 WARN     rscd -  servername 5328 BladeLogicRSCD (Not_available): (Not_available): C:/Program Files/BMC Software/BladeLogic/RSCD/rscd.log log file has been tampered


      What is or might be happening here? Could this cause the job to not run? I searched the Communities on this and couldn't find anything.