Hi Johnny,
Thank you for your precious tip.
Warm Regards, Mário Gamito
Johnny Hughes wrote:
You can at least strip this out to another file, so you can get it out of /var/log/messages and somewhere else.
Edit the file /etc/syslog.conf and find the line:
*.info;mail.none;authpriv.none;cron.none /var/log/messages
Change it to:
*.info;auth.none;mail.none;authpriv.none;cron.none /var/log/messages
then add these lines:
# Strip out auth info auth.* /var/log/auth
Save the file....
This will make it so that there is a seperate file that is /var/log/auth .. which will contain all auth log info
Next, you need to make sure that log file ( /var/log/auth ) is rotated like all the other syslog logs. Edit the file /etc/logrotate.d/syslog and add /var/log/auth to the top line and save the file.
Now restart syslog with the command:
/etc/init.d/syslog restart