Hi guys:
I could only find one answer for this topic via google, and the poster wasnt' sure if he was breaking something with his "fix".
I there a way to redirect the cron session messages from syslog to a different log?
i.e.: Aug 15 01:03:01 tn1 crond(pam_unix)[29303]: session opened for user root by (uid=0) Aug 15 01:03:07 tn1 crond(pam_unix)[29303]: session closed for user root
I tried cron.none and crond.none (and the correspondine lines to put those in their own file) in syslog.conf but neither redirected.
The other guys solution was: ===== I disabled the session line in /etc/pam.d/crond this line : session required /lib/security/$ISA/pam_stack.so service=system-auth to this line : #session required /lib/security/$ISA/pam_stack.so service=system-auth =====
But I'm not real comfortable with that.
Anyone know? Thans, Scott
Am Mo, den 15.08.2005 schrieb scott.list um 15:13:
I could only find one answer for this topic via google, and the poster wasnt' sure if he was breaking something with his "fix".
I there a way to redirect the cron session messages from syslog to a different log?
i.e.: Aug 15 01:03:01 tn1 crond(pam_unix)[29303]: session opened for user root by (uid=0) Aug 15 01:03:07 tn1 crond(pam_unix)[29303]: session closed for user root
I tried cron.none and crond.none (and the correspondine lines to put those in their own file) in syslog.conf but neither redirected.
Thans, Scott
Edit /etc/syslog.conf and change it like this:
# Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;local5.none;authpriv.none;cron.none;auth.!=info /var/log/messages
that config line has just "auth.!=info" appended
# Log cron auth messages in a separate file. auth.info /var/log/cron.auth
add that instruction
After "service syslog restart" the syslog messages caused by cron will appear in /var/log/cron.auth only.
Alexander
Alexander:
Thanks very much for the help. Your input solved the issue. I tweaked the solution a little to put the cron and cron auth messages in the same file. For the archives I have these lines relavant to the issue in syslog.conf:
# Main syslog *.info;mail.none;authpriv.none,cron.none,auth.!=info /var/log/messages
# Cron messages cron.*,auth.info /var/log/cron
Thanks again, Scott