You can at least strip this out to another file, so you can get it out of /var/log/messages and somewhere else. Edit the file /etc/syslog.conf and find the line: *.info;mail.none;authpriv.none;cron.none /var/log/messages Change it to: *.info;auth.none;mail.none;authpriv.none;cron.none /var/log/messages then add these lines: # Strip out auth info auth.* /var/log/auth Save the file.... This will make it so that there is a seperate file that is /var/log/auth .. which will contain all auth log info Next, you need to make sure that log file ( /var/log/auth ) is rotated like all the other syslog logs. Edit the file /etc/logrotate.d/syslog and add /var/log/auth to the top line and save the file. Now restart syslog with the command: /etc/init.d/syslog restart -- Johnny Hughes <http://www.HughesJR.com/>