I have been looking at the contents of /var/log/messages and the /etc/syslog.conf file and there appears to be a problem in my FC4 installation. I am using the default /etc/syslog.conf which was installed with the system (clean install - not upgrade).
From /etc/syslog.conf
... # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages
...
# Log cron stuff cron.* /var/log/cron
From the syslog.conf man page:
In addition to the above mentioned names the syslogd(8) understands the following extensions: An asterisk (''*'') stands for all facilities or all priorities, depending on where it is used (before or after the period). The keyword none stands for no priority of the given facility.
... Multiple selectors may be specified for a single action using the semicolon ('';'') separator. Remember that each selector in the selector field is capable to overwrite the preceding ones. Using this behavior you can exclude some priorities from the pattern.
As I read the man page, the last match, wins and 'none' means don't log. As can be seen in the following excerpt from /var/log/messages, cron is logging a lot of stuff. I am looking for a suggestion as to what to change to supress cron writing to /var/log/messages.
[styma8]: tail /var/log/messages Jan 27 12:45:01 styma8 crond(pam_unix)[14334]: session closed for user root Jan 27 12:46:01 styma8 rpc.mountd: authenticated unmount request from styma9:934 for /home (/home) Jan 27 13:00:02 styma8 crond(pam_unix)[14410]: session opened for user root by (uid=0) Jan 27 13:00:02 styma8 crond(pam_unix)[14410]: session closed for user root Jan 27 13:01:01 styma8 crond(pam_unix)[14427]: session opened for user root by (uid=0) Jan 27 13:01:01 styma8 crond(pam_unix)[14427]: session closed for user root Jan 27 13:05:01 styma8 crond(pam_unix)[14448]: session opened for user root by (uid=0) Jan 27 13:05:02 styma8 crond(pam_unix)[14448]: session closed for user root Jan 27 13:15:01 styma8 crond(pam_unix)[21672]: session opened for user root by (uid=0) Jan 27 13:15:01 styma8 crond(pam_unix)[21672]: session closed for user root
In addition to the above mentioned names the
syslogd(8) understands the following extensions: An asterisk (''*'') stands for all facilities or all priorities, depending on where it is used (before or after the period). The keyword none stands for no priority of the given facility.
Multiple selectors may be specified for a single
action using the semicolon ('';'') separator. Remember that each selector in the selector field is capable to overwrite the preceding ones. Using this behavior you can exclude some priorities from the pattern.
I believe I fixed it. I changed the default syslog.conf line to read: *.info;mail.none;authpriv.none;cron.none;pam_unix.none /var/log/messages
and added a line.
pam_unix.* /var/log/pam_unix.log
I also added a /etc/logrotate.d file named pam_unix /var/log/pam_unix.log { copytruncate weekly rotate 52 compress missingok }
Just one more thing to remember to take care of when I switch to FC5. :-|
Bob STyma