Quieting down /var/log/messages 1

[Yrrk]

Due to the fact that our network group kills idle connections after 10 minutes, I get a lot of this in /var/log/messages when I stay logged in..

Anyone know how to prevent this level of logging?

Jul 31 09:00:01 ps-sm-poly3u-10 crond(pam_unix)[5205]: session opened for user root by (uid=0)
Jul 31 09:00:01 ps-sm-poly3u-10 crond(pam_unix)[5205]: session closed for user root
Jul 31 09:01:01 ps-sm-poly3u-10 crond(pam_unix)[5208]: session opened for user root by (uid=0)
Jul 31 09:01:01 ps-sm-poly3u-10 crond(pam_unix)[5208]: session closed for user root
Jul 31 09:10:01 ps-sm-poly3u-10 crond(pam_unix)[5210]: session opened for user root by (uid=0)
Jul 31 09:10:01 ps-sm-poly3u-10 crond(pam_unix)[5210]: session closed for user root
Jul 31 09:20:01 ps-sm-poly3u-10 crond(pam_unix)[5213]: session opened for user root by (uid=0)
Jul 31 09:20:01 ps-sm-poly3u-10 crond(pam_unix)[5213]: session closed for user root
Jul 31 09:30:01 ps-sm-poly3u-10 crond(pam_unix)[5216]: session opened for user root by (uid=0)
Jul 31 09:30:01 ps-sm-poly3u-10 crond(pam_unix)[5216]: session closed for user root

 

[lgarner]

Edit syslog.conf and have cron.none go to /var/log/messages.

 

[Yrrk]

Thats seems to already be the default..

 

[geirendre]

Syslog dosn't have much room for adjustments,
you basicaly select what to log, and where to put it.
Maby you should try to upgrade to syslog-ng.
It has a filtering function that lets you easely filter
out messages with regexp.

http://www.balabit.com/products/syslog_ng/

http://www.campin.net/syslog-ng/faq.html

You can even log to a MySQL-database and view it in a
browser with Apache. Like this:

http://www.phpwizardry.com/demo/

http://www.phpwizardry.com/php-syslog-ng.php

 

[Annihilannic]

It's actually the auth facility that you need to adjust to quieten those messages. We usually change these lines:

[tt]# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages[/tt]

to:

[tt]# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;auth.!=debug;auth.!=info;authpriv.none;cron.none /var/log/messages

# Log auth messages elsewhere
auth.* /var/log/auth[/tt]

That keeps the auth stuff separate so you can see the wood for the trees in /var/log/messages, but still retains an audit trail for auth. Remember to set up log rotation for /var/log/auth if you choose to do this as it can get pretty big.

Annihilannic.