Bug 145761

Summary: crond logging to /var/log/messages
Product: Red Hat Enterprise Linux 4 Reporter: blbooth <blbooth>
Component: sysklogdAssignee: Jason Vas Dias <jvdias>
Status: CLOSED DUPLICATE QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.0   
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-01-21 15:09:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description blbooth 2005-01-21 09:14:11 UTC
Description of problem:

Crond is logging to /var/log/messages, even though

cron.none                /var/log/messages

is in syslog.conf.


Version-Release number of selected component (if applicable):
Occurs under beta2's sysklogd-1.4.1-22 and jvdias's sysklogd-1.4.1-26_EL


/etc/syslog.conf:
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
cron.*                                                  /var/log/cron

/var/log/messages:
Jan 21 18:01:01 nogrod crond(pam_unix)[26564]: session opened for user root by
(uid=0)
Jan 21 18:01:01 nogrod crond(pam_unix)[26564]: session closed for user root

/var/log/cron:
Jan 21 18:01:01 nogrod crond[26565]: (root) CMD (run-parts /etc/cron.hourly)


Is this pam related?

Comment 1 Jason Vas Dias 2005-01-21 15:09:17 UTC
Yes, this is entirely due to PAM. When the crond process does the 
equivalent of a 'su' to run each cron job, the PAM libraries emit
these 'auth.info' log messages.
You could direct these auth.info messages elsewhere in syslog.conf,
eg. with:

*.info;mail.none;news.none;authpriv.none;cron.none;auth.!info /var/log/messages
authpriv.*;auth.info                                          /var/log/secure


*** This bug has been marked as a duplicate of 130242 ***