Description of problem: The default syslog.conf provided with FC1 has these lines: # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages However, authentication messages *do* get logged to /var/log/messages. "auth" needs to be added to the above string, so it reads: *.info;mail.none;auth,authpriv.none;cron.none /var/log/messages Version-Release number of selected component (if applicable): 1.4.1-13
What changed from authpriv to auth? What specific messages do you see?
From su and login, for example: Apr 22 16:54:50 host su(pam_unix)[2716]: session opened for user root by vader(uid=0) Apr 22 16:54:50 host su(pam_unix)[2716]: session closed for user root Apr 22 16:54:58 host login(pam_unix)[1047]: session opened for user root by LOGIN(uid=0) Apr 22 16:54:58 host -- root[1047]: ROOT LOGIN ON tty1 Apr 22 16:55:02 host login(pam_unix)[1047]: session closed for user root
In fc2+, syslog.conf is now: " # Don't log private authentication messages! *.info;mail.none;news.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure " These messages: Apr 22 16:54:50 host su(pam_unix)[2716]: session closed for user root Apr 22 16:54:50 host su(pam_unix)[2716]: session closed for user root are auth.info messages; users can direct them elsewhere using syslog.conf, but by default they are caught by *.info;... /var/log/messages