Bug 145761 - crond logging to /var/log/messages
crond logging to /var/log/messages
Status: CLOSED DUPLICATE of bug 130242
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: sysklogd (Show other bugs)
4.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Jason Vas Dias
Brian Brock
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-01-21 04:14 EST by blbooth
Modified: 2007-11-30 17:07 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-01-21 10:09:17 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description blbooth 2005-01-21 04:14:11 EST
Description of problem:

Crond is logging to /var/log/messages, even though

cron.none                /var/log/messages

is in syslog.conf.


Version-Release number of selected component (if applicable):
Occurs under beta2's sysklogd-1.4.1-22 and jvdias's sysklogd-1.4.1-26_EL


/etc/syslog.conf:
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
cron.*                                                  /var/log/cron

/var/log/messages:
Jan 21 18:01:01 nogrod crond(pam_unix)[26564]: session opened for user root by
(uid=0)
Jan 21 18:01:01 nogrod crond(pam_unix)[26564]: session closed for user root

/var/log/cron:
Jan 21 18:01:01 nogrod crond[26565]: (root) CMD (run-parts /etc/cron.hourly)


Is this pam related?
Comment 1 Jason Vas Dias 2005-01-21 10:09:17 EST
Yes, this is entirely due to PAM. When the crond process does the 
equivalent of a 'su' to run each cron job, the PAM libraries emit
these 'auth.info' log messages.
You could direct these auth.info messages elsewhere in syslog.conf,
eg. with:

*.info;mail.none;news.none;authpriv.none;cron.none;auth.!info /var/log/messages
authpriv.*;auth.info                                          /var/log/secure


*** This bug has been marked as a duplicate of 130242 ***

Note You need to log in before you can comment on or make changes to this bug.