Bug 145761 - crond logging to /var/log/messages
Summary: crond logging to /var/log/messages
Status: CLOSED DUPLICATE of bug 130242
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: sysklogd   
(Show other bugs)
Version: 4.0
Hardware: All
OS: Linux
Target Milestone: ---
: ---
Assignee: Jason Vas Dias
QA Contact: Brian Brock
Depends On:
TreeView+ depends on / blocked
Reported: 2005-01-21 09:14 UTC by blbooth
Modified: 2007-11-30 22:07 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-01-21 15:09:17 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

Description blbooth 2005-01-21 09:14:11 UTC
Description of problem:

Crond is logging to /var/log/messages, even though

cron.none                /var/log/messages

is in syslog.conf.

Version-Release number of selected component (if applicable):
Occurs under beta2's sysklogd-1.4.1-22 and jvdias's sysklogd-1.4.1-26_EL

*.info;mail.none;authpriv.none;cron.none                /var/log/messages
cron.*                                                  /var/log/cron

Jan 21 18:01:01 nogrod crond(pam_unix)[26564]: session opened for user root by
Jan 21 18:01:01 nogrod crond(pam_unix)[26564]: session closed for user root

Jan 21 18:01:01 nogrod crond[26565]: (root) CMD (run-parts /etc/cron.hourly)

Is this pam related?

Comment 1 Jason Vas Dias 2005-01-21 15:09:17 UTC
Yes, this is entirely due to PAM. When the crond process does the 
equivalent of a 'su' to run each cron job, the PAM libraries emit
these 'auth.info' log messages.
You could direct these auth.info messages elsewhere in syslog.conf,
eg. with:

*.info;mail.none;news.none;authpriv.none;cron.none;auth.!info /var/log/messages
authpriv.*;auth.info                                          /var/log/secure

*** This bug has been marked as a duplicate of 130242 ***

Note You need to log in before you can comment on or make changes to this bug.