Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 4 product line. The current stable release is 4.9. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 145761

Summary:	crond logging to /var/log/messages
Product:	Red Hat Enterprise Linux 4	Reporter:	blbooth <blbooth>
Component:	sysklogd	Assignee:	Jason Vas Dias <jvdias>
Status:	CLOSED DUPLICATE	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-01-21 15:09:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description blbooth 2005-01-21 09:14:11 UTC

Description of problem:

Crond is logging to /var/log/messages, even though

cron.none                /var/log/messages

is in syslog.conf.


Version-Release number of selected component (if applicable):
Occurs under beta2's sysklogd-1.4.1-22 and jvdias's sysklogd-1.4.1-26_EL


/etc/syslog.conf:
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
cron.*                                                  /var/log/cron

/var/log/messages:
Jan 21 18:01:01 nogrod crond(pam_unix)[26564]: session opened for user root by
(uid=0)
Jan 21 18:01:01 nogrod crond(pam_unix)[26564]: session closed for user root

/var/log/cron:
Jan 21 18:01:01 nogrod crond[26565]: (root) CMD (run-parts /etc/cron.hourly)


Is this pam related?

Comment 1 Jason Vas Dias 2005-01-21 15:09:17 UTC

Yes, this is entirely due to PAM. When the crond process does the 
equivalent of a 'su' to run each cron job, the PAM libraries emit
these 'auth.info' log messages.
You could direct these auth.info messages elsewhere in syslog.conf,
eg. with:

*.info;mail.none;news.none;authpriv.none;cron.none;auth.!info /var/log/messages
authpriv.*;auth.info                                          /var/log/secure


*** This bug has been marked as a duplicate of 130242 ***