View Single Post
Old 1st July 2010, 17:53
sixerjman sixerjman is offline
Junior Member
Join Date: Apr 2007
Posts: 1
Thanks: 0
Thanked 0 Times in 0 Posts
Default Thanks Martin!

Originally Posted by martin1977 View Post
OK, now comes the GOOD solution.
forget about the last post - that one might be the solution for "old school" syslog users but since I use rsyslog there is a much better way:

Simply replace the old
auth,authpriv.*                 /var/log/auth.log
:msg, contains, "pam_unix(cron:session)"  ~
auth,authpriv.*                 /var/log/auth.log
This would write everything into /var/log/auth.log BUT messages that contain "pam_unix(cron:session)". (Please note that the tilde "~" at the end of the line is required)
This is exactly what at least I was searching for. Rsyslog has much more fun functionallity and it is worth to have a closer look into it.

Best regards,
This was exactly the problem I was having, and exactly the solution I was looking for. I also run rsyslog, and at first I added the 'auth,authpriv.*' line to the top of my rsyslog.conf before I had read to the bottom of the thread (I was in a rush to get those pam.unix messages out of the way). Surgical and elegant, nice work.
Reply With Quote