topic Re: Authentication logging problem in Linux server. in Operating System - Linux

Authentication logging problem in Linux server.

Kanagaraj — Sun, 29 Mar 2009 18:33:48 GMT

Dear All,

our linux server have intalled OS Redhat E5 Linux,I want to capture auth.info and auth.notice logs in /var/log/authlog file.

I have made entires in /etc/syslog.conf file.

The entries are given below.

auth.info /var/log/authlog
auth.info /var/log/authlog

one information..
authlog file already created.
-rw------- 1 root root 0 Mar 27 18:44 /var/log/authlog

I have restarted syslog demon
service restart syslog

if any one faced same problem and resolved then Please share with me........

Re: Authentication logging problem in Linux server.

Kanagaraj — Sun, 29 Mar 2009 18:37:06 GMT

Sorry------

In previous thread,I have mentioned only configuration of auth logs entires.

My problem is that authentication logs are not capturing in /var/adm/authlog file.

Re: Authentication logging problem in Linux server.

Matti_Kurkela — Mon, 30 Mar 2009 16:03:14 GMT

Perhaps you've made the same mistake as many others when editing the syslog.conf file for the first time.

Between "auth.info" and "/var/log/authlog" parts, there *must* be at least one TAB character, not a space character.

Also, the specification

auth.info/var/log/authlog

captures all "auth" category messages of severity "info" _and above_.

To get _only_ messages of severity "info" or "notice", you must do something like this:

auth.info,auth.!warn/var/log/authlog

This selects authentication messages of severity "info" and above, then _de-selects_ messages of severity "warn" and above, leaving only "info" and "notice".

An alternative way to specify it would be:
auth.=info,auth.=notice/var/log/authlog

The equal sign means "only this severity level exactly".

MK

Re: Authentication logging problem in Linux server.

Kanagaraj — Tue, 31 Mar 2009 17:24:49 GMT

Thanks MK,Problem solved.

Re: Authentication logging problem in Linux server.

Kanagaraj — Tue, 31 Mar 2009 17:25:29 GMT

I am closing this thread