System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

Authentication logging problem in Linux server.

Kanagaraj
Regular Advisor

Authentication logging problem in Linux server.

Dear All,

our linux server have intalled OS Redhat E5 Linux,I want to capture auth.info and auth.notice logs in /var/log/authlog file.

I have made entires in /etc/syslog.conf file.

The entries are given below.

auth.info /var/log/authlog
auth.info /var/log/authlog


one information..
authlog file already created.
-rw------- 1 root root 0 Mar 27 18:44 /var/log/authlog

I have restarted syslog demon
service restart syslog

if any one faced same problem and resolved then Please share with me........
4 REPLIES
Kanagaraj
Regular Advisor

Re: Authentication logging problem in Linux server.

Sorry------

In previous thread,I have mentioned only configuration of auth logs entires.

My problem is that authentication logs are not capturing in /var/adm/authlog file.
Matti_Kurkela
Honored Contributor

Re: Authentication logging problem in Linux server.

Perhaps you've made the same mistake as many others when editing the syslog.conf file for the first time.

Between "auth.info" and "/var/log/authlog" parts, there *must* be at least one TAB character, not a space character.

Also, the specification

auth.info/var/log/authlog

captures all "auth" category messages of severity "info" _and above_.

To get _only_ messages of severity "info" or "notice", you must do something like this:

auth.info,auth.!warn/var/log/authlog

This selects authentication messages of severity "info" and above, then _de-selects_ messages of severity "warn" and above, leaving only "info" and "notice".

An alternative way to specify it would be:
auth.=info,auth.=notice/var/log/authlog

The equal sign means "only this severity level exactly".

MK
MK
Kanagaraj
Regular Advisor

Re: Authentication logging problem in Linux server.

Thanks MK,Problem solved.

Kanagaraj
Regular Advisor

Re: Authentication logging problem in Linux server.

I am closing this thread