Excessive Logging

[Nobody's Hero]

In the past I have eliminated syslog entries by using syslog-ng. Great product for managing logs. However, now I have 3 servers that are not allowd to use syslog-ng. Period.

Is there a way I can control what gets logged to the authlog? Im not too worried about syslog. Its the authlog that is creating a huge amount of entries.

[Steven E. Protter]

Shalom,

The authlog is a critical log for compliance with SOX. You should try frequently copying it off (logrotate) versus trying to reduce entries.

SEP

[Nobody's Hero]

I figured so, thanks anyway.

[Nobody's Hero]

Closed.

[TTr]

What entries do you have in your /etc/syslog.conf file for auth.xxxx ?
You could remove the "auth.debug" if it is in there and reload syslogd with "kill -HUP ".