su log in syslog

[marc seguin]

Hello,

I have too many messages like :
su: + tty?? root-oracle
in my syslog file.

sudo file is enough.
How to prevent these messages in syslog file ?

thanks

[Chris Wilshaw · Accepted solution]

Change /etc/syslog.conf to include

*.info;auth.none;mail.none /var/adm/syslog/syslog.log

This sends all messages of type info to syslog.log, except those from mail and the auth system (login, su etc).

Then restart syslogd

[T G Manikandan]

check /etc/syslog.conf

check you have auth.none

*.info;auth.none;mail.none /var/adm/syslog/syslog.log

[Mark Grant]

Not sure exactly but something like

edit /etc/syslog.conf and change

"*.info;mail.none /var/adm/syslog/syslog.log" to

"*.info;mail.nonea;su.none /var/adm/syslog/syslog.log"

You then need to "kill -1" the syslogd process.