Authentication logging problem in Linux server.

[Kanagaraj]

Dear All,

our linux server have intalled OS Redhat E5 Linux,I want to capture auth.info and auth.notice logs in /var/log/authlog file.

I have made entires in /etc/syslog.conf file.

The entries are given below.

auth.info /var/log/authlog
auth.info /var/log/authlog


one information..
authlog file already created.
-rw------- 1 root root 0 Mar 27 18:44 /var/log/authlog

I have restarted syslog demon
service restart syslog

if any one faced same problem and resolved then Please share with me........

[Kanagaraj]

Sorry------

In previous thread,I have mentioned only configuration of auth logs entires.

My problem is that authentication logs are not capturing in /var/adm/authlog file.

[Matti_Kurkela]

Perhaps you've made the same mistake as many others when editing the syslog.conf file for the first time.

Between "auth.info" and "/var/log/authlog" parts, there *must* be at least one TAB character, not a space character.

Also, the specification

auth.info/var/log/authlog

captures all "auth" category messages of severity "info" _and above_.

To get _only_ messages of severity "info" or "notice", you must do something like this:

auth.info,auth.!warn/var/log/authlog

This selects authentication messages of severity "info" and above, then _de-selects_ messages of severity "warn" and above, leaving only "info" and "notice".

An alternative way to specify it would be:
auth.=info,auth.=notice/var/log/authlog

The equal sign means "only this severity level exactly".

MK

[Kanagaraj]

Thanks MK,Problem solved.

[Kanagaraj]

I am closing this thread