https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c17 --- Comment #17 from charlie meier <fishdude@gmx.net> 2013-05-31 12:40:35 UTC --- (In reply to comment #16)
I think I know what you mean. There are e.g. pam messages like:
/usr/sbin/cron[13588]: pam_unix(crond:session): session opened for user root by (uid=0) /USR/SBIN/CRON[13588]: pam_unix(crond:session): session closed for user root
which look like cron messages, but they aren't.
Your filter is cron.*, that is factility "cron" (9), level any. Look into the journal using:
journalctl -o export | less
and search for the messages of interest, you'll find out, that it were not logged with the "cron" facility "SYSLOG_FACILITY=9", but with "authpriv" "SYSLOG_FACILITY=10" (in above example).
That was exactly the problem. I fixed it with a separate rule. Thanks. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.