On Monday 13 October 2003 21:20, Carlos E. R. wrote:
The 03.10.13 at 19:38, James Mohr wrote:
I am trying configure PAM logging on SuSE 8.0 and 8.2 systems. The biggest thing that bothers me is that I cannot figure out what facility and what priority is used for the messages.
It is difficult if not documented.
Everything is being written to /var/adm/messages, which is getting overloaded with junk. I would like to be able to define certain piorities (error ane above?) which get written then and all others are either discarded or written to a different log file.
Add an entry to syslog.conf like:
facility.* /var/log/testing
Where 'facility' is anyone of the available facilities. Restart syslog (rcsyslog restart) and see if there are pam entries there. No? redo for another facility.
Otherwise, add multiple entries like:
auth.* /var/log/facility.auth authpriv.* /var/log/facility.authpriv cron.* /var/log/facility.cron daemon.* /var/log/facility.daemon <SNIP>
I was hoping that have to take a hammer to the problem, but that's what I ended up doing. Thanks. Turns out it uses the auth facility (where else). I thought I had read that it was localX, but I wasn't sure. However, even things like su failures are reported as priority "info" so it all ends up in the same place. I was hoping to be able to filter out the errors/warning. Fortunately our monitoring software can parse the entries. regards, jimmo -- --------------------------------------- "Be more concerned with your character than with your reputation. Your character is what you really are while your reputation is merely what others think you are." -- John Wooden --------------------------------------- The Linux Tutorial needs your help! Visit us at http://www.linux-tutorial.info