Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my /etc/rsyslog.conf, I have the following line to log the auth facility into /var/log/auth.log:

auth,authpriv.*           /var/log/auth.log

but the file is flooded with cron logs, such as these:

CRON[18620]:  pam_unix(cron:session): session opened for user root by (uid=0)
CRON[18620]:  pam_unix(cron:session): session closed for user root

I would like to get rid of the cron logs, and only have real "auth" events being logged into that file. By that I mean, I want to see which users have logged into the system, or made su -.

How can I achieve that?

share|improve this question
up vote 4 down vote accepted

I believe this is what you are looking for:

:msg, contains, "pam_unix(cron:session)" ~
auth,authpriv.* /var/log/auth.log

the first line matches cron auth events, and deletes them. The second line then logs as per your rule, minus the previously deleted lines.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.