Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In my /etc/rsyslog.conf, I have following line to log auth facility into /var/log/auth.log:

auth,authpriv.*           /var/log/auth.log

but the file is flooded with cron logs, sucgh as these:

CRON[18620]:  pam_unix(cron:session): session opened for user root by (uid=0)
CRON[18620]:  pam_unix(cron:session): session closed for user root

I would like to get rid of the cron logs, and only have real "auth" events being logged into that file. By that I mean, I want to see which users have logged into the system, or made su -.

How can I achieve that?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I believe this is what you are looking for:

:msg, contains, "pam_unix(cron:session)" ~
auth,authpriv.* /var/log/auth.log

the first line matches cron auth events, and deletes them. The second line then logs as per your rule, minus the previously deleted lines.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.