5

In my /etc/rsyslog.conf, I have the following line to log the auth facility into /var/log/auth.log:

auth,authpriv.*           /var/log/auth.log

but the file is flooded with cron logs, such as these:

CRON[18620]:  pam_unix(cron:session): session opened for user root by (uid=0)
CRON[18620]:  pam_unix(cron:session): session closed for user root

I would like to get rid of the cron logs, and only have real "auth" events being logged into that file. By that I mean, I want to see which users have logged into the system, or made su -.

How can I achieve that?

5

I believe this is what you are looking for:

:msg, contains, "pam_unix(cron:session)" ~
auth,authpriv.* /var/log/auth.log

the first line matches cron auth events, and deletes them. The second line then logs as per your rule, minus the previously deleted lines.

3

If an attacker can control part of the message logged, they could mask events by filtering on the message contents.

Alternatively, you can filter out messages from the process CRON with:

#Continue logging CRON to syslog
*.*;auth,authpriv.none          -/var/log/syslog
#Filter events from the process CRON out of auth.log
:programname, isequal, "CRON" ~
auth,authpriv.*                 /var/log/auth.log

If you don't want any CRON events logged, you can put the filter line first in your rsyslog.conf.

  • This works and appears to be the more secure method – pcnate Mar 23 '18 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.