CentOS - Aug 2005 - redirect crond(pam_unix) syslog messages

Hi guys:

I could only find one answer for this topic via google, and the poster
wasnt' sure if he was breaking something with his "fix".

I there a way to redirect the cron session messages from syslog to a
different log?

i.e.:
Aug 15 01:03:01 tn1 crond(pam_unix)[29303]: session opened for user
root by (uid=0)
Aug 15 01:03:07 tn1 crond(pam_unix)[29303]: session closed for user
root

I tried cron.none and crond.none (and the correspondine lines to put
those in their own file) in syslog.conf but neither redirected.

The other guys solution was:
====I disabled the session line in /etc/pam.d/crond
this line : session required /lib/security/$ISA/pam_stack.so
service=system-auth
to this line : #session required /lib/security/$ISA/pam_stack.so
service=system-auth
====
But I'm not real comfortable with that.

Anyone know?
Thans, Scott

Am Mo, den 15.08.2005 schrieb scott.list um 15:13:
> I could only find one answer for this topic via google, and the poster
> wasnt' sure if he was breaking something with his "fix".
> 
> I there a way to redirect the cron session messages from syslog to a
> different log?
> 
> i.e.:
> Aug 15 01:03:01 tn1 crond(pam_unix)[29303]: session opened for user
> root by (uid=0)
> Aug 15 01:03:07 tn1 crond(pam_unix)[29303]: session closed for user
> root
> 
> I tried cron.none and crond.none (and the correspondine lines to put
> those in their own file) in syslog.conf but neither redirected.
> Thans, Scott
Edit /etc/syslog.conf and change it like this:

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;local5.none;authpriv.none;cron.none;auth.!=info       
/var/log/messages

    that config line has just "auth.!=info" appended

# Log cron auth messages in a separate file.
auth.info                                              
/var/log/cron.auth

    add that instruction

After "service syslog restart" the syslog messages caused by cron will
appear in /var/log/cron.auth only.

Alexander


-- 
Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773
legal statement: http://www.uni-x.org/legal.html
Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.11-1.35_FC2smp 
Serendipity 16:24:20 up 7 days, 2:13, load average: 1.93, 1.86, 1.30 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
URL:
<http://lists.centos.org/pipermail/centos/attachments/20050815/3a70eac7/attachment-0002.sig>

Alexander:

Thanks very much for the help.  Your input solved the issue.  I
tweaked the solution a little to put the cron and cron auth messages
in the same file.  For the archives I have these lines relavant to the
issue in syslog.conf:

# Main syslog
*.info;mail.none;authpriv.none,cron.none,auth.!=info
/var/log/messages

# Cron messages
cron.*,auth.info                                        /var/log/cron

Thanks again,
Scott