On Fri, 2005-02-25 at 11:56 -0600, Jess Anderson wrote: > Every time cron wakes up, it logs authentication (PAM) > actions to syslog. Not especially useful for a one-user > (plus root) system, these messages mostly fill up space: > > Feb 25 11:21:01 seth crond(pam_unix)[4381]: session opened for user anderson by (uid=0) > Feb 25 11:21:02 seth crond(pam_unix)[4381]: session closed for user anderson > Feb 25 11:25:01 seth crond(pam_unix)[4396]: session opened for user root by (uid=0) > Feb 25 11:25:01 seth crond(pam_unix)[4396]: session closed for user root > Feb 25 11:27:01 seth crond(pam_unix)[4454]: session opened for user anderson by (uid=0) > Feb 25 11:27:02 seth crond(pam_unix)[4454]: session closed for user anderson > Feb 25 11:30:01 seth crond(pam_unix)[4497]: session opened for user root by (uid=0) > Feb 25 11:30:01 seth crond(pam_unix)[4500]: session opened for user root by (uid=0) > Feb 25 11:30:01 seth crond(pam_unix)[4497]: session closed for user root > Feb 25 11:30:01 seth crond(pam_unix)[4500]: session closed for user root > > As far as I can see this logging is compiled in, rather than > being controlled by /etc/syslog.conf. Of maybe (entirely > possible) I'm confused. The man pages don't mention options > or other alternatives, apparently. > > Suggestions welcome. Where is this being logged? If it is being logged to /var/log/messages, then do the following to see what is being logged there. grep '/var/log/messages' /etc/syslog.conf My machine returns the following response, *.info;mail.none;authpriv.none;cron.none /var/log/messages This means that any facility with a priority of info, or higher will log any messages to /var/log/messages. In this case, I think it is the auth facility that is causing the messages. To get rid of them, try editing /etc/syslog.conf and changing the line associated with /var/log/messages to the following, *.info;auth.none;mail.none;authpriv.none;cron.none /var/log/messages This should get rid of these messages. This may cause you to miss certain messages that may be important. Try different priority levels until you get it right. Don't forget to restart syslogd after making the changes to /etc/syslog.conf. Ian
