removing cron entries from auth.log

divukman · 05-27-2006, 05:19 AM

Aloha all,

I'd like to remove cron.hourly entries from appearing in auth.log. I've done this by commenting out the cron.hourly line from /etc/crontab, but that's not the solution. Anything I can do with syslog-ng? Add some filter?

Thanks!

jschiwal · 05-27-2006, 05:48 AM

Go to the cron.hourly directory and edit the files. For example:
/usr/sbin/mcelog --ignorenodev --filter >> /var/log/mcelog

Removing the ">>/var/log/mcelog" will stop the logging.

divukman · 05-27-2006, 05:53 AM

I've added a filter to syslog-ng conf file. I think this should work.

Code:

# all messages from the auth and authpriv facilities
filter f_auth { facility(auth, authpriv);};

#filter the CRON messages
filter f_cron_msgs { not match("CRON*"); };


# auth,authpriv.*                 /var/log/auth.log
# + filter the CRON messages out
log {
        source(s_all);
        filter(f_auth);
        filter(f_cron_msgs);
        destination(df_auth);
};