cron

WyattOil · 02-01-2014, 12:49 PM

Goal: To have cron events logged to solely in /var/log/cron.log This will make my /var/log/messages file easier to audit since there will be less "noise" to sift through.

I have done the following (SUSE distro if that matters).
1) Edited /etc/rsyslog.conf to include:
# Cron logging
cron.* -/var/log/cron.log

2) touched and chmoded /var/log/cron.log to create the file and set permissions.

3) Restarted syslog so the new config file settings were read.

Cron events are logging to that file now, but they also are still being logged to /var/log/messages.

I need to know what additional changes I need to make in order to prevent cron events from logging to /var/log/messages.

Thank you in advance.

rigor · 02-01-2014, 06:18 PM

Here's an example of how, on openSUSE 13.1, I direct log messages from the dhcpcd process only to a separate log file:

Code:

# dhcpcd messages in a separate file, and not in /var/log/messages.
if      ($programname == 'dhcpcd')  \
then    -/var/log/dhcp
&       stop



#
# the rest in one file
#
*.*;mail.none;news.none                 -/var/log/messages

The:

Code:

stop

says that the chosen log messages should not be matched against any further patterns in the configuration file, that processing of the selected messages should stop at that point. If the stop wasn't there, *.* would match, and the messages would also be placed in /var/log/messages. In fact, since I've included only part of the configuration file, there are also other patterns later in the file that would match.

HTH.

unSpawn · 02-01-2014, 07:21 PM

Quote:

Originally Posted by WyattOil

Cron events are logging to that file now, but they also are still being logged to /var/log/messages.
I need to know what additional changes I need to make in order to prevent cron events from logging to /var/log/messages.

What you simply need to do is post your syslog configuration. Because without that we don't know where things go wrong.