wanting more information on my logs

elishac · 02-06-2010, 01:05 PM

Hello,

I'm using ubuntu, and I'd like my /var/log/syslog file to display unix_chkpwd lines, such as this one (which it doesn't do at the moment) :
Feb 6 04:20:40 www unix_chkpwd[20528]: password check failed for user (root)
I'd rather not install linux_pam unless really necessary because I already tried it and I've had quite a lot of problems with it.

Thanks.

neonsignal · 02-06-2010, 05:30 PM

Are you using an LTS version of Ubuntu? Otherwise, I would have thought that you would already have PAM reporting logins to /var/log/auth.log.

You might look at setting up the audit daemon (auditd package).

elishac · 02-06-2010, 05:54 PM

What's an LTS version ?
Yeah you're right, there are some reports in /var/log/auth.log, but why aren't there any reports in /var/log/syslog, as there are in my friend's ?
How to set up the audit daemon to make this line appear ?