Hi

I have installed the rootsh and its working fine in centos 6.
But problem is its all the log stored in /var/log/messages and /var/log/rootsh/ also.

Now I want to stop the log in /var/log/messages when I run the command from root I am able to stop the log in /var/log/messages.

rootsh --no-syslog --- but same thing I want to do with normal user also.

for that logged into the normal user login and vi .bashrc and add the following line
rootsh --no-syslog

Its creating a 225 process

[root@testing ~]# ps aux | grep rootsh | wc -l
225

[root@testing ~]# ps aux | grep rootsh | less

code 16521 0.0 0.0 8256 832 pts/1 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16535 0.0 0.0 8256 816 pts/3 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16549 0.0 0.0 8256 820 pts/5 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16563 0.0 0.0 8256 816 pts/6 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16577 0.0 0.0 8256 820 pts/7 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16591 0.0 0.0 8256 820 pts/8 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16605 0.0 0.0 8256 820 pts/9 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16619 0.0 0.0 8256 824 pts/10 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16633 0.0 0.0 8256 820 pts/11 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16647 0.0 0.0 8256 820 pts/12 S+ 14:43 0:00 /usr/bin/rootsh --no-sysl



Please help to solve this issue.

If you need continuous auditing don't set the shell in a users resource files but consider setting the users shell to rootsh globally. Also consider using the audit service in conjunction with rootsh. *BTW 'ps|grep' means you don't know 'pgrep' yet ;-p



See if you can filter those messages out in /etc/(r)syslog(-ng).conf?