want to get ssh/pam to log elsewhere...

[jpalfree]

Hi. Currently my ssh/pam logs to /var/log/messages along with many other things but i've seen it logged elsewhere in other distros, like /var/log/auth.log.

I'd like to get ssh/pam to log into a different file for convenience, and keeping better track of authentication attempts.

Does anyone know of a way to do this?
thanks

[anomie]

By default in FC, there is an entry in /etc/syslog.conf that looks like:

authpriv.*       /var/log/secure

Have a look at man 5 syslog.conf - this will explain a little about how the facility.priority (in this case authpriv.*) work.

Also check out man 3 syslog - this has some info about authpriv (LOG_AUTHPRIV).

You might want to back up your /etc/syslog.conf file before messing with it.

If you already have an authpriv.* entry in yours, you can point it to a new logging file instead. Note that you will need to create the new file before the logger can write anything there (if it does not already exist).

Finally, remember to restart the syslogd daemon when you're done.

[jpalfree]

Ahhh. Thankyou!

I had a feeling it was something to do with syslogs, but I didn't know how they worked till now. I actually use syslog-ng, but I figured it out from the man pages and this great example.

There are also good resources on the gentoo-wiki under syslog-ng.

Thanks again.