SUMMARY: Getting syslog to log auth messages

From: Chris Stoddart (
Date: Thu Feb 24 2000 - 05:50:27 CST


I'd just like to update those who have sent suggestions so far. In
the order I tried them:

1. making sure there are tabs and not spaces between the selector and
action fields, thus:
has no effect

2. using the line 'logger -p auth.notice "this is a test"' works every
time even with a * wildcard after auth.

3. changing the wildcard to debug or notice thus:
auth.debug /var/log/authlog
with a tab and no spaces suddenly started logging failed logins.

I suspect I had a combination of problems here, namely it needs tabs not
spaces and the BSD trailing wildcard flag is not supported (despite Sun
stealing syslogd from BSD unix). I tried using auth.debug yesterday instead
of auth.* with no success, but then I probably had spaces between selector
and action fields :-/

Cheers and thanks to everyone who helped, including (so far):

Jarrett Carver
Juergen Schreiner
Larry Garrett
Bernhard Sadlowski
Daniel Manne


Dr Chris Stoddart: Unix SysAdmin,
Department of Computer Science, 
Sheffield University, U.K.

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:14:03 CDT