From owner-freebsd-questions@FreeBSD.ORG Mon Jun 24 16:28:53 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 7035FCB1 for ; Mon, 24 Jun 2013 16:28:53 +0000 (UTC) (envelope-from kudzu@tenebras.com) Received: from mail-ob0-x22c.google.com (mail-ob0-x22c.google.com [IPv6:2607:f8b0:4003:c01::22c]) by mx1.freebsd.org (Postfix) with ESMTP id 413AA10DE for ; Mon, 24 Jun 2013 16:28:53 +0000 (UTC) Received: by mail-ob0-f172.google.com with SMTP id wo10so11117120obc.31 for ; Mon, 24 Jun 2013 09:28:52 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:x-gm-message-state; bh=PXoYhFbxtiZDF2K3Gjz4n3KBawsWYRYAc95ydbRaqOk=; b=psDKuMXoQMPQTrbWY5gm6ZYek1XtNjYN2UNpi5xJLqGhFbjApf88X/Adb79sNMm4DP UPo2XSjMJ0dhzC/bUKxtyWDAmJ3lI2N/IL9qXi8de9GlVMk9o8132L5MChImu7bLOCp4 n5cYbC0uxM3GK4n7sCYh6aENVsl3vE4a0KMDTpvxk2MmQoD6WlS+dbMu2rdhQBES/YKE G8CSQjSw3Oya1lgdl3gYQEDtHn6Qd4wpQIUImxNgcNNQbszlDFOvmRE80mZ0lIeW+cN+ NR0C4K5r2orTdrRvgIR/WPdXiMAIT2bcLqajA7MqDh/J8v6wwYOVIB28CpIA+6xhZrOA OLRw== MIME-Version: 1.0 X-Received: by 10.60.174.111 with SMTP id br15mr11171780oec.130.1372091332256; Mon, 24 Jun 2013 09:28:52 -0700 (PDT) Received: by 10.60.123.77 with HTTP; Mon, 24 Jun 2013 09:28:52 -0700 (PDT) In-Reply-To: References: Date: Mon, 24 Jun 2013 09:28:52 -0700 Message-ID: Subject: Re: auth.notice on syslog server From: Michael Sierchio To: "freebsd-questions@freebsd.org" Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQn2K2jU+cgFd/IZPpOxZ6eTAzXvuvzQyE8xSY8KOwDSCSww4qkp5TFuGguoHwTQAVNA23dQ X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Jun 2013 16:28:53 -0000 On Mon, Jun 24, 2013 at 5:35 AM, SWENNEN Rudi wrote: > Hello FreeBSD-list, > > I have the following two freebsd systems/servers: a server and a client. The syslog of the client is send to the server. > I was wondering why the auth.notice entry on my server is generating a syslog entry (/dev/console) when I change to root on the client: > Jun 24 12:01:38 SERVER kernel: Jun 24 12:00:32 CLIENT su: rudi to root on /dev/ttyv0 > > Is there a way to "limit" the auth-facility not to log via syslog if the entry in generated from a remote system? Yes, on the host that sends the logs. E.g., auth.*,authpriv.*: /var/log/auth console.*,cron.*,daemon.*,kern.*,mail.*,ntp.*,security.*,syslog.*,user.*,local.*: @loghost