From owner-freebsd-questions Tue Jan 11 20:32:32 2000 Delivered-To: freebsd-questions@freebsd.org Received: from cc942873-a.ewndsr1.nj.home.com (cc942873-a.ewndsr1.nj.home.com [24.2.89.207]) by hub.freebsd.org (Postfix) with ESMTP id 6038014E58 for ; Tue, 11 Jan 2000 20:32:27 -0800 (PST) (envelope-from cjc@cc942873-a.ewndsr1.nj.home.com) Received: (from cjc@localhost) by cc942873-a.ewndsr1.nj.home.com (8.9.3/8.9.3) id XAA09576; Tue, 11 Jan 2000 23:33:46 -0500 (EST) (envelope-from cjc) From: "Crist J. Clark" Message-Id: <200001120433.XAA09576@cc942873-a.ewndsr1.nj.home.com> Subject: Re: sshd and syslogd In-Reply-To: <387B7288.8A5D24F5@journalstar.com> from Tony Wells at "Jan 11, 2000 12:12:24 pm" To: awells@journalstar.com (Tony Wells) Date: Tue, 11 Jan 2000 23:33:46 -0500 (EST) Cc: su98-rin@nada.kth.se (Richard Nyberg), freebsd-questions@FreeBSD.ORG Reply-To: cjclark@home.com X-Mailer: ELM [version 2.4ME+ PL54 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Tony Wells wrote, > I tried what you suggested, but still don't see messages from sshd in > /var/log/authlog; I still see login failures from telnet in > /var/log/messages. I rebooted the machine after I made the changes just > to make sure everybody read the changed config files. > Could I have a conflict in syslog.conf? The contents of syslog.conf are > listed below: > > # $FreeBSD: src/etc/syslog.conf,v 1.9.2.1 1999/08/29 14:19:02 peter Exp > $ > # > # Spaces are NOT valid field separators in this file. > # Consult the syslog.conf(5) manpage. > *.err;kern.debug;auth.notice;mail.crit /dev/console > *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages > mail.info /var/log/maillog > lpr.info /var/log/lpd-errs > cron.* /var/cron/log > *.err root > *.notice;news.err root > *.alert root > *.emerg * > # uncomment these if you're running inn > # news.crit /var/log/news/news.crit > # news.err /var/log/news/news.err > # news.notice > /var/log/news/news.notice > !startslip > *.* /var/log/slip.log > !ppp > *.* /var/log/ppp.log > auth.* /var/log/authlog The way you have it set up, only AUTH messages from ppp will end up in /var/log/authlog. -- Crist J. Clark cjclark@home.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message