Home / server / Questions / 761368
Accepted
xivix
Asked: 2016-03-04 08:26:05 +0800 CST

Linux excessive USER_ACCT and USER_AUTH entries in /var/log/messages

  • 772

I am running a Fedora 23 email server using sendmail & dovecot and am getting a daily flood of success entries like the ones below. Is there any way to shut off the success and only log the fail?

Mar  3 10:19:18 server audit: USER_AUTH pid=6154 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=pam_unix acct="smith" exe="/usr/libexec/dovecot/auth" hostname=127.0.0.1 addr=127.0.0.1 terminal=dovecot res=success'
Mar  3 10:19:18 server audit: USER_ACCT pid=6154 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="smith" exe="/usr/libexec/dovecot/auth" hostname=127.0.0.1 addr=127.0.0.1 terminal=dovecot res=success'
linux

1 Answers

  1. Best Answer

    This is probably auditd creating these excessive logs.

    You can read more about that verbosity issue here:

    https://lists.fedoraproject.org/pipermail/users/2015-July/463114.html

    where some countermeasures are being discussed. it might be too much for what you want to achieve though.

    You could figure out how to set /etc/audit/audit.rules to precisely configure the verbosity to your taste.

    • 0