Arch Linux

Rulatir

Banned

Registered: 2007-02-05

Posts: 94

[solved] What the heck is /var/log/ppp.log ?

There is a file in my /var/log directory named ppp.log, but it is not a PPP log. It contains a random log of commands I ran with sudo. It includes stuff that I emphatically don't want to be logged anywhere on my system, like truecrypt invocations. What is ppp.log? What writes it? Why does it contain stuff completely unrelated to PPP?

edit: going through the forums and marking my old stuff as solved...

Last edited by Rulatir (2009-01-11 11:12:14)

skymt

Member

Registered: 2006-11-27

Posts: 443

Re: [solved] What the heck is /var/log/ppp.log ?

That's odd, it's happening on my system, too. Looking at `syslog-ng.conf', `/var/log/ppp.log' is supposed to contain log entries from the `local2` facility. (A syslog facility is just a category of entries, used to sort them into individual files.) Judging from the sudo man page and PKGBUILD, sudo should be logging to the `auth' syslog facility. This aspect of your problem is probably a bug and should be reported. I'd start with the Arch bug tracker, and it can go upstream if the sudo maintainer thinks it should.

As for disabling sudo logging entirely, that's fortunately easy. Just run `visudo', and under the `Defaults specification' comment, add this line:

Defaults        !syslog

Zer0

Member

From: Windsor, ON, Canada

Registered: 2006-08-25

Posts: 299

Re: [solved] What the heck is /var/log/ppp.log ?

Confirmed here also, sudo logging to ppp.log
The first log entry is on Nov 1, 2007 for me.

skymt

Member

Registered: 2006-11-27

Posts: 443

Re: [solved] What the heck is /var/log/ppp.log ?

On further investigation, it looks like the problem was noticed and solved. On Dec 31, the sudo maintainer changed the PKGBUILD to log to auth. I update pretty much daily, and the last entry in my `/var/log/ppp.log' is dated Jan 1. It looks like in November the upstream sudo maintainer changed the default log facility to local2, which Arch uses for PPP entries. The latest sudo package should be fine.

Rulatir

Banned

Registered: 2007-02-05

Posts: 94

Re: [solved] What the heck is /var/log/ppp.log ?

Thanks everyone! I confirm it fixed now. Last command logged in my ppp.log is the "pacman -Syu" that installed the latest sudo