You are not logged in.

#1 2018-01-25 13:44:12

sistematico
Member
From: Campo Grande / MS / Brasil
Registered: 2008-07-26
Posts: 94
Website

Disable journalctl success logs

How to disable/hide this logs?

# journalctl | grep sudo
...
jan 25 10:35:49 majestic sudo[3934]: pam_unix(sudo:session): session opened for user root by (uid=0)
jan 25 10:36:19 majestic sudo[3934]: pam_unix(sudo:session): session closed for user root
...

and this:

# journalctl | grep cron
...
jan 25 10:30:01 majestic crond[3639]: pam_unix(crond:session): session opened for user lucas by (uid=0)
jan 25 10:30:01 majestic crond[3638]: pam_unix(crond:session): session opened for user lucas by (uid=0)
jan 25 10:30:01 majestic CROND[3641]: (lucas) CMD (sh -c "~/.local/bin/git-cron" > /dev/null 2>&1)
jan 25 10:30:01 majestic CROND[3638]: pam_unix(crond:session): session closed for user lucas
jan 25 10:30:12 majestic CROND[3639]: pam_unix(crond:session): session closed for user lucas
...

Thank you all.

Last edited by sistematico (2018-01-26 01:36:10)


Lucas Saliés Brum
blog | medium | vk | twitter | github | .share
Forgive the spelling and grammar, English is not my native language.

Offline

#2 2018-01-25 14:02:55

ayekat
Member
Registered: 2011-01-17
Posts: 1,233
Website

Re: Disable journalctl success logs

What is your goal, exactly?

Before I spoonfeed you the link to the man page section that describes how this can be achieved, I would like to be convinced that you have a good reason to do so. Because log messages are a useful tool for troubleshooting—if something goes wrong and you deliberately disabled logging for services like sudo, you (or the people you're asking for help) are not going to be happy.

Offline

#3 2018-01-25 14:32:25

Trilby
Inspector Parrot
Registered: 2011-11-29
Posts: 19,070
Website

Re: Disable journalctl success logs

I second everything in the above post.  But I'd also point out you haven't really said what you want to disable.  You want to disable them ever being added to the logs at all?  That's a horrible idea.

If you don't want to see them, well you didn't really give us nearly enough information, so working with just what you actually told us, the direct answer for disabling the printing of those lines is this:

journalctl | grep -v sudo
journalctl | grep -v cron

But that is certainly not what you want.  Presumably you want to see most sudo/cron log entries, you just want to filter some out, so do just that: filter out what you don't need to see.


"UNIX is simple and coherent..." - Dennis Ritchie, "GNU's Not UNIX" -  Richard Stallman

Offline

#4 2018-01-26 01:35:24

sistematico
Member
From: Campo Grande / MS / Brasil
Registered: 2008-07-26
Posts: 94
Website

Re: Disable journalctl success logs

I want HIDE or DISABLE cron and sudo successful logs.


Lucas Saliés Brum
blog | medium | vk | twitter | github | .share
Forgive the spelling and grammar, English is not my native language.

Offline

#5 2018-01-26 01:38:07

sistematico
Member
From: Campo Grande / MS / Brasil
Registered: 2008-07-26
Posts: 94
Website

Re: Disable journalctl success logs

ayekat wrote:

Because log messages are a useful tool for troubleshooting

Disable only sucessful logs.


Lucas Saliés Brum
blog | medium | vk | twitter | github | .share
Forgive the spelling and grammar, English is not my native language.

Offline

#6 2018-01-26 01:38:11

Trilby
Inspector Parrot
Registered: 2011-11-29
Posts: 19,070
Website

Re: Disable journalctl success logs

Yeah, that clarified things, like a thick smear of mud.

Ok then.  Use the commands in my previous post and mark your thread as solved.


"UNIX is simple and coherent..." - Dennis Ritchie, "GNU's Not UNIX" -  Richard Stallman

Offline

#7 2018-01-26 01:42:31

sistematico
Member
From: Campo Grande / MS / Brasil
Registered: 2008-07-26
Posts: 94
Website

Re: Disable journalctl success logs

Trilby wrote:

Yeah, that clarified things, like a thick smear of mud.

Ok then.  Use the commands in my previous post and mark your thread as solved.

Not solved, I don't want to see these logs.
Is spamming journalctl.

Last edited by sistematico (2018-01-26 01:42:59)


Lucas Saliés Brum
blog | medium | vk | twitter | github | .share
Forgive the spelling and grammar, English is not my native language.

Offline

#8 2018-01-26 01:45:57

sistematico
Member
From: Campo Grande / MS / Brasil
Registered: 2008-07-26
Posts: 94
Website

Re: Disable journalctl success logs

Trilby look: https://unix.stackexchange.com/a/224444/85741 this is not working for me...
Understand now?


Lucas Saliés Brum
blog | medium | vk | twitter | github | .share
Forgive the spelling and grammar, English is not my native language.

Offline

#9 2018-01-26 10:46:33

ayekat
Member
Registered: 2011-01-17
Posts: 1,233
Website

Re: Disable journalctl success logs

sistematico wrote:

this is not working for me...

Please read this sticky. We can't help you with PAM configuration issues if you don't tell us what you tried and how exactly (with logs et al) it went wrong.

Also, I believe this question hasn't been answered (and the link not been read) yet, so I refuse to give you further clues:

Offline

#10 2018-02-13 14:07:33

sistematico
Member
From: Campo Grande / MS / Brasil
Registered: 2008-07-26
Posts: 94
Website

Re: Disable journalctl success logs

ayekat wrote:
sistematico wrote:

this is not working for me...

Please read this sticky. We can't help you with PAM configuration issues if you don't tell us what you tried and how exactly (with logs et al) it went wrong.

Also, I believe this question hasn't been answered (and the link not been read) yet, so I refuse to give you further clues:

Nothing is wrong, my goal is not log sucessfull login attempts.


Lucas Saliés Brum
blog | medium | vk | twitter | github | .share
Forgive the spelling and grammar, English is not my native language.

Offline

#11 2018-02-13 14:51:18

Trilby
Inspector Parrot
Registered: 2011-11-29
Posts: 19,070
Website

Re: Disable journalctl success logs

sistematico wrote:

I don't want to see these logs.

sistematico wrote:

my goal is not log sucessfull login attempts.

These are not the same, which is why I asked for clarification early on.  If you don't want to see them, don't look at them.  See `man journalctl` specifically the -p flag:

journalctl -p 5 | grep sudo

or just

journalctl -p 5 /bin/sudo

If you don't want them to be entered in the log in the first place, I can't help, but I will reiterate that there is virtually no reason to prevent this information from being logged I think it's just a bad idea to try.

Last edited by Trilby (2018-02-13 14:57:55)


"UNIX is simple and coherent..." - Dennis Ritchie, "GNU's Not UNIX" -  Richard Stallman

Offline

#12 2018-02-13 15:06:10

seth
Member
Registered: 2012-09-03
Posts: 6,874

Re: Disable journalctl success logs

my goal is not log sucessfull login attempts.

...

Not solved, I don't want to see these logs.
Is spamming journalctl.

You're kinda self-contraditing...

man journald.conf

especiall look at MaxLevel* stuff - this will however impact *everything*
If you want to conceil logins for some probably shady reason, you'll have be a bit more forthcoming with your intentions.

Offline

#13 2018-02-13 17:07:22

sistematico
Member
From: Campo Grande / MS / Brasil
Registered: 2008-07-26
Posts: 94
Website

Re: Disable journalctl success logs

You're kinda self-contraditing...

But is not solved.

especiall look at MaxLevel* stuff - this will however impact *everything*

MaxLevel don't supress/disable/hide/ignore sucessfull logins.

If you want to conceil logins for some probably shady reason, you'll have be a bit more forthcoming with your intentions.

No special reason, I just wonder if this is possible, and I believe it is(ignore sucessfull logins from journalctl command).


Lucas Saliés Brum
blog | medium | vk | twitter | github | .share
Forgive the spelling and grammar, English is not my native language.

Offline

#14 2018-02-13 17:08:51

sistematico
Member
From: Campo Grande / MS / Brasil
Registered: 2008-07-26
Posts: 94
Website

Re: Disable journalctl success logs

Trilby wrote:

I think it's just a bad idea to try.

Why?


Lucas Saliés Brum
blog | medium | vk | twitter | github | .share
Forgive the spelling and grammar, English is not my native language.

Offline

#15 2018-02-13 17:14:20

seth
Member
Registered: 2012-09-03
Posts: 6,874

Re: Disable journalctl success logs

sistematico wrote:

But is not solved.

How does the shifting of your goals relate to their status?
Oh, yes ...

sistematico wrote:

MaxLevel don't supress/disable/hide/ignore sucessfull logins.

"MaxLevel" is no key at all and yes, it does.
RTFM.
I know you didn't, because you would have either be more precise on what you tried or asked back.
So RTFM.

Offline

#16 2018-02-13 17:25:37

sistematico
Member
From: Campo Grande / MS / Brasil
Registered: 2008-07-26
Posts: 94
Website

Re: Disable journalctl success logs

seth wrote:

"MaxLevel" is no key at all

I know.

seth wrote:

it does.

Only for sudo?


Lucas Saliés Brum
blog | medium | vk | twitter | github | .share
Forgive the spelling and grammar, English is not my native language.

Offline

#17 2018-02-13 17:29:03

sistematico
Member
From: Campo Grande / MS / Brasil
Registered: 2008-07-26
Posts: 94
Website

Re: Disable journalctl success logs

I'm giving up this thread, my doubt is not important to the general knowledge, they can lock if they want.

Thank you all.


Lucas Saliés Brum
blog | medium | vk | twitter | github | .share
Forgive the spelling and grammar, English is not my native language.

Offline

#18 2018-02-13 18:06:58

seth
Member
Registered: 2012-09-03
Posts: 6,874

Re: Disable journalctl success logs

No, of course not "only for sudo" - the message is sent by pam_unix anyway.
This brings us back to your intentions, in particular the subject "Disable journalctl success logs"

So try "man 8 pam_unix" then ...
And NO, it will not only affect sudo. The message is from PAM, not sudo.
If you need a more flexible log, use rsyslog.

Offline

Board footer

Powered by FluxBB