You are not logged in.
There is a file in my /var/log directory named ppp.log, but it is not a PPP log. It contains a random log of commands I ran with sudo. It includes stuff that I emphatically don't want to be logged anywhere on my system, like truecrypt invocations. What is ppp.log? What writes it? Why does it contain stuff completely unrelated to PPP?
edit: going through the forums and marking my old stuff as solved...
Last edited by Rulatir (2009-01-11 11:12:14)
Offline
That's odd, it's happening on my system, too. Looking at `syslog-ng.conf', `/var/log/ppp.log' is supposed to contain log entries from the `local2` facility. (A syslog facility is just a category of entries, used to sort them into individual files.) Judging from the sudo man page and PKGBUILD, sudo should be logging to the `auth' syslog facility. This aspect of your problem is probably a bug and should be reported. I'd start with the Arch bug tracker, and it can go upstream if the sudo maintainer thinks it should.
As for disabling sudo logging entirely, that's fortunately easy. Just run `visudo', and under the `Defaults specification' comment, add this line:
Defaults !syslog
Offline
Confirmed here also, sudo logging to ppp.log
The first log entry is on Nov 1, 2007 for me.
Offline
On further investigation, it looks like the problem was noticed and solved. On Dec 31, the sudo maintainer changed the PKGBUILD to log to auth. I update pretty much daily, and the last entry in my `/var/log/ppp.log' is dated Jan 1. It looks like in November the upstream sudo maintainer changed the default log facility to local2, which Arch uses for PPP entries. The latest sudo package should be fine.
Offline
Thanks everyone! I confirm it fixed now. Last command logged in my ppp.log is the "pacman -Syu" that installed the latest sudo
Offline