you_hikoの技術メモ

# visudo

# 最終行に追記する
Defaults syslog=local1

# vi /etc/rsyslog.conf

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none               /var/log/messages
↓
# sudoのログを/var/log/messsageには出さないように修正
*.info;mail.none;authpriv.none;cron.none;local1.none   /var/log/messages       # local1.noneを追記

# The authpriv file has restricted access.
# sudoのログを/var/log/sudo.logへ出力
local1.*     /var/log/sudo.log　　　　# 42行目： 追記

# /etc/rc.d/init.d/rsyslog restart

Shutting down system logger: [ OK ]
Starting system logger: [ OK ]