From 9e5933f4a49b4a85e19c964569415af24cdf0e8f Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Sun, 1 Mar 2020 10:09:45 +0100
Subject: syslog: T2086: move sudo session open/close log entries to auth.log

---
 src/etc/rsyslog.d/sudo.conf | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 src/etc/rsyslog.d/sudo.conf

(limited to 'src')

diff --git a/src/etc/rsyslog.d/sudo.conf b/src/etc/rsyslog.d/sudo.conf
new file mode 100644
index 000000000..589651f87
--- /dev/null
+++ b/src/etc/rsyslog.d/sudo.conf
@@ -0,0 +1,9 @@
+# Isolating sudo messages from syslog
+#
+# https://debian-administration.org/article/676/Isolating_sudo_messages_from_syslog
+
+# match if "program name" is equal to "sudo"
+:programname, isequal, "sudo" -/var/log/auth.log
+
+# if we matched this causes the input to be swallowed, preventing further logging.
+& ~
-- 
cgit v1.2.3