Change syslogging of authorization related commands

For sucessful sudo, just log it at info level.
Capture any security failures/changes into /var/log/auth.log
but skip normal CLI commands

Turn off the builtin sync after each write to /var/log/messages
by putting - before file name; the sync causes a disk write
each time and therefore can be a performance hit during boot.

2 files changed, 21 insertions, 2 deletions

diff --git a/debian/vyatta-cfg-system.postinst.in b/debian/vyatta-cfg-system.postinst.in
index 0852319e..8e8b6015 100644
--- a/debian/vyatta-cfg-system.postinst.in
+++ b/debian/vyatta-cfg-system.postinst.in
@@ -57,6 +57,13 @@ EOF
 	echo -e "\n%users ALL=NOPASSWD: ${bindir}/sudo-users/" >> /etc/sudoers
     fi
 
+    # Reduce logging level of good commands
+    if ! grep -q "^Defaults syslog_goodpri" /etc/sudoers; then
+	echo "\nDefaults syslog_goodpri=info" >>/etc/sudoers
+    fi
+	
+    fi
+
     # keep env vars
     if ! grep -q 'env_keep+=VYATTA_*' /etc/sudoers ; then
 	echo "Defaults env_keep+=VYATTA_*" >> /etc/sudoers
diff --git a/sysconf/syslog.conf b/sysconf/syslog.conf
index 4281cfd6..f732affc 100644
--- a/sysconf/syslog.conf
+++ b/sysconf/syslog.conf
@@ -1,2 +1,14 @@
-*.warning	/var/log/messages 
-local7.*	/var/log/messages
+# Standard logfiles by facility
+auth.*;,authpriv.notice	/var/log/auth.log
+
+# Some other (unused) standard entries
+#cron.*			/var/log/cron.log
+#kern.*			-/var/log/kern.log
+#lpr.*			-/var/log/lpr.log
+#mail.*			-/var/log/mail.log
+#user.*			-/var/log/user.log
+
+# Catch-all log file used by CLI
+*.warning;local7.*;\
+	auth,authpriv.none;\
+	cron,daemon.none; -/var/log/messages