2

I have a Ubuntu (14.x) host serving as a Git repository box (via GitLab CE). Around 50 users are using shared user (in this case gitlab) to connect to the box to sync their repositories. This method works quite fine but unluckily it totally nukes my /var/log/auth.log which easily grows to 10 gigs per day with lines like this:

Apr 22 14:10:25 gitlab sshd[7434]: pam_unix(sshd:session): session opened for user git by (uid=227)
Apr 22 14:10:25 gitlab sshd[7435]: pam_unix(sshd:session): session closed for user gitlab

Is there a method to suppress this messages for this user and stop flooding my logfile?

Improve this question

1 Answer 1

Reset to default
5

You can configure rsyslogd to discard messages mentioning the gitlab user. Create a file in /etc/rsyslog.d/ (say, 10-filter-git.conf), containing:

if $syslogfacility-text startswith 'auth' and $msg contains 'gitlab' and  not ($msg contains 'failure') then ~

This is an expression-based filter that:

  • matches messages coming from facilities whose name begin with auth. Typically, the entries in auth.log are from the auth and authpriv facilities.
  • matches messages containing gitlab - use your username here.
  • matches messages not containing failure - I assume you'd still want to keep an eye out for authentication failures.
  • ~ discards messages sent to it.

Then restart rsyslogd:

service rsyslog restart

Now normal messages about the gitlab user shouldn't appear in auth.log.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .