Strangest thing (crond every 5 min.)

[mailing-lists at hughesjr.com (Johnny Hughes)]

You can at least strip this out to another file, so you can get it out of
/var/log/messages and somewhere else.

Edit the file /etc/syslog.conf and find the line:

*.info;mail.none;authpriv.none;cron.none      /var/log/messages

Change it to:

*.info;auth.none;mail.none;authpriv.none;cron.none      /var/log/messages

then add these lines:

# Strip out auth info
auth.*                                                  /var/log/auth

Save the file....

This will make it so that there is a seperate file that is /var/log/auth
.. which will contain all auth log info

Next, you need to make sure that log file ( /var/log/auth ) is rotated
like all the other syslog logs.  Edit the file /etc/logrotate.d/syslog and
add /var/log/auth to the top line and save the file.

Now restart syslog with the command:

/etc/init.d/syslog restart


-- 
Johnny Hughes
<http://www.HughesJR.com/>