Remove the record of su commands from the message log file

Root authority is required for script execution, but su commands are used in the script to execute other commands or scripts, such as using the nginx user to invoke the log statistics script.

There are too many logs in the / var/log/message log

Jun 28 10:28:06 localhost su: (to nginx) chuangyw on noneJun 28 10:28:06 localhost su: (to nginx) chuangyw on noneJun 28 10:28:06 localhost su: (to nginx) chuangyw on noneJun 28 10:28:07 localhost su: (to nginx) chuangyw on noneJun 28 10:28:07 localhost su: (to nginx) chuangyw on noneJun 28 10:28:07 localhost su: (to nginx) chuangyw on noneJun 28 10:28:07 localhost su: (to nginx) chuangyw on noneJun 28 10:28:07 localhost su: (to nginx) chuangyw on noneJun 28 10:28:07 localhost su: (to nginx) chuangyw on noneJun 28 10:28:07 localhost su: (to nginx) chuangyw on noneJun 28 10:28:07 localhost su: (to nginx) chuangyw on noneJun 28 10:28:07 localhost su: (to nginx) chuangyw on noneJun 28 10:28:07 localhost su: (to nginx) chuangyw on noneJun 28 10:28:08 localhost su: (to nginx) chuangyw on noneJun 28 10:28:08 localhost su: (to nginx) chuangyw on noneJun 28 10:28:08 localhost su: (to nginx) chuangyw on noneJun 28 10:28:08 localhost su: (to nginx) chuangyw on noneJun 28 10:28:08 localhost su: (to nginx) chuangyw on noneJun 28 10:28:08 localhost su: (to nginx) chuangyw on noneJun 28 10:28:08 localhost su: (to nginx) chuangyw on none

Seriously affect the reading and filtering of message

Plan to re-create a file to save the information, such as / var/log/su

Modify / etc/rsyslog.conf

Add to the message entry:

Auth.none

Add entries:

Auth.* / var/log/su

# Log anything (except mail) of level info or higher.# Don't log private authentication messageshandling. InfoterMail.noneTerritauthpriv.noneThere cron.none Auth.none / var/log/messages# The authpriv file has restricted access.authpriv.* / var/log/secureauth.* / var/log/su# Log all the mail messages in one place.mail.* -/ var/log/maillog

Remember to restart rsyslog to take effect

Systemctl restart rsyslog.service