On 12/25/2013 08:43 AM, Duncan wrote: > Alice Ferrazzi posted on Wed, 25 Dec 2013 15:38:42 +0900 as excerpted: > >> On Sun, Dec 15, 2013 at 2:19 AM, Michael Orlitzky <m...@gentoo.org> >> wrote: >>> rc-update del vixie-cron default >>> /etc/init.d/vixie-cron stop >>> emerge -C vixie-cron >>> emerge cronie >>> rc-update add cronie default >>> /etc/init.d/cronie start >> >> I Just did the same, is simple and "drop-in" > > I did it too, a few days ago. > > TL;DR: Drop-in but for the log-spamming. =:^( > > While cronie itself was simple and drop-in for vixie-cron, it DID start > rather severely log-spamming, IIRC four log-lines every 10 minutes when > the run-crons ran. As a result, while the functionality was drop-in > replacement, for the system as a whole it wasn't purely a drop-in > replacement, as I had to adjust logging somewhat to kill the spamming. > > An update tweak to my syslog-ng.conf category-cron filter later, and I > was down to a single log entry in the general messages log every ten > minutes, the other three diverted to my separate cron log. > > The remaining one was an audit entry (type=1006) output by the kernel. > Of course I could filter that out or divert it to the cron log too, but > first I needed to know the significance. After all, it's not often I get > the kernel outputting audit entries. > > A bit of googling later, I found that the type 1006 audit entries I was > getting were AUDIT_LOGIN related, due to the way cron changes user to run > its various programmed entries. Of course one can turn off the kernel's > corresponding audit options, but that affects other things too. > Meanwhile, the google turned up some RHEL/Fedora complaints about > something similar. Apparently in this case the kernel defaults to log- > spamming even if audit logging is generally deactivated. I could try > installing an audit tool and configure it to turn that off specifically, > but meh, just set a syslog filter for it; the effect is the same either > way. >
Could you share the lines that provided the filtering? I'm sure it would help others. Your e-mail led me to check my logs to see if I have the same, but I don't know where to look.
