Hi,
I am looking for a solution to keep /var/log/secure a bit cleaner. The issue is that on this machine there are automatic ssh privatekey logins every minute from another machine of mine. It is a script that copies some files every minute, and I have to keep it running. Since I have an entry in /var/log./secure every minute from the second machine, it is obvious that it becomes overcrowded and difficult to read. I was unable to find a solution to exclude from logging the private key sessions OR to exclude logins from that certain machine (my.other.machine's.ip)
If anyone has a solution besides a cron script that will delete the entries from /var/log/secure, please take 500 points ;)
Here's an example of how the file looks:
Feb 11 15:21:03 gw sshd[24571]: Illegal user gordon from x.y.z.t
Feb 11 15:21:03 gw sshd[24573]: Illegal user williamb from x.y.z.t
Feb 11 15:21:05 gw sshd[24571]: Failed password for illegal user gordon from x.y.z.t port 37546 ssh2
Feb 11 15:21:05 gw sshd[24573]: Failed password for illegal user williamb from x.y.z.t port 37607 ssh2
Feb 11 15:21:08 gw sshd[24578]: Illegal user maartend from x.y.z.t
Feb 11 15:21:09 gw sshd[24577]: Illegal user williamb from x.y.z.t
Feb 11 15:21:11 gw sshd[24578]: Failed password for illegal user maartend from 125.22.251.218 port 37854 ssh2
Feb 11 15:21:11 gw sshd[24577]: Failed password for illegal user williamb from x.y.z.t port 37852 ssh2
Feb 11 15:21:14 gw sshd[24794]: Illegal user fahriald from x.y.z.t
Feb 11 15:21:14 gw sshd[24823]: Illegal user maartend from x.y.z.t
Feb 11 15:21:16 gw sshd[24794]: Failed password for illegal user fahriald from x.y.z.t port 38124 ssh2
Feb 11 15:21:17 gw sshd[24823]: Failed password for illegal user maartend from x.y.z.t port 38133 ssh2
Feb 11 15:21:20 gw sshd[24837]: Illegal user michelle from x.y.z.t
Feb 11 15:21:20 gw sshd[24838]: Illegal user fahriald from x.y.z.t
Feb 11 15:21:22 gw sshd[24837]: Failed password for illegal user michelle fromx.y.z.t port 38402 ssh2
Feb 11 15:21:22 gw sshd[24838]: Failed password for illegal user fahriald from x.y.z.t port 38416 ssh2
Feb 11 15:21:26 gw sshd[24843]: Illegal user michelle from x.y.z.t
Feb 11 15:21:28 gw sshd[24843]: Failed password for illegal user michelle from x.y.z.tport 38729 ssh2
Feb 11 15:21:40 gw sshd[25337]: Accepted publickey for root from my.other.machine's.ip port 54751 ssh2
Feb 11 15:22:39 gw sshd[26598]: Accepted publickey for root from my.other.machine's.ip port 54752 ssh2
Feb 11 15:23:40 gw sshd[27871]: Accepted publickey for root from my.other.machine's.ip port 54753 ssh2
Feb 11 15:24:40 gw sshd[29188]: Accepted publickey for root from my.other.machine's.ip port 54754 ssh2
Feb 11 15:25:40 gw sshd[30403]: Accepted publickey for root from my.other.machine's.ip port 54755 ssh2
Feb 11 15:26:40 gw sshd[31416]: Accepted publickey for root from my.other.machine's.ip port 54756 ssh2
As you can see, these entries overcrowd the file, making it a bit difficult to track for real events.
Any idea?
P.S. The machine is an old Red Hat 7.x
