Take the 2-minute tour ×

When I delete /var/log/secure this file will be recreated. How do I disable the recreation of this file?

share|improve this question
Do you know which program creates that file? –  Timo Feb 9 '14 at 21:17
Where do you want the information that normally gets logged in this file to end up? –  Gilles Feb 9 '14 at 23:53

2 Answers 2

/var/log/secure is written to by syslogd (or rsyslogd, depending on the OS version) -- this is controlled by /etc/syslog.conf (or /etc/rsyslog.conf). As shipped, the log class "authpriv.*" is set to log to this file. If you don't wan't logging, your can comment out this selector from the .conf file.

Also, check the logrotate configuration (/etc/logrotate.conf, /etc/logrotated.d/) for the rotation script for syslog. This will typically re-create the file (although the file won't be growing if you comment it out of /etc/rsyslog.conf).

share|improve this answer
Is this everything that needs to be done? –  ZeroxZerox Feb 9 '14 at 21:40
Should you simply delete the logrotate.conf and lograted.d? –  ZeroxZerox Feb 10 '14 at 6:37
You do not want to delete logrotate configuration files -- there are several ones in there, if you delete them then your log files will continue to grow. First, I should have probably asked you, why you don't want /var/log/secure? Is it because it is getting too large before it gets rotated out? If so, you can adjust the rotate scripts so that it rotates sooner, and compresses when it rotates. –  Derek Pressnall Feb 10 '14 at 18:20

If you cannot find the program that writes that file, and disable that program or if you cannot prevent it from being run, you can try and create the file and change the permission:

 rm /var/log/secure
 touch /var/log/secure
 chmod 000 /var/log/secure

Depending on how the program that writes to the file works, this might prevent it from updating the file. But it could also cause the program that writes the file to complain or even to crash.

*Of course you end up with the file being there, it would not be recreated and/or updated. But if the creating program removes/renames the old /var/log/secure before it starts writing the new version there is little you can do without changing the program or its configuration.

share|improve this answer
/var/log/secure always gets renamed to something like secure-20140902, because of logrotation. This is default behavior! So it is a fact that "the creating program renames the old /var/log/secure" –  ZeroxZerox Feb 9 '14 at 21:20

Your Answer


