username syntax is deprecated in rsyslog. Use
If it still does not work:
rsyslog uses the
/var/run/utmp file to find a list of the user's ttys; terminal emulators have to add themselves to that file, and this requires sufficient privileges (the file is usually not world-writable). X11-based terminal emulators are different from system login programs, in that they start with the user's, not root's, privileges.
who to list the contents of utmp. If they do not list any "pts/X" entries belonging to pseudo-terminals:
First make sure
/var/run/utmp exists, is owned by the
utmp group and is writable by that group. If not, run
# chown :utmp /var/run/utmp && chmod ug=rw,o=r /var/run/utmp
Then check if your terminal emulator has sufficient privileges to write to that file – namely, the setgid bit and correct group ownership:
-rwxr-sr-x 1 root utmp 1.3M May 25 2012 /usr/bin/urxvt
-rwxr-sr-x 1 root utmp 475K Nov 26 16:54 /usr/bin/xterm
-rwxr-sr-x 1 root utmp 15K Nov 13 00:36 /usr/lib/vte/gnome-pty-helper
Note: GNOME Terminal uses a separate
gnome-pty-helper tool to perform utmp changes.
If any are missing, run:
# chown :utmp /usr/lib/vte/gnome-pty-helper \
&& chmod g+s /usr/lib/vte/gnome-pty-helper
rsyslogd is running as an account that is allowed to write to users' ttys. If necessary, add it to the
In some distributions, check if the SELinux or AppArmor policy allows the utmp updates.