Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently setting up a VPS and was wondering if there is any way at all for me to exclude a specific user from being logged to /var/log/auth.log?

Doing the same for lastlog and every other log file that is somehow affected by sshd would be even better.

I know I can /dev/null/ the entire log file, but this would obviously break fail2ban and similar packages.

I have come across a solution that relies on a cron job cutting out the offending parts, but this seems a little dodgy. Any ideas?

share|improve this question

You are trying to tamper with audit data. By design this is very difficult to do (I would say almost impossible) as otherwise what would be the point of having audit logs?

If you want to spy on your users then you have to consider law in your country as well as technical difficulties.

I'm afraid that you are looking for a dodgy solution which likely will be difficult to achieve.

Or just install rootkit...

share|improve this answer
i simply don't want to be logged on my own server. this has nothing to do with 'spying on my users'? there's no one but me. – house Jun 1 '13 at 11:39
@house If there's no one but you, couldn't you just ignore these logs and log entries? – Daniel Beck Jun 1 '13 at 13:23
@Daniel it's just for peace of mind, really. i like my privacy :) – it was possible to exclude cron, so i was hoping there'd be an easy way for individual users as well. – house Jun 1 '13 at 13:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.