腳本執行需要root權限，但腳本中使用su命令來執行其他命令或腳本，比如使用nginx用戶調用日誌統計腳本。
在/var/log/message日誌中有過多的日誌顯示
Jun 28 10:28:06 localhost su: (to nginx) chuangyw on none Jun 28 10:28:06 localhost su: (to nginx) chuangyw on none Jun 28 10:28:06 localhost su: (to nginx) chuangyw on none Jun 28 10:28:07 localhost su: (to nginx) chuangyw on none Jun 28 10:28:07 localhost su: (to nginx) chuangyw on none Jun 28 10:28:07 localhost su: (to nginx) chuangyw on none Jun 28 10:28:07 localhost su: (to nginx) chuangyw on none Jun 28 10:28:07 localhost su: (to nginx) chuangyw on none Jun 28 10:28:07 localhost su: (to nginx) chuangyw on none Jun 28 10:28:07 localhost su: (to nginx) chuangyw on none Jun 28 10:28:07 localhost su: (to nginx) chuangyw on none Jun 28 10:28:07 localhost su: (to nginx) chuangyw on none Jun 28 10:28:07 localhost su: (to nginx) chuangyw on none Jun 28 10:28:08 localhost su: (to nginx) chuangyw on none Jun 28 10:28:08 localhost su: (to nginx) chuangyw on none Jun 28 10:28:08 localhost su: (to nginx) chuangyw on none Jun 28 10:28:08 localhost su: (to nginx) chuangyw on none Jun 28 10:28:08 localhost su: (to nginx) chuangyw on none Jun 28 10:28:08 localhost su: (to nginx) chuangyw on none Jun 28 10:28:08 localhost su: (to nginx) chuangyw on none
嚴重影響message的閱讀和過濾；
計劃將信息重新建立一個文件保存比如/var/log/su
修改/etc/rsyslog.conf
在message條目中添加：
auth.none
增加條目：
auth.* /var/log/su
# Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none;auth.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure auth.* /var/log/su # Log all the mail messages in one place. mail.* -/var/log/maillog
記得重啓rsyslog生效
systemctl restart rsyslog.service