You in my demo. I've shown you how it works on CentOS.
Now I'd like to show you what it's like on Ubuntu.
Sudo systemctl status of r syslog do we have it?
Yeah, we do. That means that if I want to know where
authentication messages are sent to, I need sudo vim on on etc
r syslog conf and then I'm going to search for auth where.
Oh, I'm not finding any auth priv So I need to check in
the rules if we have anything that is setting authentication related messages.
And what I'm seeing here is that, well, there is no rules in here.
That's interesting. So what is Ubuntu doing? Well, let's check out etc r
syslog d and aha. There we can see the configuration 50 default conf.
So this distribution isn't specifying everything in the main configuration file,
it's spreading it out over the different drop in files.
So 50 default conf is what I need to be looking at. And, and look, there we go.
Auth and auth priv Everything is going to var log auth log. So this is what we need to see.
So sudo less on var log auth log and there we can see
all the authentication related messages and that's how you can find it.