OCI: /var/log/secure Log File Is not Updated or Present in Linux Instance

Applies To:

Oracle Cloud Infrastructure - Version N/A and later  

Linux x86-64 

 

Symptoms: 

OCI Linux instance does not have a /var/log/secure or the log files contents are not updated.

$ sudo ls -l /var/log/secure 
ls: cannot access /var/log/secure: No such file or directory 

 

Cause:

The /etc/rsyslog.conf file does not have a configuration to log information to /var/log/secure

 

Solution:

1) As the root user, edit the file /etc/rsyslog.conf and append the following lines:

authpriv.*                                             /var/log/secure 

2) Then restart and enable rsyslog service: 

$ sudo systemctl restart rsyslog 
$ sudo systemctl enable rsyslog