system and kernel log daemon touch /var/log/auth.log chmod 600 /var/log/auth.log