How to ignore Cp-Wrap messages in /var/log/secure

The described log entries are normal. Is there a specific reason that necessitates ignoring Cp-Wrap (CP-Wrapper) log messages (in "/var/log/secure")?

What problem are you seeing exhibited, if any?

 

Customize system logwatch configuration to ignore specific services

Please note that the reported message is not an error; however, if you are receiving e-mails from the system utility "logwatch" then I believe you may be able to ignore certain log entries by adjusting the appropriate logwatch configuration file(s). For RHEL4/CentOS4, having logwatch ignore the service appeared to work as reported in this older thread: Logwatch Full of CP-Wrap messages - cPanel Forums

The following steps should help if you need to have logwatch ignore "Cp-Wrap" log entries in /var/log/secure:

• For RHEL4/CentOS4:
  1. Verify if logwatch is installed and install if needed:
     
     Code:

     # rpm -q logwatch
     # /scripts/ensurerpm logwatch

  2. Locate appropriate configuration file:
     
     Code:

     /etc/log.d/conf/services/secure.conf

  3. Open configuration file, look for a line like the following:
     Code:

     $ignore_services = sshd Pluto stunnel proftpd

  4. Edit to append an additional ignored service:
     
     Code:

     $ignore_services = sshd Pluto stunnel proftpd Cp-Wrap

  5. Save changes and then wait to check the content of future logwatch e-mails.
• For RHEL5/CentOS5:
  1. Verify if logwatch is installed and install if needed:
     
     Code:

     # rpm -q logwatch
     # /scripts/ensurerpm logwatch

  2. Locate appropriate configuration file:
     
     Code:

     /etc/logwatch/conf/services/secure.conf

  3. If configuration file does not exist, create it by copying the default:
     
     Code:

     # cp -av /usr/share/logwatch/default.conf/services/secure.conf /etc/logwatch/conf/services/secure.conf

  4. Open configuration file, look for a line like the following:
     Code:

     $ignore_services = sshd Pluto stunnel proftpd saslauthd imapd

  5. Edit to append an additional ignored service:
     
     Code:

     $ignore_services = sshd Pluto stunnel proftpd saslauthd imapd Cp-Wrap

  6. Save changes and then wait to check the content of future logwatch e-mails.