How To Suppress Excessive Logging by PAM

PAM (Linux Pluggable Authentication Modules) has become very verbose in Ubuntu 24.04 LTS, causing excessive logging of various events. This has the annoying side effect of making the logs too big, and hard to find information in. It also causes log summarizing programs, such as Logwatch, to generate larger reports.

The goal of this page is to detail how to suppress excessive logging by PAM.

The following works for Ubuntu 24.04 LTS, and perhaps its upstream Debian release as well.

Edit the file: /etc/pam.d/common-session-noninteractive

Locate the following line, usually at the end of the file:

session required  pam_unix.so

Add the following lines just before the live above (containing pam_unix.so):

# Added to suppress excessive logging
session [success=1 default=ignore] pam_succeed_if.so service in cron quiet use_uid

Then run the following command:

sudo pam-auth-update

This will popup a dialog, make sure that the following are enabled:

[*] Unix authentication
[*] Register user sessions in the systemd control group hierarchy
[*] Inheritable Capabilities Management  

This should take care of the excessive logging by PAM.