Extrait de /etc/syslog.conf

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages
 
# The authpriv file has restricted access.
authpriv.*                                  /var/log/auth.log
auth,authpriv.none;                         /var/log/syslog