LinuxQuestions.org - Chrooted OpenSSH SFTP server logging issue

- Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)

- - Chrooted OpenSSH SFTP server logging issue (https://www.linuxquestions.org/questions/linux-server-73/chrooted-openssh-sftp-server-logging-issue-895146/)

Chrooted OpenSSH SFTP server logging issue

Hi all,

I have a problem related to logs in a chrooted sftp server where user home directories are on an NFS share. (/CHROOT-NFS)
Basically I have let's say 500 users each one of them are chrooted in their own home directory.
Since I want verbose logging as well, I have to create dev/log in each user directory and make the syslog daemon listen to it. (/CHROOT-NFS/user200/dev/log)
Everthing is working fine with one server.

BUT I have for eg. 10 servers using the same NFS share to share the SFTP load. I though that it's not gonna be a problem, I just set the same sylog setup on all servers and thats it. Unfortunately this doesn't work because logging works only on the server where I created the device files originally.

Any idea? I hope I was enough detailed to understand this mess :)

Thanks in advance,
cU

Set up syslog to log to files on ONE server (your syslog server) and the configure syslog on the OTEHR servers to forward to that ONE. Check the manpage and config file comments: it is not difficult.

Actually, it is possible (and prob advisable, given the nums of users & servers involved) to have each server have its own logs and each server can also fwd same log info to a central server, as above.

Eg (RHEL/Centos): on the central logging server

Code:

#Edit /etc/sysconfig/syslog. Add “-r” to the SYSLOGD_OPTIONS line:



SYSLOGD_OPTIONS="-m 0 -r"



Restart syslogd with:



service syslog restart

On sending server

Code:

/etc/syslog.conf is something like:



*.info;cron.!=info;mail.none;local0.notice          @logs.company.com



#where logs.company.com is the machine you just set up to listen to syslog messages.

& restart syslog here also.

See 'The Easy Way' section here http://lonesysadmin.net/2011/01/13/h...d-hatcentos-5/

PS I'd prob use the IP of the central server, rather than DNS name: YMMV