LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (http://www.linuxquestions.org/questions/linux-software-2/)
-   -   Centralized syslog in solaris 10 (http://www.linuxquestions.org/questions/linux-software-2/centralized-syslog-in-solaris-10-a-887465/)

harshaabba 06-21-2011 02:31 AM

Centralized syslog in solaris 10
 
hi all,

I want to implement centralized syslog server for my linux servers in order to log successfull logging and failure
loggings.

I uses solaris 10 as a centralized server.Here is the syslog.conf file.

*.err;kern.notice;auth.notice /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages

*.alert;kern.err;daemon.err operator
*.alert root

*.emerg *

local7.err /logs/cisco/cis
local7.warn /logs/cisco/cis
auth.debug /logs/cisco/cis

# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)

mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)

#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err /dev/sysmsg
user.err /var/adm/messages
user.alert `root, operator'
user.emerg *


This is the remote client linux machine syslog.conf

authpriv.* /var/log/secure
authpriv.* @<SOLARIS_SERVER_IP>


But Still I coudnt get the authentication messages. Please help me.

tnx

chrism01 06-21-2011 08:45 PM

As it says here, on the CLIENT
Code:

# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)

you need to un-comment out ie activate that line.

On the Central SERVER, amend /etc/default/syslogd
Code:

#ident  "@(#)syslogd.dfl        1.1    01/11/01 SMI"
#
# Copyright (c) 2001 by Sun Microsystems, Inc.
# All rights reserved.
#
# /etc/default/syslogd
#
# syslogd default settings processed via syslogd(1M).
#
# LOG_FROM_REMOTE affects the logging of remote messages, see syslogd(1M)
# for details.  The default value is "YES".  A value of "NO" (any case)
# results in disabling of remote logging; any other value is ignored.
#
# Copy and uncomment the following default lines to change the values.
#
#LOG_FROM_REMOTE=YES

ie activate (un-comment) that line.

You may(?) also have to adjust the firewalls at each end ( on Solaris http://www.homepage.montana.edu/~uni...laris_ipf.html).
FYI
Code:

grep syslog /etc/services
syslog          514/udp



All times are GMT -5. The time now is 01:20 PM.