Secure logging.

Logging from ONE MACHINE, through ONE SWITCH back up a CABLE TO ANOTHER MACHINE PHYSICALLY SITUATED RIGHT NEXT TO THE OTHER.

Simple?

PROVE IT.

I have spent six weeks now, just trying to do remote logging in real-time but NOT IN CLEARTEXT.

This cannot be done.

I have tried:

1. Stunnel. Could not encrypt UDP so...
2. Syslog-ng. Would not compile, any questions answered with blissful silence.
3. SSH and Netcat. Did not work, absolutely nothing happened, and I know how to use both programs.
4. IPSec. Tried FreeSwan, Super FreeSwan and OpenSwan. Have now compiled a record of two kernels a DAY on TWO machines, tried every configuration under the sun. Come to the conclusion that everyone else on the openswan mailing list finds it way too difficult to configure.

Anything else I have missed? I WILL not send my logs in cleartext over my network, so this means I will not send my logs anywhere. I wouldn't be so furious if I was using some obscure broken linux but I am using a relatively clean Slackware 9.1 install with a 2.6.1 kernel.

mark

Well you already tried the two things I was going to recommend (syslog-ng and use TCP so you could tunnel it with stunnel or SSH), and IPSec tunnel between the machines. I'm not aware of any other way that it's possible to do it in real-time and encrypted.

Obviously, a lot of people have successfully setup syslog-ng and IPSec, so is it possible that there are "issues" with your distro, or that you just did not follow instructions correctly?

That's what frustrates me. I'm not blindly angry like I was earlier.

When I have a program I've never used before, I follow the documentation to the letter. The results of my application therefore rely entirely on the documentation.

I know that there's nothing wrong with my distro, as it was a minimal install of Slackware and I am meticulous (read obsessive) about keeping my machines in 100% working order.

I remember actually, I DID get syslog-ng to compile, but couldn't find any documentation that didn't assume you already knew everything about the program and had been using it for several years. All I want is to duplicate exactly my standard syslog setup, nothing more, (except I want it TCP instead of UDP).

According the mailing list, google and other linux forums (I belive I'd given up before I asked here), nobody in the world knows how to use this program. I find this very hard to believe.

Passed the day with some therapeutic noise-core.

mark