LinuxQuestions.org - Centralized syslog in solaris 10

- Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)

- - Centralized syslog in solaris 10 (https://www.linuxquestions.org/questions/linux-software-2/centralized-syslog-in-solaris-10-a-887465/)

Centralized syslog in solaris 10

hi all,

I want to implement centralized syslog server for my linux servers in order to log successfull logging and failure
loggings.

I uses solaris 10 as a centralized server.Here is the syslog.conf file.

*.err;kern.notice;auth.notice /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages

*.alert;kern.err;daemon.err operator
*.alert root

*.emerg *

local7.err /logs/cisco/cis
local7.warn /logs/cisco/cis
auth.debug /logs/cisco/cis

# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)

mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)

#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err /dev/sysmsg
user.err /var/adm/messages
user.alert `root, operator'
user.emerg *

This is the remote client linux machine syslog.conf

authpriv.* /var/log/secure
authpriv.* @<SOLARIS_SERVER_IP>

But Still I coudnt get the authentication messages. Please help me.

tnx

As it says here, on the CLIENT

Code:

# if a non-loghost machine chooses to have authentication messages

# sent to the loghost machine, un-comment out the following line:

#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)

you need to un-comment out ie activate that line.

On the Central SERVER, amend /etc/default/syslogd

Code:

#ident  "@(#)syslogd.dfl        1.1    01/11/01 SMI"

#

# Copyright (c) 2001 by Sun Microsystems, Inc.

# All rights reserved.

#

# /etc/default/syslogd

#

# syslogd default settings processed via syslogd(1M).

#

# LOG_FROM_REMOTE affects the logging of remote messages, see syslogd(1M)

# for details.  The default value is "YES".  A value of "NO" (any case)

# results in disabling of remote logging; any other value is ignored.

#

# Copy and uncomment the following default lines to change the values.

#

#LOG_FROM_REMOTE=YES

ie activate (un-comment) that line.

You may(?) also have to adjust the firewalls at each end ( on Solaris http://www.homepage.montana.edu/~uni...laris_ipf.html).
FYI

Code:

grep syslog /etc/services

syslog          514/udp