Solaris 10 syslog server

jonfa · 06-27-2007, 09:04 AM

Hi All,

I am attempting to setup a Solaris 10 syslog server to receive logs from linux machines. Here's what I did:

On the server (Solaris 10):
1. start syslogdby issuing $/usr/sbin/syslogd -T

On a client (Centos 4.5):
1. Configured /etc/syslog.conf to send logs to server using @server_ip_address

I am not receiving any communication between server and client. What am I missing? Thanks.

acid_kewpie · 06-27-2007, 10:19 AM

you've not shown us the config files, we can't just take your word for it that you configured it right now can we?

personally i'd suggest you might like to look at splunk, which runs under solaris or linux and does a lovely job of handling things like syslog and other log data in a clever way. i'd also suggest using syslog-ng instead of normal syslog on linux, it's much simpler and more powerful.

jonfa · 06-28-2007, 08:35 AM

Here is a syslog.conf file from my Centos 4.5 box:

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none/var/log/messages

# The authpriv file has restricted access.
authpriv.* /var/log/secure

# Log all the mail messages in one place.
mail.* -/var/log/maillog

# Log cron stuff
cron.* /var/log/cron

# Everybody gets emergency messages
*.emerg *

# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log
local7.* /var/log/boot.log

*.info;mail.none;authpriv.none;cron.none @10.0.0.88
authpriv.* @10.0.0.88
##*.debug /var/log/messages

I am trying to get the logs to my Solaris 10 box (IP=10.0.0.88). I have started syslogd on Solaris with the -T option.

I have found that some log files (from the linux clients) are being stored in /var/adm/messages (on Solaris), but it's not logging information like system logon.

Where would I find the logs for authentication? How can I get all my log information to my Solaris box? Any suggestions?