topic Re: Syslog and inetd messages. in Operating System - HP-UX

Syslog and inetd messages.

Ian Killer — Wed, 27 Sep 2000 15:39:51 GMT

Our syslog which we use regularly in problem solving is full of "Connection Attempt" messages logged by inetd, making the task of problem solving more painful than it needs to be. I cant remove the informational level daemon messages from syslog without losing our service guard messages aswell. We can't turn off inetd logging without compromising our security. Is there a way of configuring inetd to log to somewhere other than syslogd without turning off logging completely?

Re: Syslog and inetd messages.

CHRIS_ANORUO — Wed, 27 Sep 2000 15:58:02 GMT

man syslogd
You can add a line in /etc/syslog.conf file for another information or error log file

Re: Syslog and inetd messages.

Lasse Knudsen — Wed, 27 Sep 2000 15:59:47 GMT

It looks like this is not an option with inetd as it is today.

You could run some kind of log analysis tool that would filter these messages from your syslog - like swatch or the like.

Maybe you need to look for an inetd replacement - there are several out there - whether they function under UX is another matter - have you tried xinetd, rlinetd, or g2s - the latter seems promising.

Re: Syslog and inetd messages.

Alan Riggs — Wed, 27 Sep 2000 16:06:21 GMT

in /etc/syslog.conf(tab delimited):

*.info;inetd.none /var/adm/syslog/syslog.log
inetd.info /var/adm/syslog/inetd.log

Re: Syslog and inetd messages.

Bruce Laughlin — Wed, 27 Sep 2000 16:10:48 GMT

Hi Ian,

Perhaps you can experiment with something like the following in your syslog.conf file. Note that I added an extra line after the mail.debug line:

$ cat /etc/syslog.conf
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
daemon.debug /var/adm/syslog/daemon.log
*.info;mail.none;daemon.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

This should effectively re-route all messages from the daemon facility of level debug or higher to /var/adm/syslog/syslog.daemon.

Of course, you should test this first to ensure it does what you want it to, and that you don't lose any messages.

Bruce Laughlin

Re: Syslog and inetd messages.

Ian Killer — Thu, 28 Sep 2000 08:47:22 GMT

Chris, Alan R., Bruce,
We tried creating another daemon facility log file, for informational messages, but it takes the serviceguard info messages with it. I'll try the suggestion of an inetd.info line. The syslog.conf file separates facilities and not specific daemons according to the man pages, but I 'll let you know what happens. I'll try the debug option also. Cheers.

Re: Syslog and inetd messages.

Ian Killer — Thu, 28 Sep 2000 08:49:23 GMT

Alan S.,
This is what I suspected. I'm trying to pick the minds of those that know undocumented features.
Cheers.

Re: Syslog and inetd messages.

Ian Killer — Thu, 28 Sep 2000 09:05:29 GMT

The inetd.info option caused syslogd to error: unknown facility.
The daemon.debug experiment left the connection messages in the syslog.log.
Bummer.

Re: Syslog and inetd messages.

Ian Killer — Thu, 28 Sep 2000 09:30:54 GMT

The daemon.debug to daemon.log, *.info and daemon.none option to syslog took all the daemon messages including service guard, LVM and named messages to daemon log. Double bummer.

Filter script it will have to be.

Thanks for all your help friends. Hope I can do the same for you sometime.

Ian