topic Re: syslog.log entries in Operating System - HP-UX

syslog.log entries

CCIL — Mon, 20 Jan 2003 08:00:33 GMT

i have HP n class server with HP-Ux 11i as OS , the server is used extensively by our clients for FTP purpose , so the /var/adm/syslog/syslog.log if i go thro" the syslog.log it shows all the FTP entries which makes nearely impossible to analyze syslog. is there any way to divert these FTP entries from syslog.log to another file

Re: syslog.log entries

Armin Feller — Mon, 20 Jan 2003 08:11:07 GMT

Hi,

you have to customize the syslog.conf file.

See syslogd(1m) and syslog(3C) for more information.

Regards ...
Armin

Re: syslog.log entries

kish_1 — Mon, 20 Jan 2003 08:32:08 GMT

you can this script, run it on crontab and will send a mail to you

Re: syslog.log entries

Stefan Farrelly — Mon, 20 Jan 2003 08:41:57 GMT

Change your /etc/syslog.conf file to this and it will log ftp messages to a new ftp logfile; (then restart syslog; /sbin/init.d/syslogd stop then start)

# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
local5.info;mail.none /var/adm/syslog/ftp.log
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

Re: syslog.log entries

Carlo Henrico_1 — Mon, 20 Jan 2003 08:44:28 GMT

Not too sure what you want to analyse. If what you are after is the system errors and warnings (and not the FTP messages), try using "dmesg -". A normal dmesg gives you all the errors and stuff but adding a "-" (minus) shows only what you have not seen yet. The system keeps track of what you have then seen and what not.

Obviously the first time it still show everything but thereafter only what you have not seen yet.

Good luck

Carlo

Re: syslog.log entries

T G Manikandan — Mon, 20 Jan 2003 09:51:07 GMT

*.info;mail.none;local5.none /var/adm/syslog/syslog.log
local5.info /var/adm/syslog/ftp.log

local5 is for ftp.

by changing the local5.info into a seperate logfile and also making the local5.none for the syslog file the ftp messages can be now re-directed to another log file

Re: syslog.log entries

Zeev Schultz — Mon, 20 Jan 2003 11:14:11 GMT

grep -v ftp /var/adm/syslog/syslog.log > /tmp/syslog_no_ftp;mv /tmp/syslog_no_ftp /var/adm/syslog/syslog.log.
put anywhere from crontab to alias (ed_syslog ex.) :)

regards