topic Re: syslog.conf file in Operating System - HP-UX

syslog.conf file

Peter Gillis — Thu, 09 Sep 2004 00:19:31 GMT

hi, ux11i
I am trying to work out the syslog.conf file. From what I understand, the following should mean a /var/adm/syslog/auth.log file is added to whenever an auth.notice type message is issued on the system:

auth.notice /var/adm/syslog/auth.log #

I have reread the conf file and issued an su command from root to another user. Would this not get logged in the /var/adm/syslog/auth.log file?

Thanks in advance for help..
Maria

Re: syslog.conf file

Olivier Decorse — Thu, 09 Sep 2004 00:33:03 GMT

Hi,
first, i advise you to create the auth.log file, with "better rights" than syslog.log.
Next, try better a su FROM an user, TO root. su from root to an user is not really interresting for authentification.

Olivier.

Re: syslog.conf file

Michael Tully — Thu, 09 Sep 2004 00:36:33 GMT

Maria,

Does the /var/adm/syslog/auth.log already exist? If not try to create it.

Did the attempt still get logged to /var/adm/syslog/syslog.log ?

Try su from an a normal user to root.

Regards
Michael

Re: syslog.conf file

Dave Olker — Thu, 09 Sep 2004 00:39:46 GMT

Hi Maria,

The level of logging all depends on how the daemon is coded to log the syslog events. If you're looking to capture su usage into a separate file from the syslog.log file, you could use:

auth.info /var/adm/syslog/auth.log

This line would instruct syslogd to log any "INFO" level messages from the authentication subsystem to the /var/adm/syslog/auth.log file. By default these messages also get logged to the /var/adm/syslog/syslog.log file, but if you want to capture specific types of messages for a given subsystem you can re-direct them in this manner.

Again, whether or not you capture the messages your interested in or not depends on how the daemon calls the syslog(3C) function and what level or type of message it logs. In the case of su, it uses INFO level syslog logging, so redirecting INFO level messages to a separate file would capture them.

Hope this helps,

Dave

Re: syslog.conf file

Muthukumar_5 — Thu, 09 Sep 2004 00:56:45 GMT

su log informations are stored as,

auth.info not as auth.notice

edit /etc/syslog.conf file as,
-----------

auth.info /var/adm/syslog/auth.log
*.info, ....

Note: No need to create the auth.log file.

Restart the syslogd as

kill the old syslogd ( ps -ef to get or syslog.pid )

/usr/sbin/syslogd -D

Try su log here and
If you see the /var/adm/syslog/auth.log file , it contains all entries.

Re: syslog.conf file

Peter Gillis — Mon, 16 Sep 2024 09:11:57 GMT

thanks all.
changing the notice to info appears to have done the trick. Olivier, what did you mean about better permissions than syslo.log??

Regards,
Maria

Re: syslog.conf file

Muthukumar_5 — Thu, 09 Sep 2004 01:25:25 GMT

Don't worry about permission of auth.log file. It will be with 444 and root / root user group.

Don't create the file, the file will be automatically created at /var/adm/syslog/ location.

syslog.log will be 644 and but auth.log will be 444

Re: syslog.conf file

Peter Gillis — Thu, 09 Sep 2004 18:09:25 GMT

Thanks Muthukumar, so what permissions should the other log files be...444 root:root ? I didnt manually create the files, as I noticed that they automatically created when restarted syslogd pid.
Regards,
Maria

Re: syslog.conf file

Dave Olker — Thu, 09 Sep 2004 18:40:40 GMT

Hi Maria,

What other log files are you referring to? Can you do an ll of /var/adm/syslog and tell us which log files you're concerned about? Also include a copy of your /etc/syslog.conf file so that we can see which log files are automatically built by syslogd.

Thanks,

Dave

Re: syslog.conf file

Peter Gillis — Thu, 09 Sep 2004 19:05:43 GMT

HI Dave,

auth.log
lpd-errs
mail.log
mesgs.log
syslog.log
xferlog

are the other log files I have in there.
Thanks, Maria

Re: syslog.conf file

Sundar_7 — Thu, 09 Sep 2004 19:15:08 GMT

Maria,

Dont worry about the individual file permissions as long as the parent directory is protected.

ls -ld /var/adm/syslog

As long as the permissions of /var/adm/syslog is 750 (with root:adm as the ownership), you can even have 777 for syslog.log and other log files.

-- Sundar.