topic Re: syslog.conf confusion in Operating System - HP-UX

syslog.conf confusion

kapra — Mon, 12 Dec 2005 11:14:36 GMT

Dear all,

I am trying to fine tune my syslog.conf file as below

security.info /var/adm/syslog/security.log
auth.info /var/adm/syslog/auth.log
kern.info /var/adm/syslog/kernelinfo.log
kern.debug /var/adm/syslog/kerneldebug.log
*.info /var/adm/syslog/allinfo.log

I am running into few problems when i try to use this configuration file. After restarting the syslogd daemon, i tried to test the functionality using logger command and found the results to be surprising.

(1) Messages from Security and Auth facilities at all levels are getting logged inside both files namely security.log & auth.log and ofcourse inside allinfo.log
(i used logger -p security.info "message" likewise for auth.info, security.notice, auth.notice....... etc), i was expecting security messages ONLY to go inside security.log and same for auth message !!

(2) if i do logger -p kern.info "kernel message", this is getting logged only inside allinfo.log and NOT inside kernelinfo.log

(All these files do exist on their locations and have write permissions for all, also there are TABS (no spaces) inside syslog.conf file).

Please help me on this.

Thank you very much in advance.

Re: syslog.conf confusion

Geoff Wild — Mon, 12 Dec 2005 12:58:03 GMT

Try:

security.info; auth.none var/adm/syslog/security.log
auth.inf; security.none /var/adm/syslog/auth.log

Rgds...Geoff

Re: syslog.conf confusion

kapra — Tue, 13 Dec 2005 05:19:42 GMT

Thanks Geoff for your reply.

I tried making suggested changes to the syslog.conf file and restarted the syslogd daemon but after the changes it logs nothing !

Nothing for security and nothing for auth.

Both files are empty after raising alerts via logger command !

Re: syslog.conf confusion

Muthukumar_5 — Tue, 13 Dec 2005 05:54:28 GMT

Try as,

security.info;auth,kern.none /var/adm/syslog/security.log
auth.info;security,kern.none /var/adm/syslog/auth.log
kern.info;security,auth.none /var/adm/syslog/kernelinfo.log
kern.debug /var/adm/syslog/kerneldebug.log
*.info;kern.none;security.none;auth.none /var/adm/syslog/allinfo.log

Revert your results. If it is not working then specify which scenario it is not doing?

-Muthu

Re: syslog.conf confusion

kapra — Tue, 13 Dec 2005 06:58:28 GMT

Thanks Muthu for your reply..

Have made the suggested changes results are as below

1. logger -p security.info "Security Info"
Nothing logged inside security.log, nothing inside auth.log & nothing inside allininfo.log

2. logger -p auth.info "Auth Info"
Same as case 1, nothing got logged anywhere

3. logger -p kern.info "Kernel Info"
This one got logged inside allinfo.log, nothing inside kernelinfo.log, nothing inside kerneldebug.log

4. logger -p kern.debug "kernel Debug"
Nothing got logged anywhere

Any further suggestions?