topic Re: syslog issues... in Operating System - HP-UX

syslog issues...

Kenneth Platz — Mon, 15 Jun 2009 14:20:27 GMT

Hello everyone,

In attempting to diagnose some perceived issues with one of my HP-UX 11.11 servers, I tried looking into my syslog... only to find it was completely empty except for entries logged by sudo. So to hunt this down, I checked out the syslog.conf file:

# @(#)B.11.11_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none;auth.debug @138.126.163.247
*.alert /dev/console
*.alert root
*.emerg *

Hmm... okay, well, we were instructed to send syslogs to a syslog server that we don't control in addition the local syslog... but we stlil need the local syslog. So I added back in the line:

*.info;mail.none;auth.debug /var/adm/syslog/syslog.log

back to the /etc/syslog.conf -- right before the remote syslog server entry, stopped & restarted the syslogd... only to find that it's STILL not logging anything to syslog!

As far as patches, we have the following syslog-related patches on the system:

[/var/adm/syslog] root@arrey #swlist -l product | grep -i syslog
PHCO_36095 1.0 syslogd(1M) cumulative patch
PHKL_26705 1.0 syslog/console handling,printf panic fix
PHKL_30105 1.0 remove mem module and LPMC syslog msgs

Can anyone offer some suggestions as to how to un-messup the syslog?

Re: syslog issues...

Dennis Handly — Mon, 15 Jun 2009 14:36:04 GMT

Make sure you have tabs and not spaces.

Re: syslog issues...

Roberto Arias — Mon, 15 Jun 2009 14:44:30 GMT

hi
first try logger -p info "test" and look for 'test' in syslog.log
my syslog.conf is ( i have syslog and syslog-ng):
auth.info /var/adm/syslog/auth.log
mail.info /var/adm/syslog/mail.log
*.info;mail.none;auth.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
# DSAU clog mail forwarding.
mail.debug @server-repository
# DSAU clog syslog forwarding.
*.info;mail.none @server-repository

Re: syslog issues...

Kenneth Platz — Mon, 15 Jun 2009 15:03:04 GMT

That fixed it... changed the spaces to tabs and stopped/restarted. Thanks for the help!