topic Re: syslog server configuration in Operating System - HP-UX

syslog server configuration

Azaru — Tue, 02 Feb 2010 10:36:45 GMT

Hi All,

Please help to configure syslog server in hpux.

Re: syslog server configuration

Horia Chirculescu — Tue, 02 Feb 2010 10:46:30 GMT

Hello,

The configuration is done through /etc/syslog.conf

Take a look at this file (there are some usefull comments)

and man syslog

Horia.

Re: syslog server configuration

Azaru — Tue, 02 Feb 2010 11:03:28 GMT

Hi,

This is my /etc/syslog.conf file in client side. Please take a look.

# @(#)B11.23_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
*.info;mail.none @bkpsvr

And added bkpsvr entry in /etc/hosts file

And restarted but no effect.

What else to be done?

Thanks for the reply

Re: syslog server configuration

Horia Chirculescu — Tue, 02 Feb 2010 11:15:52 GMT

In order to perform redirect, you must prepare syslogd to accept remote logging message on the system bkpsvr.

Also, if bkpsvr is behind a firewall, you must allow syslog traffic to pass through.

Horia.

Re: syslog server configuration

Michal Kapalka (mikap) — Tue, 02 Feb 2010 11:18:41 GMT

hi,

check the configuration on the SYSlog server side, if its reachable for the forwarded client.

mikap

Re: syslog server configuration

Horia Chirculescu — Tue, 02 Feb 2010 11:30:57 GMT

>And restarted but no effect.

You do not need to restart. After altering configuration file, you can perform a

kill -HUP `cat /var/run/syslog.pid`

to force re-load the configuration file.

Horia.

Re: syslog server configuration

Azaru — Tue, 02 Feb 2010 12:25:27 GMT

Hi all,

What needs to be done on bkpsvr to accept the logs from client?

There is no firewall between them.

I have done

kill -HUP `cat /var/run/syslog.pid`

But where the logs will get stored?

Re: syslog server configuration

Horia Chirculescu — Tue, 02 Feb 2010 12:31:01 GMT

>What needs to be done on bkpsvr to accept the logs from client?

It depends on what kind of SO you have there.

On HP-UX you need to do nothing, your syslogd accepts by default network connections.

From Linux, you must call syslogd with -r parameter.

man syslogd

on this server would help understanding the syntax.

Horia.

Re: syslog server configuration

Horia Chirculescu — Tue, 02 Feb 2010 12:36:21 GMT

>But where the logs will get stored?

Where you asked to syslogd to send those (you instructed syslogd on the file /etc/syslog.conf)

Horia.

Re: syslog server configuration

Johnson Punniyalingam — Tue, 02 Feb 2010 12:45:08 GMT

>>What needs to be done on bkpsvr to accept the logs from client?<<<

Do your >>Backup Server Running Any application to capture the "Syslog" from Clients ?? IF Not you try ftp syslog

Alternative Choice :-

scp -p /var/adm/syslog/syslog.log Bkupserver:/logs/hostname

Re: syslog server configuration

Johnson Punniyalingam — Tue, 02 Feb 2010 12:49:19 GMT

if you have any Software Installed on the backup server, You can edit "syslog.conf file from the your client side

Check below thread for more infromation

http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1265114848901+28353475&threadId=1219056

Re: syslog server configuration

Azaru — Wed, 03 Feb 2010 05:30:23 GMT

Where(path) can i find the logs of clients in bkpsvr server.

Re: syslog server configuration

Johnson Punniyalingam — Wed, 03 Feb 2010 05:41:19 GMT

>>Where(path) can i find the logs of clients in bkpsvr server<<<

Before Answering your Question.

Did you give any information, what do really need so that we can help you accordingly

Are you running Any application or Software ? to Capture the syslog in your Backup Server

Re: syslog server configuration

Horia Chirculescu — Wed, 03 Feb 2010 05:42:41 GMT

It depends on your OS that you have.

By default, on HP-UX, check:

/var/adm/syslog/

On Linux, check:

/var/log

But again, those directories and the associated files are set up on /etc/syslog.conf
Check that file on bkpsvr!

Best regards,
Horia.

Re: syslog server configuration

Azaru — Wed, 03 Feb 2010 05:43:14 GMT

But we have done os hardening on all the servers. Will the client send logs to server withour credential?

Re: syslog server configuration

Azaru — Wed, 03 Feb 2010 05:46:39 GMT

No we are not using any software,application to capture syslog.

Re: syslog server configuration

Johnson Punniyalingam — Wed, 03 Feb 2010 05:54:51 GMT

>>But we have done os hardening on all the servers. Will the client send logs to server withour credential?<<<<

Again this doesn't give enough information what you are looking for

>>No we are not using any software,application to capture syslog.<<

if you are not using any SW or Application, what method are you using to capture your syslog ??????

are you using ftp/sftp method to copy your "Client Syslog" to your "Backup Server" ??

if your server harden you may need use (sftp /scp) secured copy of your "Client Syslog" to your backup Server"

Re: syslog server configuration

Horia Chirculescu — Wed, 03 Feb 2010 06:41:22 GMT

>No we are not using any software,application to capture syslog.

>Will the client send logs to server withour credential?

Syslog does not use any encryption to send data to remote server.

If this troubles you, you can make another private LAN (insert another ethernet card in each server) between all your servers that will send syslog data to the bkpsvr server.

Alternatively, you could implement (on bkpsvr) a sollution based on scp as Johnson suggested.
You could run on bkpsvr from time to time a script (use crontab) that will use scp to copy the logs that you want, from whatever server you want.

Best regards,
Horia.

Re: syslog server configuration

Kanagaraj — Wed, 03 Feb 2010 09:39:06 GMT

Hi Azar,

In syslog server configure like this.

/etc/syslog.conf file

local2.debug

eg.

local2.debug /backuplogs/ems/srvr_syslog.log

at client machine.

Syslog server: SYSLOGSRVR

put entries in /etc/syslog.conf file

local2.debug @SYSLOGSRVR

I hope this will help you out to setup a syslog server.

also see this link.
http://www.linuxhomenetworking.com/cisco-hn/syslog-cisco.htm

Re: syslog server configuration

Kanagaraj — Wed, 03 Feb 2010 09:41:20 GMT

Don't forget to restart syslogd.

/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start