topic Re: Question regarding syslog.conf in Operating System - HP-UX

Question regarding syslog.conf

wvsa — Fri, 30 Jul 2010 16:09:52 GMT

Good morning all;

A quick question, would like to know if it is possible to configure syslog in such a way the following entries get written into a separate file. Here is the entry:

romans02 inetd[8563]: registrar/tcp: Connection from romans02 (172.17.4.10) at Fri Jul 30 10:03:19 2010

Here is a copy of our syslog.conf file
# cat syslog.conf
# @(#)B.11.31_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none;auth.none /var/adm/syslog/syslog.log
auth.info /var/adm/syslog/auth.log
*.alert /dev/console
*.alert root
*.emerg *

Thank you for your comments

Norm

Re: Question regarding syslog.conf

Deeos — Fri, 30 Jul 2010 16:46:49 GMT

Hi,

Your question is confusing me?
Could you focus on your query in details?

here, I have put entries of /etc/syslog.conf file!

# @(#)B11.23_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

Regards
Deeos

Re: Question regarding syslog.conf

Ishwar_1 — Fri, 30 Jul 2010 16:54:07 GMT

Yes, Change the path were you want the logs and restart the syslogd deamon.

This will log all new entries to the change path

Thanks
Ishwar VenuGopal

Re: Question regarding syslog.conf

wvsa — Fri, 30 Jul 2010 17:38:32 GMT

Hello;

Let me attempt to re-phrase my question:

Currently we have in our syslog file the following entry occuring over and over and over again:

romans02 inetd[8563]: registrar/tcp: Connection from romans02 (172.17.4.10) at Fri Jul 30 10:03:19 2010

Would like to have this entry not go into our syslog file instead would like to have this entry and all other inetd loggin entries be written to a separate file. With the help of Bill Hassell we are writing auth info to auth.log in syslog directory. WOuld like to do the same thing for the inetd entry. Does this help?

Thank you

Norm

Re: Question regarding syslog.conf

Bill Hassell — Sun, 01 Aug 2010 01:22:08 GMT

> WOuld like to do the same thing for the inetd entry.

inetd? What log entries do you have for inetd? By default, inetd does not log connections. Did you modify netdaemons to add INETD_ARGS?

Re: Question regarding syslog.conf

Bill Hassell — Sun, 01 Aug 2010 01:33:11 GMT

By the way, inetd (when it logs anything) will use the facility daemon so you could modify syslog.conf to create a separate daemon.log file. Here is an example that has several facilities logged into different directories:

*.info;mail.none;local0.none;local1.none;local2.none;local3.none;local4.none;local5.none;auth.none;user.none;lpr.none;daemon.none;kern.notice; /var/adm/syslog/syslog.log

mail.debug /var/adm/syslog/mail.log
local0.info;local1.info;local2.info;local3.info;local4.info /var/adm/syslog/local01234.log
local5.info /var/adm/syslog/ftpd.log
auth.info /var/adm/syslog/auth.log
daemon.info /var/adm/syslog/daemon.log
kern.info /var/adm/syslog/kern.log
lpr.info /var/adm/syslog/lpr.log

In the above example, inetd will log to daemon.log.

Re: Question regarding syslog.conf

wvsa — Mon, 02 Aug 2010 21:55:38 GMT

Bill;

Thanks again for your input, very helpful. Yes indeed did modify netdaemons file and turned on logging - audit requirements

Norm