topic Re: Remote syslog from HP-UX to Linux Server in Operating System - HP-UX

Remote syslog from HP-UX to Linux Server

MattJ123 — Wed, 20 Oct 2004 14:14:32 GMT

I'm attempting to setup remote syslog for certain log files originating on an HP-UX 11 server and the remote site is a Redhat Linux server.

On the linux server, I have enabled the -r flag:
SYSLOGD_OPTIONS="-m 0 -r"
and netstat -ln:
udp 0 0 0.0.0.0:514 0.0.0.0:*
confirms that the Redhat server is in fact, listening for syslog.

On the HP-UX side:
/etc/syslog.conf
mail.* @xxx.xxx.xxx.xxx
and the /sbin/init.d/syslog stop/start has been done.

The linux server isn't receiving remote syslog, Why?

Re: Remote syslog from HP-UX to Linux Server

Steven E. Protter — Wed, 20 Oct 2004 14:19:50 GMT

It appears that you are trying to send this log to an nfs export share on the Linux System.

Make sure all options, including squash are set correctly on the Linux NFS export. If not, root won't get appropriate permissions to write the file. Its possible to block NFS access by hostname or ip address, so I suggest a careful look at the /etc/exports file.

If there are problems exportfs -av to re-export the filesystems.

Most Linux boxes have a default iptables or ipchains firewall that blocks port 514 and other NFS ports.

check the /etc/sysconfig/iptables or ipchains file and see that apprioriate ports are open.

Failed write attempts should show up in the /var/log/message file on the Linux box, unless the firewall is blocking.

service iptables stop

resetart syslog on the HP box to test if the firewall is causing trouble.

SEP

Re: Remote syslog from HP-UX to Linux Server

MattJ123 — Wed, 20 Oct 2004 14:22:59 GMT

NFS is not running on either site. I believe that syslogd can receive messages through udp, much as it does locally.

http://www.cse.msu.edu/~westrant/symlink/pages/HoneynetDocs/remote-syslog.htm as the site that gave me the idea.

Re: Remote syslog from HP-UX to Linux Server

Sanjay_6 — Wed, 20 Oct 2004 14:24:06 GMT

Hi,

On your linux server check the location of mail.* in the /etc/syslog.conf. Is it logging the mail log to syslog or some mail log file.

Hope this helps.

regds

Re: Remote syslog from HP-UX to Linux Server

MattJ123 — Wed, 20 Oct 2004 14:29:00 GMT

I've tried doing a *.* @xxx.xxx.xxx.xxx and am still not receiving anything on the linux site. I then attempted a
mailx -s "test" email@domain.com <This is a test message
EOF

and in the HP server it appears in the mail.log, nothing on the linux server

Re: Remote syslog from HP-UX to Linux Server

Sundar_7 — Wed, 20 Oct 2004 14:49:42 GMT

Matthew,

Couple of things

1) /etc/syslog.conf is little sensitive about the spacing.

mail.* @xxx.xxx.xxx.xxx

2) You need to send a HUP signal to the syslogd in the HP-UX server.

# kill -1 `cat /var/run/syslogd.pid`

Test the communication using the logger command

logger -t mail.notice "Test from HP-UX"

- Sundar.

Re: Remote syslog from HP-UX to Linux Server

MattJ123 — Wed, 20 Oct 2004 14:56:36 GMT

Currently, the line in the /etc/syslog.conf on HP-UX looks like:
*.* @

the whitespace is 1 tab exactly

I ran the logger command you mentioned:
in /var/log on the linux site:
grep -lR "HP-UX" *

found nothing

Re: Remote syslog from HP-UX to Linux Server

Sundar_7 — Wed, 20 Oct 2004 15:05:07 GMT

/etc/syslog.conf
*.* @

I dont see the Linux server name in there.

*.* @linux-server

did you send the HUP signal to syslogd in HP-UX ?

I would not recommend *.* to a different server, because the syslogd at the receiving end has no means of idenifying syslog messages from HP-UX, so the messages from both LINUX and HP-UX will mingle in the same log files, which I dont think you would prefer.

Re: Remote syslog from HP-UX to Linux Server

MattJ123 — Wed, 20 Oct 2004 15:07:08 GMT

my apologies, my response was imcomplete.
*.* @ip.address

for testing purposes I want to do *.* until I see something, then I will tweak from that point.

kill -1 has been run again the syslogd

Re: Remote syslog from HP-UX to Linux Server

Zinky — Wed, 20 Oct 2004 15:17:38 GMT

On your Linux SYSLOG Server's syslog.conf, have this:

# Output to console
*.err;mail,kern.notice;daemon,auth.debug;user.info /dev/console

# Output to local file "messages" for local analysis
*.err;auth,daemon,mark,kern.debug;auth,mail,user.notice /var/adm/messages

On your SYSLOG "Clients", have this in addition to your customisations:

# Forward to loghost MEDUSA on Lunar Sector 123
auth.info;mark.debug;*.debug @medusa.sec23.moon.com

HUP your syslogd processes and you should be all set for centralised logging.

And adjust accordingly..

HTH..

Re: Remote syslog from HP-UX to Linux Server

MattJ123 — Wed, 20 Oct 2004 15:29:27 GMT

># Output to console
>*.err;mail,kern.notice;daemon,auth.debug;user.info /dev/console
># Output to local file "messages" for local analysis
>*.err;auth,daemon,mark,kern.debug;auth,mail,user.notice /var/adm/messages
did both entries to the config and restarted daemon

as stated earlier i have *.* @xxx.xxx.xx.xxx
and its been hupped.

would you believe I'm still not getting log entries on the linux site?

i even tried *.* @xxx.xxx.xx.xxx:514

Re: Remote syslog from HP-UX to Linux Server

Zinky — Wed, 20 Oct 2004 15:33:24 GMT

That is strange.

Have you inquired from some Linux sites as well?

Re: Remote syslog from HP-UX to Linux Server

MattJ123 — Wed, 20 Oct 2004 15:39:15 GMT

yes, i have tried from linux hosts as well with no luck.

same options in the remote sites syslog.conf:
*.* @xxx.xxx.xxx.xxx

/etc/init.d/syslog restart

on the syslog server
ls /var/adm/log
messages 0 bytes

the file was created, but nothing is being written to it.

Re: Remote syslog from HP-UX to Linux Server

Zinky — Wed, 20 Oct 2004 15:40:46 GMT

Matthew,

The problem I think is with the client, I just did on my HP-UX boxen (syslog server is another HP-UX boxen). There should be a TAB separator between the notifications and the @SYSLOGHOST:

# Forward to loghost MEDUSA on Lunar Sector 123
auth.info;mark.debug;*.debug @medusa.sec23.moon.com

I could not earlier make it to work if the spearator were spaces...

HTH.

Re: Remote syslog from HP-UX to Linux Server

Ermin Borovac — Wed, 20 Oct 2004 20:47:42 GMT

I think your problem lies in the fact that on HP-UX you can't use asterisk for selecting all levels (i.e. facility.level). You can use asterisk to select all facilities though.

mail.* /* DOESN'T WORK */
*.debug /* SHOULD WORK */

You can run syslogd on HP-UX with debugging enabled (-d) and it should print error messages about lines in syslog.conf that it rejected.

Specifying particular level (e.g. debug) will select that level and all higher severity levels, so if you specify mail.debug in syslog.conf it will effectively select all levels (debug, info, notice, warning, err, crit, alert, emerg).

Re: Remote syslog from HP-UX to Linux Server

MattJ123 — Thu, 21 Oct 2004 08:31:27 GMT

On Linux site:
/etc/sysconfig/syslog{
SYSLOGD_OPTIONS="-m 0 -r"
}
/etc/syslog.conf{
*.* /var/adm/messages
}

kill -1 PID for syslog

On HP-UX Site:
/etc/syslog.conf{
*.debug @xxx.xxx.xxx.xxx
}

kill -1 PID for syslog
logger -t mail.notice "Test from HP-UX"

Checked the Linux site, and the logs are appearing now. Thanks for the help everybody!