topic Re: syslog.conf in Operating System - HP-UX

syslog.conf

Stéphane Gauthier — Tue, 09 Feb 2010 14:36:03 GMT

Hello,

Ou security guy wants to log all sessions (telnet, ftp, ssh) on our HP-UX server using a syslog server. I am trying to send the info using the HP-UX syslog but it does not seem to be working using *.auth. Any advice? Here is the syslog.conf config. Yes they are some TAB between the first and second column...just can't see here ;o)

# @(#)B.11.31_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none;local1.none /var/adm/syslog/syslog.log
*.info;mail.none;local1.none @10.1.0.100
*.alert /dev/console
*.alert root
*.emerg *
*.auth @10.1.0.100
#

Re: syslog.conf

Robert-Jan Goossens — Tue, 09 Feb 2010 15:15:54 GMT

Hi StÃ©phane,

I believe it should be auth.info, the syslog daemon is very picky.

try this.

auth.info @10.1.0.100
auth.info /var/adm/syslog/auth.log

Kill and start the syslogd.

Regards,
Robert-Jan

Re: syslog.conf

Stéphane Gauthier — Tue, 09 Feb 2010 17:39:18 GMT

Tks. I have try and auth.info does it only with ftp connexion and do not catch the telnet or ssh one.

Re: syslog.conf

WayneHP — Wed, 10 Feb 2010 02:17:27 GMT

This should be useful.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=267234

Re: syslog.conf

Don Mallory — Mon, 01 Mar 2010 16:33:47 GMT

You don't have to kill and restart the syslog daemon, just do a ps -ef | grep syslog, find the PID and run "kill -HUP 1234" where 1234 is the PID of syslogd.

Syslog only requires you to tell it to "hang up" and re-read the config. Otherwise, you will miss any messages that occur during the restart.