topic Re: Configure SLES9 as a central log host in Operating System - Linux

Configure SLES9 as a central log host

Ryan Goh — Wed, 22 Dec 2004 05:04:50 GMT

Hi all,

My company just bought one hp server installed with SLES 9. My boss ask me to configure this server based on requirement stated below:

1. Configure the syslog daemon to accept messages from other machines.
2. Configure the syslog daemon to write all messages concerning mail to /var/log/allmail. Mail messages must not be written anywhere else. Disable immediate file syncing after writing messages.
3. Configure the syslog daemon to write all kernel messages to /var/log/kernel. Kernel messages with priority equal or higher than "warning" have also to be written to console 10.
4. Configure the syslog daemon to write all messages other than mail and kernel messages to /var/log/allmessages.

I have difficuty on how to configure syslog.conf based on the requirement stated above, need your expertise to help me on the configuration of syslog.conf.

Thank you.
Ryan Goh

Re: Configure SLES9 as a central log host

Ivajlo Yanakiev — Wed, 22 Dec 2004 07:12:52 GMT

use -r option for syslogd.
It will tell your syslogd to get all messege from network.
Also you need to change syslog.conf on all server that need to send syslog to main server.

by the way :)
Did you try to read man syslog , syslogd , syslog.conf

Re: Configure SLES9 as a central log host

Vitaly Karasik_1 — Wed, 22 Dec 2004 09:57:27 GMT

you can use the following resources for syslog/logrotate:

http://www.linuxjournal.com/article.php?sid=5476 syslog Configuration

http://www.precision-guesswork.com/sage-guide/syslog-overview.html syslog Overview

http://www.linux-mag.com/cgi-bin/printer.pl?issue=2000-09&article=guru Keeping Track of What Goes On

http://www.chinalinuxpub.com/doc/www.siliconvalleyccie.com/linux-hn/logging.htm
Troubleshooting Linux With Syslog [you can read here about logrotate too!]

Re: Configure SLES9 as a central log host

Ryan Goh — Wed, 22 Dec 2004 23:59:26 GMT

Hi,

I try "syslogd -r", get error message "syslogd: Already running". So, I type "/etc/init.d/syslog stop" follow by "syslogd -r". Is it correct.

Do I need to configure syslog.conf on central log host server with the requirement I stated, or only on other servers which send messages to the central log host server.

Regards,
Ryan Goh

Re: Configure SLES9 as a central log host

Ermin Borovac — Thu, 23 Dec 2004 00:54:39 GMT

On the central syslog server add "-r" to SYSLOGD_PARAMS in /etc/sysconfig/syslog and restart syslog service

SYSLOGD_PARAMS="-r"

# /etc/init.d/syslog restart

On other machines add the following line to /etc/syslog.conf and restart syslog service.

*.debug @

You may want different logging level as *.debug will forward all syslog messages to central syslog server.

Re: Configure SLES9 as a central log host

Ivajlo Yanakiev — Thu, 23 Dec 2004 03:04:01 GMT

my be it better to send *.* that mean
all msg.all services

Re: Configure SLES9 as a central log host

Ryan Goh — Thu, 23 Dec 2004 05:43:20 GMT

Hi All,

Anyone know how to configure the syslog daemon to write all kernel messages to /var/log/kernel. Kernel messages with priority equal or higher than "warning" have also to be written to console 10, how to write it in syslog.conf. If I want to send it console 10, is it correct wrote it as "/dev/console10 .

What is the diffrent between syslog.conf and syslog file?

Thank for the reply.

Ryan Goh

Re: Configure SLES9 as a central log host

Ivajlo Yanakiev — Thu, 23 Dec 2004 07:20:47 GMT

syslog.conf is config file :)
You place your option for syslogd daemon

syslog file = /var/log/message this is text file that get all system messeges :)

You realy need some general reading for linux.

You can not use linux wihtout know basic :)
Sorry man.
If you want I can invite you to my Linux classes :)

Re: Configure SLES9 as a central log host

Ryan Goh — Thu, 23 Dec 2004 09:13:01 GMT

Thank very much for the help. I know I still need a lot of guidance, that why I post it to the forum.

What I mean is /etc/sysconfig/syslog file and /etc/syslog.conf file. I know syslog.conf, but not very sure about /etc/sysconfig/syslog file. What is the purpose of /etc/sysconfig/syslog file?

Regards,
Ryan Goh

Re: Configure SLES9 as a central log host

Vitaly Karasik_1 — Thu, 23 Dec 2004 09:16:27 GMT

/etc/sysconfig/syslog file - in many distros
contains command-line options for syslog daemon

/etc/syslog.conf - syslogd configuration

I suggest you to read one of articles I sent you.

Good luck!
Vitaly

Re: Configure SLES9 as a central log host

Ivajlo Yanakiev — Thu, 23 Dec 2004 09:37:43 GMT

You ask for decision !

Did you read man page ?
Did you read some book or google about that.
Did you try to done this by your self ?
Did you ask frineds or support to help you ?

No :0

Take care
and
Merry Christmas

Re: Configure SLES9 as a central log host

Ryan Goh — Wed, 29 Dec 2004 02:39:02 GMT

I have configure my server, it seem work follow requirement. The settings I set as below. Correct me if I done wrongly.

1. Configure the syslog daemon to accept messages from other machines.

- Add -r option to SYSLOGD_PARAMS in syslog file.

2. Configure the syslog daemon to write all messages concerning mail to /var/log/allmail. Mail messages must not be written anywhere else. Disable immediate file syncing after writing messages.

- add "mail.* -/var/log/allmail" in syslog.conf

3. Configure the syslog daemon to write all kernel messages to /var/log/kernel. Kernel messages with priority equal or higher than "warning" have also to be written to console 10.

- add "kern.* /var/log/kernel" and "kern.warning /dev/tty10" in syslog.conf

4. Configure the syslog daemon to write all messages other than mail and kernel messages to /var/log/allmessages.

- add "*.*;mail.none;kern.none /var/log/allmessages" in syslog.conf

Full content of these two files.

syslog file content :

## Path: System/Logging
## Description: System logging
## Type: list(0,1,2,3,4,5,6,7)
## Default: 1
## Config: ""
## ServiceRestart: syslog
#
# Default loglevel for klogd
#
KERNEL_LOGLEVEL=1

## Type: string
## Default: ""
## Config: ""
## ServiceRestart: syslog
#
# if not empty: parameters for syslogd
# for example SYSLOGD_PARAMS="-r -s my.dom.ain"
#
SYSLOGD_PARAMS="-r"

## Type: string
## Default: -2
## Config: ""
## ServiceRestart: syslog
#
# if not empty: parameters for klogd
# for example KLOGD_PARAMS="-2" for clean oops lines
#
KLOGD_PARAMS="-2"

## Type: list(syslogd,syslog-ng)
## Default: syslogd
## Config: syslog-ng
## Command: /sbin/rcsyslog restart
## PreSaveCommand: /sbin/rcsyslog status && /sbin/rcsyslog stop
#
# The name of the syslog daemon used as
# syslog service: "syslogd", "syslog-ng"
#
SYSLOG_DAEMON="syslogd"

## Type: string
## Default: "/var/lib/ntp/dev/log"
## ServiceRestart: syslog
## Config: syslog-ng
#
# The filename mentioned here will be added with the "-a ..." option as
# additional socket via SYSLOGD_PARAMS when syslogd is started.
#
# This additional socket is needed in case that syslogd is restarted. Otherwise
# a chrooted 'ntpd' won't be able to continue logging.
#
SYSLOGD_ADDITIONAL_SOCKET_NTP="/var/lib/ntp/dev/log"

syslog.conf file content :

# /etc/syslog.conf - Configuration file for syslogd(8)
#
# For info about the format of this file, see "man syslog.conf".
#
mail.* -/var/log/allmail

kern.* /var/log/kernel
kern.warning /dev/tty10

*.*;mail.none;kern.none /var/log/allmessages

Thank again for the web links and solution you reply. It help a lot.

Regards,
Ryan Goh

Re: Configure SLES9 as a central log host

Ryan Goh — Fri, 31 Dec 2004 06:49:51 GMT

Thank all.

Re: Configure SLES9 as a central log host

Ryan Goh — Sat, 05 Aug 2006 01:34:49 GMT

tahnks