topic Making log server in Operating System - Linux

Making log server

mw_9 — Wed, 18 Jun 2003 02:51:37 GMT

Hi all
Can I make log server which all client messages are logged separately

One condition is given

1.
Messeges from all clients must be logged by client's name each at log server

any tips are helpful

Re: Making log server

Stuart Browne — Wed, 18 Jun 2003 03:12:07 GMT

When yous ay 'log', I take it you mean that you want 'syslog' to send the events to be logged to a given server?

So you've got your client PC's logging events like:

kern.* @othermachine

(as detailed in 'man syslog.conf').

You'll also have to make 'syslogd' listen for incoming requests. According to 'man syslogd', the flag you need is '-r'.

Depending on what distribution you are using depends on how to best eanble this feature however.

The simplest way is to modify the startup routine in /etc/rc.d/*/*syslogd (adding the -r flag to the startup routines), however if you are using a RedHat system, you can just modify the line "SYSLOGD_OPTIONS" in "/etc/sysconfig/syslog".

Have fun.

Re: Making log server

U.SivaKumar_2 — Wed, 18 Jun 2003 04:18:35 GMT

Hi,

I found syslog-ng is the right candidate for this purporse when I was experimenting on distributed IDS architectures and centralized logging system.

syslog-ng is capable of filtering the incoming syslog data from the syslog clients and decide the destination file depending on the client hostname.

I have some example on it's filtering configuration on syslog-ng central log server,

filter f_client1{ host("client1"); };
filter f_client2 { host("client2"); };

destination client1 { file /var/log/client1; };
destination client2 { file /var/log/client2; };

now the syslog messages from client1 will logged to /var/log/client1 and client2 will be logged to /var/log/client2

regards,

U.SivaKumar

Re: Making log server

mw_9 — Wed, 18 Jun 2003 08:24:55 GMT

Does 'syslog-ng' you said some kind of utilities linux has?

can you give more details about?

Re: Making log server

U.SivaKumar_2 — Wed, 18 Jun 2003 10:31:09 GMT

Please check these links for more information.

http://www.balabit.com/products/syslog_ng/reference/book1.html

http://www.campin.net/syslog-ng/faq.html

you can download the free software GPL licensed here

http://www.balabit.com/downloads/syslog-ng/

regards,

U.SivaKumar

Re: Making log server

mw_9 — Thu, 19 Jun 2003 07:30:58 GMT

Dose syslog-ng have to be installed each clients that I wanted to log ?

Re: Making log server

U.SivaKumar_2 — Thu, 19 Jun 2003 09:30:31 GMT

Re: Making log server

U.SivaKumar_2 — Thu, 19 Jun 2003 09:31:44 GMT

Not neccesary.

Only the central log server which you choose should have syslog-ng installed. Disable normal syslogd in this server.

#ntsysv

syslog-ng should be listening for incoming syslog messages.

On all other client edit /etc/syslogd.conf and put this single line if you want to log everything to the central log server.

*.* @log.mydomain.com

regards,

U.SivaKumar

Re: Making log server

Paddy_1 — Thu, 19 Jun 2003 20:24:35 GMT

watch out for this product if security is a requirement.

http://coombs.anu.edu.au/~avalon/nsyslog.html

Re: Making log server

mw_9 — Fri, 20 Jun 2003 01:10:10 GMT

what did I wrong?
see that attached file

Re: Making log server

mw_9 — Fri, 20 Jun 2003 07:03:46 GMT

I can't generate client's named file.
what's wrong?
Messeges from all clients are logging default messages file.

what's wrong?

Re: Making log server

mw_9 — Sat, 21 Jun 2003 02:09:11 GMT

thank you all your replies..
Thanks..

Re: Making log server

U.SivaKumar_2 — Sat, 21 Jun 2003 02:47:24 GMT

hi ,

is your problem solved ?.

regards,

U.SivaKumar