Script to dump at syslog server

[coollllllllllll]

Hi ,

Say we have a windows server where we would like to dump syslog line by line as it gets logged in our hpux server ,is there any script for the same ???

[Dennis Handly]

Dump it where?

I suppose you could use "tail -f" on the file.

[coollllllllllll]

Hi ,

We have a windows server of 200gb space on g: drive

we would like to dump syslog.log from one hpux server to this windows server g:drive , but it must be spontaneus.

As soon as entry in syslog.log comes it must ftp the same on this windows server.

[Dennis Handly]

>As soon as entry in syslog.log comes it must ftp the same on this windows server.

It appears you are trying to reinvent a syslog server?

Try google to look for: syslog server windows

[coollllllllllll]

Hi ,

I just want to dump entries coming in my hpux box to say to windows server mayb everyday at end of day.

[Torsten.]

I don't see a real purpose here, but consider this: map a windows share to the server, logrotate the file and move/copy it to the share per cron in the evening.

[coollllllllllll]

Hi ,

Its an audit requirement.

[Matti_Kurkela]

If the audit requirement is that the log messages are sent to the windows server as soon as they are generated, then copying the log files at the end of a day won't satisfy the spirit of the requirement.

The HP-UX syslog daemon can already send the log messages to other host(s): you just need to configure it, to tell it what messages it should send and where to. You don't need a separate script for that.

On the Windows side, you need to set up a syslog server (a very small and simple program) to catch the incoming syslog messages.

Here's one free alternative (the first hit from Google on "windows syslog server"):

http://sourceforge.net/projects/syslog-server/

Once the Windows syslog server is running, you can edit HP-UX /etc/syslog.conf to choose the log messages to send.

For example, to send all the log messages to the host at IP address 1.2.3.4, you would add this line to /etc/syslog.conf:

*.*             @1.2.3.4

 Note: there should be TAB characters between the message selector "*.*" and the destination specification "@1.2.3.4", not spaces. If you use spaces, the syslog daemon will ignore the line and the messages won't be sent.

Once you've modified /etc/syslog.conf, send a HUP signal to the syslog daemon to make the change effective:

kill -HUP `cat /var/run/syslog.pid`

You can use the HP-UX command "logger" to send your own syslog messages. That might be useful when testing the syslog message forwarding, for example.

Please see "man syslogd" and "man logger" for details.

[coollllllllllll]

Hi Matti ,

How do we add host entry in syslog configuration of windows.

i downloaded setup and souble clicked it, i cans ee service is running in windows.

have also made entries in my hp box , restarted syslog daemon , how do i incorporate hpux ost with  this server.

[Matti_Kurkela]

You don't have to "add a host entry in Windows": as soon as the syslog server receives a message from a given host, a host entry should appear automatically.

The syslog messages are transmitted using UDP port 514: if the Windows system is protected by a firewall, you should make sure incoming traffic to port 514/UDP is accepted.

In the Settings menu of the Syslog server, there is a "Logging threshold" setting: it can be used to ignore low-priority syslog messages. When testing the Windows syslog server, make sure it is set to "debug" so that no messages are ignored.

In the HP-UX /etc/syslog.conf file, make sure you used TAB characters instead of spaces when writing the new entry. A common mistake is to use spaces (or to use an editor which silently changes the TABs to spaces for you).