configuring of syslog.conf

[Theophilus Nuworkpor]

I am running HPUX 11.23, i wish to configure my servers to send their syslog entries to a windows syslog server and a copy it to their local server's /var/adm/syslog/syslog.log entry.

[Steven E. Protter]

Shalom,

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=750918

That forum thread has the configuration you need.

As to whether it will work, you will need to see the specifications for the windows box. You need to know what port it expects the information on.

SEP

[Bill Hassell]

A single line in /etc/syslog.conf will do the job for HP-UX:

*.info;mail.none @windows-hostnameIP

Now, about your windows box. Windows ain't Unix so you'll have to find a syslog program for your windows box before this will work.

[Theophilus Nuworkpor]

I have a kiwi syslog server running on windows. I'm to configure all my hpux boxes to send my thier syslog messages to the kiwi syslog server. The entries in /etc.syslog.conf file shows:

mail.debug @102.25.10.10
*.info;mail.none @102.25.10.10
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

where 102.25.10.10 is the IP for the windows server on which the kiwi syslog server is running. This is the setting on all my hpux boxes but only one is sending its messages to the syslog server and no entry to /var/adm/syslog/syslog.log Please can some help?
Theo

[Fabio Ettore]

Hi Theo,
the way to send syslog entries to a remote server is the already mentioned by Steven and Bill, if it's already configured in such way and working for just a system then I'd check if there is a space or a TAB between fields in the file. It's important they are TAB, otherwise syslogd couldn't work as expected.

HTH.

Best regards,
Fabio

NOTE: I wouldn't give 0 points to Steven and Bill (two of the best contributors of ITRC forums), they have given the right and perfect procedure to achieve what you requested, if it doesn't work in your case then you should find the reason (I gave a my thought about the possible reason).
Of course everyone is free to assign points as desired but giving 0 points means (to me) that it's not appreciated at all the effort of people to give help. It's just a my personal note...

[Theophilus Nuworkpor]

Fabio,

Thanks for your concern and education. I want to say sorry to Steven and Bill. I'm new to the forum and really did know how the points assignment works. Once again thank you very much.

However, back to my problem. The space or are in the entries of the /etc/syslog.conf file. After stopping and starting syslogd, I wish to find out if I have do anything else.

NB: Steven and Bill am sorry. Thanks

[Fabio Ettore · Accepted solution]

Hi Theo,
so welcome to ITRC forums :)

About space or TAB I meant you must have TAB between fields, for example:

mail.debug@102.25.10.10
*.info;mail.none@102.25.10.10
[...]

and so on for all rows.

Be sure the file is so configured.

Enjoy using ITRC forums.

Best regards,
Fabio

[TTr]

Edit /etc/syslog.conf with vi and enable vi to show control characters.

# vi /etc/syslog.conf

In vi hit the escape key and type
: set list

Then you will see all the TAB characters as ^I. You must *delete all* spaces in this file and put TAB characters instead. Then save the file and restart the syslog daemon.

[Bill Hassell]

As mentioned, you must use tabs EVERYWHERE in the syslog.conf file. This is badly documented in the syslogd man page. The rule is:

ANY line with a space ANYWHERE on the line becomes a comment. To make sure your syslog.conf file is correct, use this command:

cat -tv /etc/syslog.conf

Every line that is used to configure syslog must have ^I between items and no spaces. In vi, you can turn on the visible display of special characters with this command:

:set list

Then turn it off with:

:set nolist

As far as I know, this is the only file in HP-UX with such bizarre requirements.

[Theophilus Nuworkpor]

Fabio,

I have got it working now. Thanks to you all.

Theo