configure syslog

[Yong Siew Lee]

Hi,

Is there a way to configure syslog.conf such that all messages, regardless of whether it is debug, alert or others, will all be log to /var/adm/syslog/syslog.log?

I have tried the following:

*.debug;mail.none /var/adm/syslog/syslog.conf

It is supposed to log all messages except mail messages, right? However, it does not seems to log all messages. I did a test by logging in to the system using the wrong password,it is not log.

Any help is appreciated. Thank you.

[federico_3]

You should insert in /etc/syslog.conf the following line :

*.debug;mail.none /var/adm/syslog/syslog.log

Federico

[federico_3]

sorry, i forgot...
after changes to syslog.conf , reinitialize syslogd daemon:
/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

federico

[Yong Siew Lee]

Hi,

Sorry, I have typed wrongly in my first message. I did try

*.debug;mail.none /var/adm/syslog/syslog.log

but it doesn't work.

[federico_3]

In my syslog.conf there is the following

*.info;mail.none /var/adm/syslog/syslog.conf

But i think that to see the bad login you should use lastb command

[Philip Chan_1]

Have you restarted syslogd after making the change?

[Bruce Regittko_1]

Hi,

You must either stop and restart syslogd or send it a hangup signal. The hangup signal will cause syslogd to reread /etc/syslog.conf. From the man page for syslogd(1m):

To make syslogd, re-read its configuration file, send it a HANGUP signal:

kill -HUP `cat /var/run/syslog.pid`

--Bruce