Configuring a system to send a copy of its syslog.log file to a remote syslog server

[Andrew Kaplan]

Hi there --

I am in the process of setting up a syslog server, and I would like one of our HP-UX systems, 10.20, to send a copy of its syslog.log file to the remote syslog server.

My plan is to modify the /etc/syslog.conf file with the following entry:

syslog.log @

Is this the correct format to use, or is there another method? Thanks.

[Jeeshan]

Hi

If you configure syslog server which will collect syslog messages from remote machine.

You can set your machine's /etc/syslog.conf file and add an entry like

*.warn;*.err@

[Steven E. Protter]

Shalom,

Make sure that port 514 is open on the firewall and you can send syslog to a remote server.

You can go network and local at the same time.

SEP

[Tim Nelson]

I concur with the above replies.

More info can always be found in the man pages for syslogd.

[Bill Hassell]

> syslog.log @

This will not work. The syslog.conf file has a very specific format. The correct format can be created by duplicating the syslog.log line in the file. Then change the destination on the right to the server's IP address or hostname, like this:

Original line:
*.info;mail.none /var/adm/syslog/syslog.log

Add this line:
*.info;mail.none @12.34.56.78

NOTE: syslog.conf has very strange requirement: *NO* spaces allowed. Insteada, separate the left side parameters from the right side with one or more tabs. If a space is used, the line is silently ignored.

[Yogeeraj_1]

hi Andrew,

see also:
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=723890

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1211962


hope this helps too!
kind regards
yogeeraj

[Aashique]

Hi,
Here is the syslog.conf info:

mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
*.alert @10.10.96.194
*.emerg @10.10.96.194
mail.debug @10.10.96.194
*.info;mail.none @10.10.96.194

Here @10.10.96.194 is the remote syslog server IP.

Thanks

Aashique

[Bill Hassell]

The example:

> *.alert @10.10.96.194
> *.emerg @10.10.96.194
> mail.debug @10.10.96.194
> *.info;mail.none @10.10.96.194

This has the potential to generate several duplicate messages. syslod processes each line separately so any alert,emerg,crit messages go out with the first line, then the next line sends out emerg,crit messages. The 3rd line will really clobber the syslog server with mail messages as the debug is very verbose and seldom needed at a central server. And the last will send out everything from info to crit.

Unless you want the thousands of email debug lines, the above 4 lines can be replaced with:

*.info;mail.none @10.10.96.194

man syslogd