Configuring syslog.conf to put all login successes/failures in syslog.log

[Dan Pearce]

I've seen several threads here on itrc about adding lines to /etc/syslog.conf file which will gather all successful and failed logins and add them to syslog.log.

I have an HP-UX 11i v1 box that I'm trying to configure this for and several threads said to add:

auth.debug /var/adm/syslog/syslog.log
user.info /var/adm/syslog/syslog.log
auth.* /var/adm/syslog/syslog.log
user.debug /var/adm/syslog/syslog.log
*.debug /var/adm/syslog/syslog.log

(they are tabs, not spaces)

I have tried individually adding the suggested lines above to my existing syslog.conf (here is the current syslog.conf):

mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

and stopped/restarted syslogd and yet I still can't get any logins logged to syslog.

Does anyone have any suggestions?

Any assistance would be greatly appreciated.

Thank you,
Dan

[Michael Steele_2]

These are already kept in wtmp, etc. Read man page on last and lastb.

[Steven E. Protter]

Shalom,

inetd -l will give you some additional information. I like the last/lastb command output myself.

SEP

[Dan Pearce]

So, the login information cannot be placed in syslog.log? There is a push here to store the syslog.log with all of this information in it to a centralized log server - which I know can be done with syslog.conf but I still don't know how to dump the successful and failed logins to syslog.

Any ideas?

Thanks,
Dan

[Tim Nelson]

I believe telnet is the only issue.

Rid yourself of telnet and use ssh. Success and fails for ssh are logged in syslog.log.