How to redirect "telnet log" to a separate file

[lin.chen]

Dear all,
Could you help me to redirect logs about telnet to a separate file.
I have checked /etc/syslog.conf.But I found few information about "facility".
as you know we can redirect "ftp log" to a different file by "local5.info /var/adm/ftp.log "
How can I do for telnet log?
Thanks a lot and wish you all a good new year.
Louis

[Bill Hassell · Accepted solution]

The best way to start researching this option is to look at the telnetd man page. All telnet connections are handled by the daemon telnetd and the man page has no reference to any log file at all -- thus, no unique telnet logging is available. So in order to log telnet connections, you have to turn on inetd logging. inetd is the parent of many network daemons including telnetd. You toggle inetd logging on or off with the inetd -l command. If inetd has logging turned on, you will see:

telnet/tcp: Connection from ...

in syslog.log (assuming that the info level has been enabled in /etc/syslog.conf). To turn on inetd logging when the system boots up, edit the file /etc/rc.config.d/netdaemons and change the INETD_ARGS line to read:

INETD_ARGS="-l"

Now all inetd-managed daemons will be logged to syslog.log (by default) using the facility daemon. That means that a telnet-specific log is not possible. All daemons managed by inetd will be logged with the daemon facility.

Now you can indeed move all inetd logging to another file. To do this, you modify /etc/syslog.conf to remove the daemon.* entries from syslog.log and add them to a new file, like this:

*.info;mail.none;daemon.none /var/adm/syslog/syslog.log
daemon.info /var/adm/syslog/daemon.log

The two lines are: log all facilities with messages starting at info level and higher, but do not log anything for mail and daemon facilities. The next line says: log all daemon messages at info and higher level.

You can create many different logfiles using the same technique. For instance, these entries will log ftp, auth and daemon in separate logs:

*.info;mail.none;local5.none;auth.none;daemon.none /var/adm/syslog/syslog.log
local5.info /var/adm/syslog/ftp.log
auth.info /var/adm/syslog/auth.log
daemon.info /var/adm/syslog/daemon.log

To determine the facility and level for a specific message in syslog, you need to to turn on syslogd facility/priority logging. To do this, add -v to syslogd's command line. To do this immediately:

# kill $(cat /var/run/syslog.pid)
# /usr/sbin/syslogd -v

and now all messages will have a 2-digit hex number inserted in front of the hostname, as in: 6D:myhost The hex digits are decoded using the information in the man page for syslog (man 3c syslog). To make this easier, I have attached a script that will decode any file (syslog.log by default) to display the facility and priority levels.

To make the syslog options permanent, edit the file /etc/rc.config.d/syslogd and change the line:

SYSLOGD_OPTS="-D -v"

Note that the -D option is recommended to force all console messages to syslog since most servers have no active console available.

[Bill Hassell]

One additional note (worth a separate post):

/etc/syslog.conf has a VERY important format restriction: NO SPACES ALLOWED. The separator between logging information and the destination is one or more tabs -- no spaces allowed. To see this, type the command:

# cat -t /etc/syslog.conf
mail.debug^I^I/var/adm/syslog/mail.log
*.info;mail.none;local5.none;auth.none^I/var/adm/syslog/syslog.log
auth.info^I^I/var/adm/syslog/auth.log
local5.info^I^I/var/adm/syslog/ftp.log
*.alert^I^I^I/dev/console
*.alert^I^I^Iroot
*.emerg^I^I^I*

As you can see, there are ^I characters (^I means CTRL-I or the tab character) separating the two fields. Any line with spaces between fields or between directives will be silently ignored.

To test the syslog.conf file, use the command logger as in:

$ logger -p local5.warn "local5 (ftp) at warn level"
$ logger -p daemon.info "daemon at info level"

That will show where the message is logged and what the hex code looks like.

[lin.chen]

Dear Bill,
Thanks a lot for your kindly and detailed reply,I will try your suggestion.
Louis.