HP-UX11i and the syslog file

[Adam Richards]

Hi,

Is there anyone out there who knows a comprehensive list of all commands on 11i which write to the syslog??

cheers

Adam.

[harry d brown jr]

Well any application can write to it, and some apps allow you to configure to do so.

Was there something you are looking for?

live free or die
harry

[Michael Tully]

Not sure if anyone has compiled a list like this before. Part of the problem you have is that you can determine what you want to write to the log. Case in point, have a look at the logging levels from the man page of syslog (3C). Starting from that, where do you stop.

[Misa]

Since any process can theoretically log to syslog, I don't think it's going to be possible to compile such a list. For example, I can use the "logger" command in a shell script that I've written and it will make syslog entries.

Perhaps if we knew the background behind your question, we could suggest additional ways of solving the problem.

--M????a

[Adam Richards]

hmm, good question!

I am actually integrating hp-ux 11i with our Risk Manager product which correlates possible intrusion and security violation on the system.

I am trying to map all base standard OS commands (eg su, rlogind, etc) so that any malicious intent can be picked up from the log file and correlated.

So, I need to know which of the base OS commands can potentially if configured correctly, (like su, rlogind etc) will write to the syslogd.

Also.....which process uses the 'login' command and does it's error messages write to it's log file through the syslod API or of it's own accord? i.e is there any chance that error's for 'login' command will write to the syslog?

cheers in advance

Adam.

[Misa · Accepted solution]

Okay. I still don't think there's a "nice" answer, but maybe this'll provide some ideas.

One thing you're probably going to want to do is read /etc/syslogd.conf to see where the different syslog facilities/priorities are going. The *standard* for a lot of stuff may be /var/adm/syslog/syslog.log, but it can be changed (and isn't the only location even in a default configuration).

One idea is to collect a bunch of syslogs from different places and go through them. syslogd writes in a specific format and you should be able to pluck out command names.

Things that write there (in a default config) include: syslogd, vmunix, nettl, rpcbind, inetd, xntpd, diagmond, su, cmcld, cmclconfd, cmtaped, telnetd, cmsrvassistd, cmlvmd, Networker daemons. Sorry, those aren't all base OS commands, but while I was at it... ;)

AFAIK, the login command will not write to syslog; it writes to /var/adm/wtmp and (if configured) /var/adm/btmp. The last (successful) and lastb (unsuccessful) commands will read those files. I *believe*, but am not sure, that things using /usr/bin/login are: getty(1m), login(1), telnetd(1m), rlogind(1m). I'm not immediately sure about rexecd and remshd, etc.

HTH.

--M????a

[V. V. Ravi Kumar_1]

hi,
such a list may not be avialble. u can not say which command is writing to syslog. but almost all services will write to syslog. mail, EMS, debug etc., iam giving a sample syslog file.
-------------------
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.alert /var/adm/syslog/alert.log
*.crit /var/adm/syslog/crit.log
*.crit root
*.emerg /var/adm/syslog/emerg.log
*.emerg *
auth.debug /var/adm/syslog/auth.log
daemon.debug /var/adm/syslog/daemon.log
*.* @hpdev
*.debug;mail.none /var/adm/syslog/debug.log
------------------------

regds

[Misa]

BTW, an issue of SysAdmin magazine talked about getting wtmp entries (such as in /var/adm/wtmp, but it can hold more than just login stuff) written into the syslog. I *think* it was within the last few months, but it may have been as long ago as a year.