Logging syslog messages to a remote server

[Paul F. Bennett]

I have attempted to configure multiple systems to send syslog message to a remote syslog collector/server but its not working, the logs never reach the server. There are several other previously configured systems that are sending logs fine.

I have added the line: '*.debug @' to /etc/syslog.conf

I had added the entry '/usr/lbin/ftpd -d -l' to the ftp line in /etc/inetd.conf

I have run inetd -c to re-read the syslog.conf file

I have run inetd -l to enable logging as well as checked syslog to verify it is enabled.

I have stopped & restarted syslog daemon with S220syslogd stop/start

I can ftp to the syslog server... well at least to get a login prompt

The syslog server is configure to accept any IP, plus several AIX systems have been configured with no problems, since.

lsof output:
lsof | grep syslog# syslogd 11203 root 13u IPv6 0xe000000143df8ac0 0t0 UDP *:55176 (Idle)

The system(s) 'appears' to be configured exactly like the systems that are working.

Any thought? :-(

[Tim Nelson]

adding a line like

*.info;mail.none @mylogserver.here.com

to /etc/syslog.conf

then sending SIGHUP ( kill -1 syslogd_pid )

Should do it.

[Mridul Shrivastava]

Add loghost entry in the /etc/hosts file

like

10.10.10.1 system1
10.10.10.2 system2 loghost

System1 is your machine and system2 is the machine you want to send log.

in /etc/syslog.conf add

*.info;mail.none @loghost

restart syslog daemon. Log should be going to the second server.

[Paul F. Bennett]

The '*.info;mail.none' line was already in the inetd.conf file, it points to syslogs.log.

I also added the IP's of the system and the server to the ./etc/hosts file.

Unfortunately, its still not sending logs :-(

[Paul F. Bennett]

Oh yeah, and I restarted syslogd with:

# ./S220syslogd stop
# ./S220syslogd start

[Mridul Shrivastava]

That entry is to write to syslog.log on the system, you need to add one more entry for the remote server if you want syslog to be updated on both places.

[Paul F. Bennett]

Here is my syslog.conf file, minus the exact IP addresses:
-------------------------------------------
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
*.debug @10.xx3.74.xx0
*.debug @10.xx3.74.xx1

-------------------------------------------

[TwoProc]

Add this line to the bottom of syslog.conf:

*.info;mail.none @10.xx3.74.xx1

( yes, it can be in there twice and not affect the line before)...

Then restart the syslog server (as before in other post).

And then issue the command:

$> logger "This is a test for syslog redirect"


You should see the "This is ..." on the other server. Have you tried using the "logger" command to write to both log files?

[Paul F. Bennett]

Still nothing :-( The syslog server is actually a RSA log colllection tool, I'm going to talked with the admins of that tool because I think the HP-UX end is configured correctly, thanks!

[TwoProc]

I didn't check up on this well enough before my last posting. According to the man page, the logger command sends at the "user.notice" level, not on *.info - so, just try this one more thing, and if it doesn't work, then you need to talk to your buddies for the other server.

So, add this to you syslog.conf file:

*.notice @10.xx3.74.xx1

Then try the logger command as suggested before.