Logging to a syslog server

[Gus Mestousis]

What would the proper syntax in the syslog.conf file be if I wanted to do the following:

Log all messages from serverA to serverB, but have the files go to the file /var/adm/syslog/serverA.syslog.log on serverB?

I realize that I have to use tabs in the syslog file, and that to send to an alternate server I should use the @serverB, but how do I send it to the particular file on serverB?

Does anything have to be done on serverB to allow it to receive the messages from serverA?
Thanks!

[Sridhar Bhaskarla]

Hi Gus,

You can configure the log files for the messages based on the facility (like *.emerg, *.info etc,) but not based on the host they are coming from. They will be logged into the syslog file that you have specified in your syslog.conf on serverB. However, these messages will appear in the syslog.log of serverB with the hostname serverA, so you can be able to easily seperate them out during the analysis.

-Sri

[Sundar_7]

Gus,

Initally I thought this is going to be very straightforward. One complication is that, I dont believe there is anyway ServerB can distinguish between the syslog messages from ServerA and log in to a different file than /var/adm/syslog.log

I can outline steps involved, but need to figure out how to route ALL the messages from ServerA to a specific file on ServerB.

On ServerA

# vi /etc/syslog.conf
local4.notice @serverB
#

# ps -ef | grep syslogd
# kill -1

On ServerB

# vi /etc/syslog.conf
local4.notice /var/adm/syslog/serverA.syslog.log
#

# kill -1 `cat /var/run/syslogd.pid`

From ServerA

# logger -t local4.notice "Hi ! this is a test"

Now check the file in ServerB.

There is no more steps involved apart from the ones I have mentioned above except in case of firewall-ed hosts. You need to enable 514/TCP for the syslog communication between the hosts.

- Sundar