Remote syslog logging (Primary and Secondary)

[Koh Kuan Wong]

Is there a method to configure 2 servers to store all the syslog, 1 as a primary and the other as a secondary. If the primary server is up and running, the syslogd will write only to the primary server. If the primary server is down, then syslogd will write only to the secondary server.

In solaris, we can use
mail.debug ifdef('LOGHOST', /var/log/authlog, @loghost)

Please help. Thanks.

[twang]

Set up a syslog server and it is logging syslog information from other hosts:
- To send messages from host A to /var/adm/syslog/syslog.log on host B, the syslog.conf file on host A would look like this:
*.info @B

[Fragon]

Hi,
I think you can setup /etc/syslog.conf to redirect the log(s) to another server. I haven't setup this function before. Please use:
#man syslogd
to get more help.

Good luck!
-ux

[twang]

Here is the syslog.conf file of one of our server. Hope it is helpful.
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
*.emerg;*.alert;*.crit;*.err;*.warning;*.notice;*.info @192.9.200.79

[Paula J Frazer-Campbell]

HI

Whilst it can be done I would not recommend it as if a server had problems and during those problems it lost contact with the syslog server you will then loose the syslog info during this stage.

This info could be very important in pining down the problem.

Paula

[Paula J Frazer-Campbell]

Further to my last post.

I would set up a copy routine so that the syslog is copied to the syslog server.

There are many ways to do this - ftp, rcp and nfs to name but three.

Paula

[Darren Prior]

Hi,

I don't believe you can make syslogd conditionally write to other servers, however it's possible to write to 2 servers:

ie in syslog.conf:

mail.debug @loghost1
mail.debug @loghost2

You'd then need to compare the syslog entries on the 2 loghosts to ensure you see everything.

regards,

Darren.

[Koh Kuan Wong]

Hi All,

Thanks for all the prompt reply. Appreciate it a lot. I think I should make my question clearer next time :) My question was answered by Darren. All my unix workstation are already writing its syslog to server A. I wanted to know whether can I configure all the workstation to write to server B if server A is down.