sending all syslog events to a syslog server

[rana786]

Hi all,

I want to send all syslog events and bad login to send to a windows/Linux syslog server. How can I do that? What should I need to configure in my hp-ux system?

Best regards,
Rana

[Ivan Krastev]

See this previous thread - http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=750918

regards,
ivan

[Steven E. Protter]

Shalom,

Yes of course you can do that. syslog used port 514 and you'll need to insure that port is open on the Linux boxes and all intervening firewalls.

SEP

[Sunny Jaisinghani]

hi

yes u can do that.

u need to configure your

/etc/hosts file by adding a loghost entry for your syslog server in all the clients.

also you need to configure /etc/syslog.conf

sunny

[gstonian]

Configure your /etc/syslog.conf file, not forgetting to update the central syslog server in your /etc/hosts file and ensure all firewalls/port are open to allow set up.

It works fine for us.

[Peter Nikitka]

Hi,

note that you have to add the option '-r' to the syslog on a Linux box, so its syslogd is listening to remote log requests.

mfG Peter

[rana786]

Hi all,

My central syslog server is windows based 'winsyslog'. 514 port is open to all client in the syslog server. I configured syslog.conf to send warn, err to the ip address of syslog server and then stop/started syslogd but still does not getting any response. Do I need to add ip address of syslog server in the /etc/hosts file? I have added following line in the syslog.conf file.

*.warn;*.err @172.16.1.36

What else should I need to configure? Is Windows syslog server capable to receive event from ux? Should I go for linux syslog server? please help.

[Peter Nikitka]

Hi,

- the delimiter must be a TAB:
*.warn;*.err@172.16.1.36

- go Linux

mfG Peter

[Sunny Jaisinghani]

hi,

your /etc/hosts file should contain an entry like this

loghost


and in /etc/syslog.conf

*.warn @loghost
*.err @loghost

[Sunny Jaisinghani]

Hi Rana,

don't know about windows syslog server.
it would be better if you use linux syslog server.
Linux syslog should definately work.

[PeterWolfe]

winsyslog is a syslog daemon for windows.
If that is working for you for other
UNIX systems, it should work fine with HP-UX.
Linux log consolidators definitely work.
HP-UX log consolidators definitely work.

Try using @
and make sure the fully qualified name
of the windows system is in /etc/hosts.

Test forwarding using logger -p. IOW,
given you forwarding filter,
you need to generate syslog messages
with the right facility.priority
(specifically warnings and errors)
Try something like:
logger -p user.warning "test message"