syslog.conf confusion

[kapra]

Dear all,

I am trying to fine tune my syslog.conf file as below

security.info /var/adm/syslog/security.log
auth.info /var/adm/syslog/auth.log
kern.info /var/adm/syslog/kernelinfo.log
kern.debug /var/adm/syslog/kerneldebug.log
*.info /var/adm/syslog/allinfo.log

I am running into few problems when i try to use this configuration file. After restarting the syslogd daemon, i tried to test the functionality using logger command and found the results to be surprising.

(1) Messages from Security and Auth facilities at all levels are getting logged inside both files namely security.log & auth.log and ofcourse inside allinfo.log
(i used logger -p security.info "message" likewise for auth.info, security.notice, auth.notice....... etc), i was expecting security messages ONLY to go inside security.log and same for auth message !!

(2) if i do logger -p kern.info "kernel message", this is getting logged only inside allinfo.log and NOT inside kernelinfo.log

(All these files do exist on their locations and have write permissions for all, also there are TABS (no spaces) inside syslog.conf file).

Please help me on this.

Thank you very much in advance.

[Geoff Wild]

Try:

security.info; auth.none var/adm/syslog/security.log
auth.inf; security.none /var/adm/syslog/auth.log


Rgds...Geoff

[kapra]

Thanks Geoff for your reply.

I tried making suggested changes to the syslog.conf file and restarted the syslogd daemon but after the changes it logs nothing !

Nothing for security and nothing for auth.

Both files are empty after raising alerts via logger command !

[Muthukumar_5]

Try as,

security.info;auth,kern.none /var/adm/syslog/security.log
auth.info;security,kern.none /var/adm/syslog/auth.log
kern.info;security,auth.none /var/adm/syslog/kernelinfo.log
kern.debug /var/adm/syslog/kerneldebug.log
*.info;kern.none;security.none;auth.none /var/adm/syslog/allinfo.log

Revert your results. If it is not working then specify which scenario it is not doing?

-Muthu

[kapra]

Thanks Muthu for your reply..

Have made the suggested changes results are as below

1. logger -p security.info "Security Info"
Nothing logged inside security.log, nothing inside auth.log & nothing inside allininfo.log

2. logger -p auth.info "Auth Info"
Same as case 1, nothing got logged anywhere

3. logger -p kern.info "Kernel Info"
This one got logged inside allinfo.log, nothing inside kernelinfo.log, nothing inside kerneldebug.log

4. logger -p kern.debug "kernel Debug"
Nothing got logged anywhere

Any further suggestions?