syslog.conf file

[Peter Gillis]

hi, ux11i
I am trying to work out the syslog.conf file. From what I understand, the following should mean a /var/adm/syslog/auth.log file is added to whenever an auth.notice type message is issued on the system:

auth.notice /var/adm/syslog/auth.log #

I have reread the conf file and issued an su command from root to another user. Would this not get logged in the /var/adm/syslog/auth.log file?

Thanks in advance for help..
Maria

[Olivier Decorse]

Hi,
first, i advise you to create the auth.log file, with "better rights" than syslog.log.
Next, try better a su FROM an user, TO root. su from root to an user is not really interresting for authentification.

Olivier.

[Michael Tully]

Maria,

Does the /var/adm/syslog/auth.log already exist? If not try to create it.

Did the attempt still get logged to /var/adm/syslog/syslog.log ?

Try su from an a normal user to root.

Regards
Michael

[Dave Olker · Accepted solution]

Hi Maria,

The level of logging all depends on how the daemon is coded to log the syslog events. If you're looking to capture su usage into a separate file from the syslog.log file, you could use:

auth.info /var/adm/syslog/auth.log

This line would instruct syslogd to log any "INFO" level messages from the authentication subsystem to the /var/adm/syslog/auth.log file. By default these messages also get logged to the /var/adm/syslog/syslog.log file, but if you want to capture specific types of messages for a given subsystem you can re-direct them in this manner.

Again, whether or not you capture the messages your interested in or not depends on how the daemon calls the syslog(3C) function and what level or type of message it logs. In the case of su, it uses INFO level syslog logging, so redirecting INFO level messages to a separate file would capture them.

Hope this helps,

Dave

[Muthukumar_5]

su log informations are stored as,

auth.info not as auth.notice

edit /etc/syslog.conf file as,
-----------

auth.info /var/adm/syslog/auth.log
*.info, ....

Note: No need to create the auth.log file.

Restart the syslogd as

kill the old syslogd ( ps -ef to get or syslog.pid )

/usr/sbin/syslogd -D

Try su log here and
If you see the /var/adm/syslog/auth.log file , it contains all entries.

[Peter Gillis]

thanks all.
changing the notice to info appears to have done the trick. Olivier, what did you mean about better permissions than syslo.log??

Regards,
Maria

[Muthukumar_5]

Don't worry about permission of auth.log file. It will be with 444 and root / root user group.

Don't create the file, the file will be automatically created at /var/adm/syslog/ location.

syslog.log will be 644 and but auth.log will be 444

[Peter Gillis]

Thanks Muthukumar, so what permissions should the other log files be...444 root:root ? I didnt manually create the files, as I noticed that they automatically created when restarted syslogd pid.
Regards,
Maria

[Dave Olker]

Hi Maria,

What other log files are you referring to? Can you do an ll of /var/adm/syslog and tell us which log files you're concerned about? Also include a copy of your /etc/syslog.conf file so that we can see which log files are automatically built by syslogd.

Thanks,

Dave

[Peter Gillis]

HI Dave,

auth.log
lpd-errs
mail.log
mesgs.log
syslog.log
xferlog

are the other log files I have in there.
Thanks, Maria

[Sundar_7]

Maria,

Dont worry about the individual file permissions as long as the parent directory is protected.

ls -ld /var/adm/syslog

As long as the permissions of /var/adm/syslog is 750 (with root:adm as the ownership), you can even have 777 for syslog.log and other log files.

-- Sundar.