syslog.conf

[Linda Lux]

My network admin wanted me to start sending the mail.debug to splunk(using an IP address). I added a line to syslog.conf like this:
mail.debug 10.2.6.170(splunk ip address)
following the
mail.debug /var/adm/syslog/mail.log

however he has said that nothing is coming over.
I stopped and started syslogd

[Steven E. Protter]

Shalom Linda,

syslog uses port 514.

See that any firewalls permit this traffic point to point at least.

On the send server:
tcpdump -i lan0 port 514
#replace lan0 with actual

On the recipient
tcpdump -i lan0 port 514
#replace lan0 with actual

lanscan or look at ifconfig to find out actual on lan

SEP

[James R. Ferguson]

Hi Linda:

You need an "@" character in front of the address. Better yet, change the IPaddress to a hostname with the "@" preceeding it.

Regards!

...JRF...

[Patrick Wallek]

The syslog.conf file REQUIRES tabs between the 'mail.debug' and the IP address. If you just use spaces it will not work.

According to the man page for syslogd: "The action field is separated from the selector by one or more tabs."

[Linda Lux]

I am sorry the line is

mail.debug (tab) (tab) @10.2.6.179

Linda

[Linda Lux]

I have syslog.log file going to that IP address in syslog.conf and that is going through.
Linda