syslog.conf

[Stéphane Gauthier]

Hello,

Ou security guy wants to log all sessions (telnet, ftp, ssh) on our HP-UX server using a syslog server. I am trying to send the info using the HP-UX syslog but it does not seem to be working using *.auth. Any advice? Here is the syslog.conf config. Yes they are some TAB between the first and second column...just can't see here ;o)

# @(#)B.11.31_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none;local1.none /var/adm/syslog/syslog.log
*.info;mail.none;local1.none @10.1.0.100
*.alert /dev/console
*.alert root
*.emerg *
*.auth @10.1.0.100
#

[Robert-Jan Goossens · Accepted solution]

Hi Stéphane,

I believe it should be auth.info, the syslog daemon is very picky.

try this.

auth.info @10.1.0.100
auth.info /var/adm/syslog/auth.log

Kill and start the syslogd.

Regards,
Robert-Jan

[Stéphane Gauthier]

Tks. I have try and auth.info does it only with ftp connexion and do not catch the telnet or ssh one.

[WayneHP]

This should be useful.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=267234

[Don Mallory]

You don't have to kill and restart the syslog daemon, just do a ps -ef | grep syslog, find the PID and run "kill -HUP 1234" where 1234 is the PID of syslogd.

Syslog only requires you to tell it to "hang up" and re-read the config. Otherwise, you will miss any messages that occur during the restart.