syslog forwarding question

[Richard Murden]

I have setup syslog fowarding to send all local6 data from server A to server B. Everything seems to come over correctly but we have noticed that the origination of the errors says server A. It should not be server A but one of the Cisco devices we are trapping. How do i correct this? We are running 11.0.
Points to be awarded!
Thanks,
Richard

[Steven E. Protter]

Shalom Richard,

There is a file called /etc/syslog.conf

See the line called
*.info;mail.none /var/adm/syslog/syslog.log

Add a line right below that looks like this:
*.info;mail.none @hostname_of_log_server

/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

SEP

[Richard Murden]

I have a line in the syslog.conf file that says:
local6.info @xx.xxx.xx.xxx

Are you saying that i need to add the line you suggested to get the correct origination of the message?

[Sundar_7]

I am taking a wild guess here. Pardon me if I am way too off. I guess Server A is getting the traps from the Cisco device, which inturn is forwarded to Server B.

If this is the case, I believe there is no way to get the correct originator in Server B. Why not just forward the traps from Cisco devices to Server B ?

[Richard Murden]

Good question, the problem is, is that our WAN Dept. wants to keep all of their logging on one server. Someone mentioned using syslog-ng? Stands for new generation. Have you ever heard of that?

[Sundar_7]

Ofcourse. if syslog is foreign to me, I am not an UNIX admin :-).

Do you know how Cisco forwards the traps to Server A ?

I can suggest one more way - append local6.* messages in a file in Server A. Run a routine from crontab to scan the file for new messages and use some other syslog facility (for ex local7 ) to forward the message to Server B.

[Sorrel G. Jakins · Accepted solution]

syslog-ng only applies to hpux 11.23 (and future releases). When syslog-ng (such a mouthful, can we call it sng? or snog?) forwards stuff it appends the local system designation and a timestamp.

HTH
Sorrel Jakins, Brigham Young U