syslog server configuration

[Azaru]

Hi All,


Please help to configure syslog server in hpux.

[Horia Chirculescu]

Hello,

The configuration is done through /etc/syslog.conf

Take a look at this file (there are some usefull comments)

and man syslog

Horia.

[Azaru]

Hi,

This is my /etc/syslog.conf file in client side. Please take a look.



# @(#)B11.23_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
*.info;mail.none @bkpsvr


And added bkpsvr entry in /etc/hosts file

And restarted but no effect.

What else to be done?

Thanks for the reply

[Horia Chirculescu]

In order to perform redirect, you must prepare syslogd to accept remote logging message on the system bkpsvr.

Also, if bkpsvr is behind a firewall, you must allow syslog traffic to pass through.

Horia.

[Michal Kapalka (mikap)]

hi,

check the configuration on the SYSlog server side, if its reachable for the forwarded client.

mikap

[Horia Chirculescu]

>And restarted but no effect.

You do not need to restart. After altering configuration file, you can perform a

kill -HUP `cat /var/run/syslog.pid`

to force re-load the configuration file.

Horia.

[Azaru]

Hi all,

What needs to be done on bkpsvr to accept the logs from client?

There is no firewall between them.

I have done

kill -HUP `cat /var/run/syslog.pid`

But where the logs will get stored?

[Horia Chirculescu]

>What needs to be done on bkpsvr to accept the logs from client?

It depends on what kind of SO you have there.

On HP-UX you need to do nothing, your syslogd accepts by default network connections.

From Linux, you must call syslogd with -r parameter.

man syslogd

on this server would help understanding the syntax.

Horia.

[Horia Chirculescu]

>But where the logs will get stored?

Where you asked to syslogd to send those (you instructed syslogd on the file /etc/syslog.conf)

Horia.

[Johnson Punniyalingam]

>>What needs to be done on bkpsvr to accept the logs from client?<<<

Do your >>Backup Server Running Any application to capture the "Syslog" from Clients ?? IF Not you try ftp syslog

Alternative Choice :-

scp -p /var/adm/syslog/syslog.log Bkupserver:/logs/hostname

[Johnson Punniyalingam]

if you have any Software Installed on the backup server, You can edit "syslog.conf file from the your client side

Check below thread for more infromation

http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1265114848901+28353475&threadId=1219056

[Azaru]

Where(path) can i find the logs of clients in bkpsvr server.

[Johnson Punniyalingam]

>>Where(path) can i find the logs of clients in bkpsvr server<<<

Before Answering your Question.

Did you give any information, what do really need so that we can help you accordingly

Are you running Any application or Software ? to Capture the syslog in your Backup Server

[Horia Chirculescu]

It depends on your OS that you have.

By default, on HP-UX, check:

/var/adm/syslog/

On Linux, check:

/var/log

But again, those directories and the associated files are set up on /etc/syslog.conf
Check that file on bkpsvr!

Best regards,
Horia.

[Azaru]

But we have done os hardening on all the servers. Will the client send logs to server withour credential?

[Azaru]

No we are not using any software,application to capture syslog.

[Johnson Punniyalingam]

>>But we have done os hardening on all the servers. Will the client send logs to server withour credential?<<<<

Again this doesn't give enough information what you are looking for


>>No we are not using any software,application to capture syslog.<<

if you are not using any SW or Application, what method are you using to capture your syslog ??????

are you using ftp/sftp method to copy your "Client Syslog" to your "Backup Server" ??

if your server harden you may need use (sftp /scp) secured copy of your "Client Syslog" to your backup Server"

[Horia Chirculescu]

>No we are not using any software,application to capture syslog.

>Will the client send logs to server withour credential?

Syslog does not use any encryption to send data to remote server.

If this troubles you, you can make another private LAN (insert another ethernet card in each server) between all your servers that will send syslog data to the bkpsvr server.

Alternatively, you could implement (on bkpsvr) a sollution based on scp as Johnson suggested.
You could run on bkpsvr from time to time a script (use crontab) that will use scp to copy the logs that you want, from whatever server you want.

Best regards,
Horia.

[Kanagaraj]

Hi Azar,

In syslog server configure like this.

/etc/syslog.conf file

local2.debug

eg.

local2.debug /backuplogs/ems/srvr_syslog.log



at client machine.

Syslog server: SYSLOGSRVR

put entries in /etc/syslog.conf file

local2.debug @SYSLOGSRVR


I hope this will help you out to setup a syslog server.

also see this link.
http://www.linuxhomenetworking.com/cisco-hn/syslog-cisco.htm

[Kanagaraj]

Don't forget to restart syslogd.

/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start