Syslog to local file and remote host

[Doug Rheams]

I have a linux server running swatch to monitor the syslog from multiple machines. I would like to send the syslog from my HP-UX system to this server but also log it locally so I can still see the logs in the event of a network failure. Can I specify multiple hosts in /etc/syslog.conf? I tried adding
*.info [tab] /var/adm/syslog.log @loghost
but it does not work. I also tried putting a seperate line for each host but I still have no luck. Is it possible to log to multiple locations?

[Richard Johnson_1]

You should be able to specify multiple destinations for messages by repeating the line in /etc/syslog.conf. Are you sending syslogd a SIGHUP after changing the file or alternatively restarting syslogd?

Regards,

Rich

[Jeff Schussele]

Hi Doug,

Although I don't think you can send to multiple loactions on the same line in syslog.conf - except for comma separated list of users. But I would try using two separate lines in the syslog.conf file as the messages are sent at that specified level & higher. Say send warning & higher to the syslog server & send info & higher to the file.

Something like

*.warning @server
*.info /var/adm/syslog/syslog.log

You should also be aware the syslog services uses port 514/UDP & therefore NO error checking is performed in transmission & that coupled with the fact that if you have an environmental problem that's causing a LOT of systems messages on a LOT of systems, you SHOULD seriously study how to route this traffic. I'd recommend a dedicated LAN for the syslog traffic & size the NICS accordingly - i.e gigabit on the syslog server & 100MB on the syslog clients & appropriate switches/routers to handle the traffic.

HTH,
Jeff