syslogd - local4, local6, & local7

[Tom Dawson]

Hi,

I'm trying to send syslogd messages for local4.info, local6.info, and local7.info to a syslogd on a remote host. The messages transmit fine for local0.info, local1.info, local2.info, and local3.info. But they don't seem to want to transfer to the remost host for local4, local6, and local7 ( local5.info are being logged in a local file ).

Have I bumped into some sort of limit ( maybe only local0-3 can be monitored remotely )? I've attaced my /etc/syslog.conf file. I've stopped and restarted syslogd.

If anyone has any suggestions of what I can try next, they'd be greatly appreciated.

TIA,
Tom

[Kevin Wright]

local0-7 are valid logging facilities. You could run syslog in debug mode with -d, then use
logger -p local6.info 'test' to see what happens.

[Michael Kelly_5]

Tom,
forgive me if this is a stupid question but how are local4/6/7 messages handled on the remote host?

Regards,
Michael.

[RolandH · Accepted solution]

Hi Tom,

perhaps it could be, because of the two local4.* lines. First of all check to change the line order

local4.debug @remosthost.domain.com
local4.info @remosthost.domain.com


(There is a EXAMPLE in the man page from syslogd, which has this order. first debug then info)

If this will not help check if it works with only one line of local4.

Check the patch level of syslogd
# what /usr/sbin/syslogd

Then check for a newer patch in the itrc.

HTH
Roland

[Elena Leontieva]

Tom,

As Michael suggested, check and compare the /etc/syslog.conf files on remote hosts.

See this doc for explanation:
http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000065680032

Elena.

[Tom Dawson]

Kevin,

I was reticent to use -d since the only place I was seeing the problem was on the production server.

Michael,

I was scared to death I was making a stupid mistake like that, but alas, I did have local4/6/7 pointing to a file on the remote syslogd server.

Roland,

In the end, I have the same syslog.conf file that I had before. But it is working now. I made the changes you suggested, stopped/restarted syslogd and it work! So then I went back and reversed their order to what I had before, stopped/restarted syslogd, and it continues to work.

So maybe I had some sort of editing error in the syslog.conf file before hand ( I had checked, I'd used as the man page demands ). Thanks!

Elana,

Havn't had time to check out the link yet, but thanks!

Tom