Linux Syslog server and HP-UX Client Server

[Mousa55]

Hi All,

I am in the process of setting up a syslog server on RHEL 5.5, to collects logs from servers (HP-UX, Linux, Windows and Cisco Network Devices) and
i following These steps on Syslog Linux server

# vi /etc/sysconfig/syslog
Configure syslogd option as follows:
SYSLOGD_OPTIONS="-m 0 -r -x"
Save and close the file. Restart syslogd, enter:
# service syslog restart

Then i Configuring the Client server by following These steps (Unix)

#Add an entry in the /etc/hosts file in the format
IP-address hostname
ex. 10.15.1.5 syslog

#add the following line to their /etc/syslog.conf files:

*.* @10.15.1.5

#restart syslogd.

/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

But still i cannot see any logs from HP-UX on syslog linux server under (tail -f /var/log/messages
Or other path) How i can solving this issue?

Thanks

[Mousa55]

Hi,

on Client server (HP-UX)

# netstat -an | grep 514
tcp 0 0 *.514 *.* LISTEN
udp 0 0 *.514 *.*
# netstat -a | grep syslog
udp 0 0 *.syslog *.*

On syslog server (Linux)

[root@syslog ~]# netstat -an | grep 514
udp 0 0 0.0.0.0:514 0.0.0.0:*
unix 2 [ ACC ] STREAM LISTENING 18524 /tmp/orbit-root/linc-12df-0-1ba5143440fb1
unix 2 [ ACC ] STREAM LISTENING 18640 /tmp/orbit-root/linc-12f7-0-1ba51434acc46
unix 2 [ ACC ] STREAM LISTENING 18656 /tmp/orbit-root/linc-12f9-0-1ba51434b02bc
unix 2 [ ACC ] STREAM LISTENING 18735 /tmp/orbit-root/linc-12fb-0-1ba51434e6461
unix 2 [ ACC ] STREAM LISTENING 18748 /tmp/orbit-root/linc-130e-0-1ba51434ea311
unix 2 [ ACC ] STREAM LISTENING 19125 /tmp/orbit-root/linc-1304-0-1ba5143676c77
unix 2 [ ACC ] STREAM LISTENING 19170 /tmp/orbit-root/linc-1300-0-1ba5143128d20
unix 3 [ ] STREAM CONNECTED 19173 /tmp/orbit-root/linc-1300-0-1ba5143128d20
unix 3 [ ] STREAM CONNECTED 19148 /tmp/orbit-root/linc-12f7-0-1ba51434acc46
unix 3 [ ] STREAM CONNECTED 19129 /tmp/orbit-root/linc-1304-0-1ba5143676c77
unix 3 [ ] STREAM CONNECTED 18997 /tmp/orbit-root/linc-12f7-0-1ba51434acc46
unix 3 [ ] STREAM CONNECTED 18956 /tmp/orbit-root/linc-12f7-0-1ba51434acc46
unix 3 [ ] STREAM CONNECTED 18917 /tmp/orbit-root/linc-12f7-0-1ba51434acc46
unix 3 [ ] STREAM CONNECTED 18845 /tmp/orbit-root/linc-12f9-0-1ba51434b02bc
unix 3 [ ] STREAM CONNECTED 18802 /tmp/orbit-root/linc-12f7-0-1ba51434acc46
unix 3 [ ] STREAM CONNECTED 18800 /tmp/orbit-root/linc-130e-0-1ba51434ea311
unix 3 [ ] STREAM CONNECTED 18755 /tmp/orbit-root/linc-130e-0-1ba51434ea311
unix 3 [ ] STREAM CONNECTED 18751 /tmp/orbit-root/linc-130e-0-1ba51434ea311
unix 3 [ ] STREAM CONNECTED 18738 /tmp/orbit-root/linc-12fb-0-1ba51434e6461
unix 3 [ ] STREAM CONNECTED 18659 /tmp/orbit-root/linc-12f9-0-1ba51434b02bc
unix 3 [ ] STREAM CONNECTED 18653 /tmp/orbit-root/linc-12f7-0-1ba51434acc46
unix 3 [ ] STREAM CONNECTED 18643 /tmp/orbit-root/linc-12f7-0-1ba51434acc46
unix 3 [ ] STREAM CONNECTED 18527 /tmp/orbit-root/linc-12df-0-1ba5143440fb1
unix 3 [ ] STREAM CONNECTED 15149

[root@syslog ~]# netstat -a | grep syslog
tcp 0 4156 syslog:ssh hqit134.sp.local:49467 ESTABLISHED
udp 0 0 *:syslog *:*

Thanks

[Mousa55]

Hi,

i can collect logs from windows PC on syslog linux server by using Datagram SyslogAgent software. but still i need your help to i can collect logs from HP-UX 11.23 server.
i configuring the Unix server as in the steps below:

1. Log in as root

2. Go to /etc/syslog.conf

3. Add a line: *.*@

4. Save and Close

# netstat -na | grep 514

tcp 0 0 *.514 *.* LISTEN
udp 0 0 *.514 *.*

5. Go to the /etc/hosts file (in case DNS is not configured or temporarily down)

Enter a line: #Sentinel Server

10. Now execute the following commands

/sbin/init.d/syslogd stop
syslogd -v
kill -HUP `cat /etc/syslog.pid`
/sbin/init.d/syslogd start

Only i see these logs when i try to telnet to syslog server from unix server

"Dec 26 13:12:41 syslog xinetd[3186]: START: telnet pid=11657 from=10.8.1.69
Dec 26 13:12:44 syslog xinetd[3186]: EXIT: telnet status=0 pid=11657 duration=3(sec)"

How i can to collect all logs of unix server ?

Thanks

[Zinky]

Have you tried using the "logger" command on UNIX (HP-UX, etc) to test actually sending log entries to syslog?

Try that firstly.

[Mousa55]

Thanks