syslog server/client

[rasczak]

I've got a solaris box I'm trying to setup as a syslog server (using default syslog, not syslog-ng) and a linux appliance i need to pull the syslogs from.

I'm having a bit of trouble understanding where i am supposed to enter the host information on the server.

vi /etc/syslog.conf

This is an example of the /etc/syslog.conf file NOTE: Do not use the space bar for /etc/syslog.conf, you must use tabs!

#ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */
#
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
#
# syslog configuration file.
#
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words. Also, within ifdef's, arguments
# containing commas must be quoted.
#
*.err;kern.notice;auth.notice /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages



# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)

mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)

#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err /dev/sysmsg
user.err /var/adm/messages
user.alert `root, operator'
user.emerg *
)


My syslog.conf file looks similar to the above. Given the current look of the file, am I supposed to leave it as is, and append the etc/hosts file with the ip, hostname and "loghost" line? or do I enter the loghosts name and IP in this config file somewhere?

I'm a bit confused. Thanks for any input.

 

[Khyron320]

I know you said you are not using syslog-ng

I set this up for my mikrotik router at home with syslog-ng. Maybe the config methods are similar and this will help?

filter f_mikrotik { host( "192.168.144.1" ); };
destination df_mikrotik { file("/var/log/mikrotik.log"); };
log { source ( s_net ); filter( f_mikrotik ); destination ( df_mikrotik ); };