SEO

Hi!

I'm trying to configure syslog to receive messages from remote host
and to put them in separate directory.

Can it be done with AIX standard syslogd?
What should I put in syslog.conf?

Thanks!


Mario.

Mario Pranjic <keeper@fly.srk.fer.hr> wrote in message news:<1bi13014kl097c1ktfpcoku7q2gl8cclqe@4ax.com>. ..
> Hi!
>
> I'm trying to configure syslog to receive messages from remote host
> and to put them in separate directory.
>
> Can it be done with AIX standard syslogd?
> What should I put in syslog.conf?
>
> Thanks!
>
>
> Mario.

It should be okay. Take a look at the /etc/syslog.conf for an idea of
the syntax, but you will need to know what you are trying to capture.

On the remote host, you will edit the /etc/syslog.conf to send all the
info to the server machine. For example if you wanted to send all the
printer info to local machine, then edit /etc/syslog.conf:

lpr.debug @local

and refresh -s syslogd

The "@local" syntax will tell the remote machine to send all the
lpr.debug messages to the "local" machine; the remote machine need to
be able to resolv "local"'s IP.

On the local machine, edit the /etc/syslog.conf to tell it what to do
with the incoming lpd.debug.

1. make sure the log file exist first; for example:
touch /var/adm/log/printer.syslog.out

2. edit /etc/syslog.conf:
lpd.debug /var/adm/log/printer rotate 1024K files 5

3. refresh -s syslogd (or stopsrc -s syslogd;startsrc -s syslogd)

In order to test it, log into remote host and use logger command.
logger -plpr.debug "my test message"

The "rotate 1024K file 5" part will make sure the log files don't get
to big on you; like it reads it will rotate when the files get 1MB up
to 5 files.

g.

On 16 Feb 2004 14:25:20 -0800, gdyche@nmhs.org (Greg Dyche) wrote:


>2. edit /etc/syslog.conf:
>lpd.debug /var/adm/log/printer rotate 1024K files 5

Thnx!

Just one more question.
In this case, both local and remote logs from lpr will be written in
the same log file.

Is it possible to arrange syslogd to write local lpr logs into one
file and remote lpr logs into different file?

Mario.

Mario Pranjic <keeper@fly.srk.fer.hr> wrote in message news:<01i330d2khb1r3kglo5lm535qrq39fo2p1@4ax.com>. ..
> On 16 Feb 2004 14:25:20 -0800, gdyche@nmhs.org (Greg Dyche) wrote:
>
>
> >2. edit /etc/syslog.conf:
> >lpd.debug /var/adm/log/printer rotate 1024K files 5
>
> Thnx!
>
> Just one more question.
> In this case, both local and remote logs from lpr will be written in
> the same log file.
>
> Is it possible to arrange syslogd to write local lpr logs into one
> file and remote lpr logs into different file?
>
> Mario.

Not that I am aware of. The syslog conf file doesn't know where the
messages are coming from; it only knows where to send them, so I don't
think it can tell the difference. You could send lpr.debug to one
place and lpr.crit to another, but the debug level would also contain
everything at the crit level.

If you don't want your machine to accept any syslog messages from
remote machines, then you must start the syslogd with the "-r" flag:
startsrc -s syslogd -a "-r"

g.