The syslog
daemon, running on SecurePlatform OS (and most Linux based OS's) handles most of the Operating System logging. This daemon uses the /etc/syslog.conf
file for configuration and handles all messages sent to it on UDP 0.0.0.0:514
Based on syslog
message facility and priority, the syslog.conf
file defines how each syslog
message is handled, then determines where this message is written locally or to what remote IP address it should be sent.
Example 1:
authpriv.* <TAB> /var/log/secure
"authpriv
" is the facility.
"." - delimits the facility from the priority.
"*" - means all priorities.
There must be a <TAB> between the selector section (facility.priority) and the action section on each line.
"/var/log/secure
" is the file that the messages are written to.
Example 2:
*.info;authpriv.none;cron.none;local5.none <TAB> @10.0.0.1
The selector section states, all facilities (except authpriv, cron
and local5
) with a priority of at least info or higher.
Send them via UDP:514 to IP address 10.0.0.1.
If you want to send syslogs to multiple servers, repeat the command from Example 2 to a different server.
Note:
When defining the priority, it will include the defined level and anything higher. Number of lines does not matter, each message is processed by each line separately.
Any time a change is made to the /etc/syslog.conf
file, the syslog
daemon should be restarted. To do so, run the service syslog restart
command.
A Security rule to allow a syslog
traffic to pass to/from the server may be required.