The syslog daemon, running on SecurePlatform OS (and most Linux based OS's) handles most of the Operating System logging. This daemon uses the /etc/syslog.conf file for configuration and handles all messages sent to it on UDP 0.0.0.0:514
Based on syslog message facility and priority, the syslog.conf file defines how each syslog message is handled, then determines where this message is written locally or to what remote IP address it should be sent.
Example 1:
authpriv.* <TAB> /var/log/secure
"authpriv" is the facility.
"." - delimits the facility from the priority.
"*" - means all priorities.
There must be a <TAB> between the selector section (facility.priority) and the action section on each line.
"/var/log/secure" is the file that the messages are written to.
Example 2:
*.info;authpriv.none;cron.none;local5.none <TAB> @10.0.0.1
The selector section states, all facilities (except authpriv, cron and local5) with a priority of at least info or higher.
Send them via UDP:514 to IP address 10.0.0.1.
If you want to send syslogs to multiple servers, repeat the command from Example 2 to a different server.
Note:
When defining the priority, it will include the defined level and anything higher. Number of lines does not matter, each message is processed by each line separately.
Any time a change is made to the /etc/syslog.conf file, the syslog daemon should be restarted. To do so, run the service syslog restart command.
A Security rule to allow a syslog traffic to pass to/from the server may be required.
