syslog daemon, running on SecurePlatform OS (and most Linux based OS's) handles most of the Operating System logging. This daemon uses the
/etc/syslog.conf file for configuration and handles all messages sent to it on UDP 0.0.0.0:514
syslog message facility and priority, the
syslog.conf file defines how each
syslog message is handled, then determines where this message is written locally or to what remote IP address it should be sent.
authpriv.* <TAB> /var/log/secure
authpriv" is the facility.
"." - delimits the facility from the priority.
"*" - means all priorities.
There must be a <TAB> between the selector section (facility.priority) and the action section on each line.
/var/log/secure" is the file that the messages are written to.
*.info;authpriv.none;cron.none;local5.none <TAB> @10.0.0.1
The selector section states, all facilities (except
authpriv, cron and
local5) with a priority of at least info or higher.
Send them via UDP:514 to IP address 10.0.0.1.
If you want to send syslogs to multiple servers, repeat the command from Example 2 to a different server.
When defining the priority, it will include the defined level and anything higher. Number of lines does not matter, each message is processed by each line separately.
Any time a change is made to the
/etc/syslog.conf file, the
syslog daemon should be restarted. To do so, run the
service syslog restart command.
A Security rule to allow a
syslog traffic to pass to/from the server may be required.