Support Center > Search Results > SecureKnowledge Details
How to configure syslog daemon on SecurePlatform OS
Solution

The syslog daemon, running on SecurePlatform OS (and most Linux based OS's) handles most of the Operating System logging. This daemon uses the /etc/syslog.conf file for configuration and handles all messages sent to it on UDP 0.0.0.0:514

Based on syslog message facility and priority, the syslog.conf file defines how each syslog message is handled, then determines where this message is written locally or to what remote IP address it should be sent.

Name Facility
kern Kernel
user Regular user processes
mail Mail system
lpr Line printer system
auth (authpriv) Authorization system, or programs that ask for
user names and passwords (login, su, getty, ftpd, etc.)
daemon Other system daemons
news News subsystem
uucp UUCP subsystem
local0... local7 Reserved for site-specific use

 

Priority Meaning
emerg Emergency condition, such as an imminent system crash, usually broadcast to all users
alert Condition that should be corrected immediately, such as a corrupted system database
crit Critical condition, such as a hardware error
err Ordinary error
warning Warning
notice Condition that is not an error, but possibly should be handled in a special way
info Informational message
debug Messages that are used when debugging programs
none Do not send messages from the indicated facility to the selected file.

 

Example 1:

authpriv.* <TAB> /var/log/secure

"authpriv" is the facility. 
"." - delimits the facility from the priority.
"*" - means all priorities.
There must be a <TAB> between the selector section (facility.priority) and the action section on each line.
"/var/log/secure" is the file that the messages are written to.

 

 

Example 2:

*.info;authpriv.none;cron.none;local5.none <TAB> @10.0.0.1

The selector section states, all facilities (except authpriv, cron and local5) with a priority of at least info or higher.
Send them via UDP:514 to IP address 10.0.0.1.

If you want to send syslogs to multiple servers, repeat the command from Example 2 to a different server.


Note:
When defining the priority, it will include the defined level and anything higher. Number of lines does not matter, each message is processed by each line separately.
Any time a change is made to the /etc/syslog.conf file, the syslog daemon should be restarted. To do so, run the service syslog restart command.
A Security rule to allow a syslog traffic to pass to/from the server may be required.

Give us Feedback
Please rate this document
[1=Worst,5=Best]
Comment