RE: [evlog-dev] Program name issue

Hi Hien,

I used the syslog forwarder. The syslogat API needs to
be used within the application to make use of it's features.
That's good for new applications but I'm looking at gathering
the logs from existing OS applications (eg DHCP, NIS,NTP,Samba,etc)
from multiple servers to a central location (and I don't want to=20
touch their code!).=20
It's been decided that the syslog ident string is a piece of information
that's not acceptable to lose - hence we need it but still want=20
to use the full capabilities of evlog.

I've now started to look at adding an "ident=3D<tag>" attribute to
the log entry structure. Just curious if someone else has done this=20
(or wanted this) before ?

Regards,
Seo

-----Original Message-----
From: Hien Nguyen [mailto:[email protected]]=20
Sent: 30 October 2003 19:50
To: O'Riordain, Seosamh
Cc: [email protected]
Subject: Re: [evlog-dev] Program name issue


Hi Seo,

May I ask you how did you log the events to evlog? did they come from=20
syslogat api or you just turned on the syslog forwarder?

Notes: For more information about syslogat see man page for evlgentmpls.

Thanks, Hien.


O'Riordain, Seosamh wrote:
> Hi,
>=20
> I've been looking at using evlog as a replacement for syslog, and also

> for being a central log consolidator. Now it provides plenty of=20
> excellent features that I can and want to use. The only thing it=20
> doesn't provide compared to syslog, is the program
> name. See below, for a comparison in output of syslog and evlog
created=20
> by doing an rsh
> to a machine.
>=20
> /var/log/messages extract
> Oct 30 11:33:46 angel2 pam_rhosts_auth[27509]: allowed to root@angel3=20
> as
> root
> Oct 30 11:33:46 angel2 login(pam_unix)[27510]: session opened for user

> root by (uid=3D0)
> Oct 30 11:33:46 angel2 login -- root[27510]: ROOT LOGIN ON pts/1 FROM=20
> angel3
>=20
> evlview -n --syslog
> Oct 30 11:33:46 angel2 allowed to root@angel3 as root
> Oct 30 11:33:46 angel2 session opened for user root by (uid=3D0) Oct =
30=20
> 11:33:46 angel2 ROOT LOGIN ON pts/1 FROM angel3
>=20
> On the central log server, when viewing the logs for this host=20
> (current
> or archived) one would
> not be able to tell what program caused these or whether one used rsh
or=20
> some other login mechanism,
> say ssh.
>=20
> My questions become, was this a deliberate decision not to provide the
> program name
> in evlog ?
> What would it take to provide this functionality ?
> Thanks.
>=20
> /Regards/Seo
>=20




-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?   SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/