RE: Consolidate logwatch message from all servers to 1 server

Hi. Thanks,

I got it remote logging working now,  but I have the following problem

I have the following entries local2,3,4 in my syslog.conf that accept the logging from my Cisco
device, but local2,3,4.warn log will go into /var/log/messages as well.  As *.info include *.warn
too

*.info;mail.none;authpriv.none;cron.none;               /var/log/messages
local2.warn                                               /var/log/local2
local3.warn                                               /var/log/local3
local4.warn                                               /var/log/local4

May I know how to exclude the local.2,3,4.warn in /var/log/messages ?


--- "Sharpe, Sam J" <sam.sharpe-AQ/[email protected]> wrote:

> > -----Original Message-----
> > From: [email protected] 
> > [mailto:[email protected]] On Behalf Of Leuy Eeelyu
> > Sent: 15 June 2006 10:07
> > 
> > > 2) setup the clients to syslog to remote server
> > > 
> > > To set machines to log centrally, edit /etc/syslog.conf and 
> > add a line
> > > like:
> > > *.info @logmachine.example.com
> > 
> > 
> > Hi ALL.. I am sorry to ask again, I had create a hostname of 
> > abc.mycompany.com to map to the logserver IP 10.10.10.10 for 
> > example in /etc/hosts
> > 
> > and in /etc/syslog.conf
> > I have this 
> > *.info;mail.none;authpriv.none;cron.none                
> > @abc.mycompany.com
> 
> That looks good (but is it on one line?) - my original email got folded
> and so did yours.
> 
> > And in the logserver, I have added SYSLOGD_OPTIONS="-m 0 -r" 
> > in /etc/sysconfig/syslog and restart syslog in client and server
> > 
> > But I don't see any connection from client to logserver at 
> > all and also no log is recorded in the logserver.  Anything wrong?
> 
> Is there a firewall on your logserver? Try turning it off - or opening
> port 514 for UDP.
> 
> > Besides, I want to know what is the file location on the 
> > logserver that the client will log to ? 
> > in the client's /etc/syslog.conf, it has @abc.mycompany.com 
> > but it did not specify what file location in logserver.  
> 
> Ahh, now this is the problem. On your server, ALL the log messages will
> be consolidated in your usual locations. So if your sshd login messages
> on the server go to /var/log/secure, all the sshd login messages on the
> clients will go to the server's /var/log/secure. This is the limitation
> we found with the standard syslogd - you can't separate logs by
> hostname.
> 
> If you install syslog-ng you can do groovy things in
> /etc/syslog-ng/syslog-ng.conf like:
> 
> destination logpile {
>   file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"
>   owner(root) group(root) perm(0600)
>   create_dirs(yes) dir_perm(0700)); };
> 
> log { source(s_sys); destination(logpile); };
> 
> And that will separate out your log messages on a per-host/per-time
> basis. You can also configure multiple destinations so we also have a
> massive "everything" log that gets rotated regularly but is not
> separated by hostname. This is the log that logwatch or swatch parses
> for all the messages from all the machines.
> 
> destination everything {
>   file("/var/log/everything" owner(root) group(root) perm(0644)); };
> log { source(s_sys); destination(everything); };
> 
> Hope that helps,
> 
> Sam
> 
> --
> Taroon-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/taroon-list
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

--
Taroon-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/taroon-list