Remote syslog

[xerazor]

Hi!

Im trying to do logging from a bunch of machines to a Solaris 8 machine acting as a syslog server.

On the server I would like to put logs in specific local/log depending on the client type.

For instance:
Local0 = Unix machines
Local1 = Extreme Switches
Local2 = Cisco Switches

The problem I'm having is that I don't know how to send all information from a specific UNIX machine to Local0 on the syslog server.

Can someone help me?


//X

Steal a little and they throw you in jail, steal a lot and they make you king

 

[xenia123]

Hi

you can write a cron job, which sends you the information included in a file (e.g called syslog) on the client to you syslog server via ftp. Sure, it's a security question, because the password is sent in cleartext..

#!/bin/sh

cd /home/ftp/
ftp -inv <<!
open [ipsyslogserver]
user [username] [userpassword]
bin
put syslog
exit

other wise you can use rsync over ssh its pretty secure - it uses public keys to crypt. As long as you keep your private key secure it's extremly difficult to break this stuff...

Hope that I could help you..

greetings
xenia

 

[xenia123]

details for configuring rsync and ssh:

http://www.jdmz.net/ssh/

 

[huebs]

Standard syslog can't filter by source client. I would investigate syslog-ng (

http://www.balabit.com/products/syslog_ng/),

which has lots of filter options. The drawback is, that you have to replace the original solaris syslog.