Panther as syslog server???

telmxp1 · 11-03-2003, 05:07 PM

I used to have my Jaguar system setup as a syslog server - where our network devices would send their syslog messages to it. However, once I upgraded to panther, this is no longer working.

I seem to remember it being a little difficult to get Jaguar to receive syslog messages on 514/UDP, but it was possibly by editing the /system/library/startupitems/systemlog/systemlog file. You would basically change the line that says "syslogd" to read "syslogd -u".

I can't seem to find this anywhere in Panther!!! The ssages on 514/UDP, but it was possibly by editing the /system/library/startupitems/systemlog/systemlog file just has #!/bin/sh exit 0

When I look at my running processes I see syslogd with the -s -w 0 switches.

How can I change syslogd to run in "insecure" mode and listen on UDP 514?

I appreciate any assistance.

M

mervTormel · 11-03-2003, 06:47 PM

$ grep syslog /etc/rc*
/etc/rc:# Logs are important. Start syslogd after the boot disk becomes r/w but before
/etc/rc:/usr/sbin/syslogd -s -m 0

stetner · 11-27-2003, 06:12 PM

I emailed this to another list

Quote:


	Yet another quick note on syslogd. case 'u': /* only log specified priority / UniquePriority++; break; and static int UniquePriority = 0; / Only log specified priority? */ (got to love that question mark at the end...) So the 'u' is not insecure mode either any more. So now I use: /usr/sbin/syslogd -m 15 For the record: static void usage(void) { fprintf(stderr, "%s\n%s\n%s\n%s\n", "usage: syslogd [-46Acdknosuv] [-a allowed_peer]", " [-b bind address] [-f config_file]", " [-l log_socket] [-m mark_interval]", " [-P pid_file] [-p log_socket]"); exit(1); }

So, the '-s' flag turns on secure, if it is not there it is in insecure mode and the -u does some weird unique priority that I have not taken the time to figure out.

The current man page does NOT match what the source code is doing. I have filed a radar (bug) on this.

teknovision · 10-18-2004, 12:49 PM

Folks,

Total newbie here.. .

I would like syslog to be sent from a Watchguard SOHO firewall to my G3 running 10.2 - G3 is located on another network and was thinking of connecting via dyndns.org address. How can i get my G3 to accept syslogs and where will it put them?

Many thanks for any help you can provide?

./phil

stetner · 10-20-2004, 09:07 PM

Just start it like this:

/usr/sbin/syslogd -m 15

and it will accept logs from anywhere.

I do not know how to set your particular router to forward to your mac though. There should be a 'syslog host' setting somewhere.

teknovision · 10-26-2004, 07:23 PM

Thanks for your help!

I did as you said (+ set the Airport to Send Syslog to Debug level to the my G3) however, cannot find any syslogs in /var/log/. My airport express freezed today - had to restart so I was hoping to find some syslogs in that folder, what file am I looking for anyway (very green here)?

Many thanks for any help you can offer in my first steps in syslogging!

.//phil

yellow · 10-26-2004, 09:14 PM

/var/log/system.log = syslog on other *NIX

11-03-2003, 05:07 PM	#1
telmxp1 Prospect Join Date: Nov 2003 Posts: 5	Panther as syslog server??? I used to have my Jaguar system setup as a syslog server - where our network devices would send their syslog messages to it. However, once I upgraded to panther, this is no longer working. I seem to remember it being a little difficult to get Jaguar to receive syslog messages on 514/UDP, but it was possibly by editing the /system/library/startupitems/systemlog/systemlog file. You would basically change the line that says "syslogd" to read "syslogd -u". I can't seem to find this anywhere in Panther!!! The ssages on 514/UDP, but it was possibly by editing the /system/library/startupitems/systemlog/systemlog file just has #!/bin/sh exit 0 When I look at my running processes I see syslogd with the -s -w 0 switches. How can I change syslogd to run in "insecure" mode and listen on UDP 514? I appreciate any assistance. M

10-18-2004, 12:49 PM	#4
teknovision Triple-A Player Join Date: Apr 2002 Location: London, UK Posts: 149	Newbie here Folks, Total newbie here.. . I would like syslog to be sent from a Watchguard SOHO firewall to my G3 running 10.2 - G3 is located on another network and was thinking of connecting via dyndns.org address. How can i get my G3 to accept syslogs and where will it put them? Many thanks for any help you can provide? ./phil

10-20-2004, 09:07 PM	#5
stetner MVP Join Date: Jan 2002 Location: Brisbane, Australia Posts: 1,108	Just start it like this: /usr/sbin/syslogd -m 15 and it will accept logs from anywhere. I do not know how to set your particular router to forward to your mac though. There should be a 'syslog host' setting somewhere. __________________ Douglas G. Stetner UNIX Live Free Or Die

10-26-2004, 07:23 PM	#6
teknovision Triple-A Player Join Date: Apr 2002 Location: London, UK Posts: 149	No Syslogs Thanks for your help! I did as you said (+ set the Airport to Send Syslog to Debug level to the my G3) however, cannot find any syslogs in /var/log/. My airport express freezed today - had to restart so I was hoping to find some syslogs in that folder, what file am I looking for anyway (very green here)? Many thanks for any help you can offer in my first steps in syslogging! .//phil

11-03-2003, 06:47 PM	#2
mervTormel League Commissioner Join Date: Jan 2002 Posts: 5,536	$ grep syslog /etc/rc* /etc/rc:# Logs are important. Start syslogd after the boot disk becomes r/w but before /etc/rc:/usr/sbin/syslogd -s -m 0

10-26-2004, 09:14 PM	#7
yellow Moderator Join Date: Jan 2002 Posts: 10,677	/var/log/system.log = syslog on other *NIX