login about faq

Hello,

I have Tectia Server 6.3.4 on Sun10. I am trying to increase event logging on the server by redirecting some auth logs to the local facility. I cannot bounce the server deliberately as it provides gateway access to hundreds of clients, so I've simply reloaded the configuration. However I cannot see the events I've added being logged. That's my change to ssh-server-config.xml:

<log-events facility="local" severity="informational">
Auth_methods_completed Servant_client_debug
</log-events>

<log-events facility="local" severity="notice">
Servant_client_verbose
</log-events>

My syslog.conf has:

*.err;kern.debug;daemon.notice;local;mail.crit        /var/adm/messages

I've used Appendix D Audit Messages as reference. I have also tried changing the facility to daemon, still no luck. Am I doing anything wrong or is it something that will be only applied if I bounce the server?

Thanks.

asked Mar 09 '16 at 16:16

fmattos's gravatar image

fmattos
21448

edited Apr 19 at 21:54

Joe%20-%20Tectia%20Support's gravatar image

Joe - Tectia Support ♦♦
55215


I've managed to solve it myself. The logging facility has to match it all from syslog.conf; it does not know what 'informational' means, instead it uses LOG_INFO you need to either add informational to syslog.conf or change the severity on the config file. I've gone by using a different severity, as syslog.conf would be considered an OS change and I'll had to do it corporate widely or nothing. Finished up with:

<log-events facility="local" severity="info">
Auth_methods_completed Servant_client_debug
</log-events>

<log-events facility="local" severity="info">
Servant_client_verbose
</log-events>
link

answered Apr 13 '16 at 23:37

fmattos's gravatar image

fmattos
21448

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or __italic__
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×30
×12
×11
×5

Asked: Mar 09 '16 at 16:16

Seen: 4,895 times

Last updated: Apr 19 at 21:54

All user contributed content licensed under the cc-by-sa license.
Powered by OSQA.