1. Syslogd Tracking system events

2. Log servers Applications are constantly encountering events which should be recorded –users attempt to login with bad passwords –servers can’t properly start –disk runs out of space –and others Many system servers are written to post messages to a log server for later analysis

3. Issues of managing a log server What messages are stored How long to store them Where should they be stored for access How are the logs backed up / recycled Should the server function for a network or a machine

4. Syslog Primarily handles system messages Classifies messages according –to the source –to the severity Stores in files according to a configuration file Usually stores in /var/log Can redirect messages to –another machine –a device like a console

5. Source subsystems auth authpriv, cron, daemon, kern, lpr, mail, mark, news, security (same as auth), syslog, user, uucp and local0 through local7.

6. Message priorities panic (same as emerg), emerg, alert, crit, err, error (same as err), warning, warn (same as warning), notice, info, debug lower higher

7. Example scenario User enters bad password Authentication server syslogd syslog.conf auth.notice /var/log/messages # from /etc/syslog.conf... auth.info /var/log/messages

8. syslogd syslog.conf auth.notice /var/log/messages mail.warn /var/log/mail.warn network remote server Other scenarios

9. syslog.conf format facility.priority destination format logs this level and higher priority facility.=priority destination format logs ONLY this level facility.!priority destination format logs NOT this level and higher priority (but all below) facility.!=priority destination format logs NOT this level but ALL OTHER LEVELS

10. syslog.conf example # Kernel messages are first, stored in the kernel # file, critical messages and higher ones also go # to another host and to the console # kern.* /var/adm/kernel kern.crit @finlandia kern.crit /dev/console kern.info;kern.!err /var/adm/kernel-info (info thru warning)

11. Feb 10 17:24:58 testserver sshd[5616]: Could not reverse map address 192.168.2.2. Feb 10 17:24:59 testserver sshd[5616]: Accepted password for dgame from 192.168.2.2 port 1186 ssh2 Feb 10 17:25:00 testserver sshd(pam_unix)[5618]: session opened for user dgame by (uid=501) Feb 10 17:25:05 testserver su(pam_unix)[5655]: session opened for user root by dgame(uid=501) EXAMPLE LOG FILE info -> auth.log