Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: RSyslog: users

authpriv.* facility support in Solaris Rsyslog

 

 

RSyslog users RSS feed   Index | Next | Previous | View Threaded


Ayelet.Regev at comverse

Sep 13, 2012, 4:33 AM

Post #1 of 22 (415 views)
Permalink
authpriv.* facility support in Solaris Rsyslog

Hi,

I am currently using syslog on solaris server and they don't support authpriv.* facility.
They recommended us to try 3rd party.

Does rsyslog on Solaris support this facility? From what version?


Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse<mailto:shahar.biron [at] comverse>
www.comverse.com<http://www.comverse.com/>




________________________________
"This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You."
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


Ayelet.Regev at comverse

Sep 13, 2012, 6:25 AM

Post #2 of 22 (402 views)
Permalink
authpriv.* facility support in Solaris Rsyslog [In reply to]

Hi,

I am currently using syslog on solaris server and they don't support authpriv.* facility.
They recommended us to try 3rd party.

Does rsyslog on Solaris support this facility? From what version?


Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse<mailto:shahar.biron [at] comverse>
www.comverse.com<http://www.comverse.com/>




________________________________
"This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You."
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


david at lang

Sep 13, 2012, 12:31 PM

Post #3 of 22 (399 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

On Thu, 13 Sep 2012, Regev Ayelet wrote:

> Hi,
>
> I am currently using syslog on solaris server and they don't support authpriv.* facility.
> They recommended us to try 3rd party.
>
> Does rsyslog on Solaris support this facility? From what version?

I'm pretty sure that it's supported it from the beginning, but rsyslog has
only supported Solaris fairly recently.

If you install rsyslog version 5.x or 6.x (the currently supported stable
versions), you should be in good shape.

As always, test and report any problems before planning a major project :)

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


Ayelet.Regev at comverse

Sep 19, 2012, 2:10 AM

Post #4 of 22 (399 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

smu80a:/ ROOT > logger -p "authpriv.debug" lala
logger: unknown facility name: authpriv
smu80a:/ ROOT >
smu80a:/ ROOT >
smu80a:/ ROOT > ps -ef | grep -i rsys
root 376 1 0 Aug 29 ? 1:47 /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-server.pid -f /etc/rsy
root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys


smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-pid="17012" x-info="http://www.rsyslog.com"] (re)start
rsyslogd:WARNING: rsyslogd is running in compatibility mode. Automatically generated config directives may interfer with your rsyslog.conf settings. We suggest upgrading your config and adding -c4 as the first rsyslogd option.
rsyslogd-2013:CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config file!
rsyslogd:Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad immark
rsyslogd:Warning: backward compatibility layer added to following directive to rsyslog.conf: MarkMessagePeriod 1200
rsyslogd:Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad imuxsock


Do I need newer version of Rsyslog to be compiled?



Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of david [at] lang
Sent: Thursday, September 13, 2012 10:31 PM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

On Thu, 13 Sep 2012, Regev Ayelet wrote:

> Hi,
>
> I am currently using syslog on solaris server and they don't support authpriv.* facility.
> They recommended us to try 3rd party.
>
> Does rsyslog on Solaris support this facility? From what version?

I'm pretty sure that it's supported it from the beginning, but rsyslog has
only supported Solaris fairly recently.

If you install rsyslog version 5.x or 6.x (the currently supported stable
versions), you should be in good shape.

As always, test and report any problems before planning a major project :)

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


rgerhards at hq

Sep 19, 2012, 2:23 AM

Post #5 of 22 (394 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Wednesday, September 19, 2012 11:10 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> smu80a:/ ROOT > logger -p "authpriv.debug" lala
> logger: unknown facility name: authpriv

FYI: logger is not part of rsyslog.
Rainer
> smu80a:/ ROOT >
> smu80a:/ ROOT >
> smu80a:/ ROOT > ps -ef | grep -i rsys
> root 376 1 0 Aug 29 ? 1:47
> /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-server.pid -f
> /etc/rsy
> root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
>
>
> smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-pid="17012"
> x-info="http://www.rsyslog.com"] (re)start
> rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> Automatically generated config directives may interfer with your
> rsyslog.conf settings. We suggest upgrading your config and adding -c4
> as the first rsyslogd option.
> rsyslogd-2013:CONFIG ERROR: could not interpret master config file
> '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config file!
> rsyslogd:Warning: backward compatibility layer added to following
> directive to rsyslog.conf: ModLoad immark
> rsyslogd:Warning: backward compatibility layer added to following
> directive to rsyslog.conf: MarkMessagePeriod 1200
> rsyslogd:Warning: backward compatibility layer added to following
> directive to rsyslog.conf: ModLoad imuxsock
>
>
> Do I need newer version of Rsyslog to be compiled?
>
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of david [at] lang
> Sent: Thursday, September 13, 2012 10:31 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> On Thu, 13 Sep 2012, Regev Ayelet wrote:
>
> > Hi,
> >
> > I am currently using syslog on solaris server and they don't support
> authpriv.* facility.
> > They recommended us to try 3rd party.
> >
> > Does rsyslog on Solaris support this facility? From what version?
>
> I'm pretty sure that it's supported it from the beginning, but rsyslog
> has
> only supported Solaris fairly recently.
>
> If you install rsyslog version 5.x or 6.x (the currently supported
> stable
> versions), you should be in good shape.
>
> As always, test and report any problems before planning a major project
> :)
>
> David Lang
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


Ayelet.Regev at comverse

Sep 19, 2012, 3:35 AM

Post #6 of 22 (385 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

How can I test the facility support of authpriv without logger?

Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Rainer Gerhards
Sent: Wednesday, September 19, 2012 12:23 PM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog



> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Wednesday, September 19, 2012 11:10 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> smu80a:/ ROOT > logger -p "authpriv.debug" lala
> logger: unknown facility name: authpriv

FYI: logger is not part of rsyslog.
Rainer
> smu80a:/ ROOT >
> smu80a:/ ROOT >
> smu80a:/ ROOT > ps -ef | grep -i rsys
> root 376 1 0 Aug 29 ? 1:47
> /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-server.pid -f
> /etc/rsy
> root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
>
>
> smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-pid="17012"
> x-info="http://www.rsyslog.com"] (re)start
> rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> Automatically generated config directives may interfer with your
> rsyslog.conf settings. We suggest upgrading your config and adding -c4
> as the first rsyslogd option.
> rsyslogd-2013:CONFIG ERROR: could not interpret master config file
> '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config file!
> rsyslogd:Warning: backward compatibility layer added to following
> directive to rsyslog.conf: ModLoad immark
> rsyslogd:Warning: backward compatibility layer added to following
> directive to rsyslog.conf: MarkMessagePeriod 1200
> rsyslogd:Warning: backward compatibility layer added to following
> directive to rsyslog.conf: ModLoad imuxsock
>
>
> Do I need newer version of Rsyslog to be compiled?
>
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of david [at] lang
> Sent: Thursday, September 13, 2012 10:31 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> On Thu, 13 Sep 2012, Regev Ayelet wrote:
>
> > Hi,
> >
> > I am currently using syslog on solaris server and they don't support
> authpriv.* facility.
> > They recommended us to try 3rd party.
> >
> > Does rsyslog on Solaris support this facility? From what version?
>
> I'm pretty sure that it's supported it from the beginning, but rsyslog
> has
> only supported Solaris fairly recently.
>
> If you install rsyslog version 5.x or 6.x (the currently supported
> stable
> versions), you should be in good shape.
>
> As always, test and report any problems before planning a major project
> :)
>
> David Lang
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


rgerhards at hq

Sep 19, 2012, 3:38 AM

Post #7 of 22 (387 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

> How can I test the facility support of authpriv without logger?

You can use rsyslog's tool tcpflood with a specifically-crafted message. Small doc at

http://www.rsyslog.com/how-to-use-tcpflood/

Or you could use the actual application you plan to use.

Rainer
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Wednesday, September 19, 2012 12:23 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
>
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Wednesday, September 19, 2012 11:10 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> > logger: unknown facility name: authpriv
>
> FYI: logger is not part of rsyslog.
> Rainer
> > smu80a:/ ROOT >
> > smu80a:/ ROOT >
> > smu80a:/ ROOT > ps -ef | grep -i rsys
> > root 376 1 0 Aug 29 ? 1:47
> > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-server.pid -
> f
> > /etc/rsy
> > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
> >
> >
> > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> pid="17012"
> > x-info="http://www.rsyslog.com"] (re)start
> > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> > Automatically generated config directives may interfer with your
> > rsyslog.conf settings. We suggest upgrading your config and adding -
> c4
> > as the first rsyslogd option.
> > rsyslogd-2013:CONFIG ERROR: could not interpret master config file
> > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config
> file!
> > rsyslogd:Warning: backward compatibility layer added to following
> > directive to rsyslog.conf: ModLoad immark
> > rsyslogd:Warning: backward compatibility layer added to following
> > directive to rsyslog.conf: MarkMessagePeriod 1200
> > rsyslogd:Warning: backward compatibility layer added to following
> > directive to rsyslog.conf: ModLoad imuxsock
> >
> >
> > Do I need newer version of Rsyslog to be compiled?
> >
> >
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of david [at] lang
> > Sent: Thursday, September 13, 2012 10:31 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> >
> > > Hi,
> > >
> > > I am currently using syslog on solaris server and they don't
> support
> > authpriv.* facility.
> > > They recommended us to try 3rd party.
> > >
> > > Does rsyslog on Solaris support this facility? From what version?
> >
> > I'm pretty sure that it's supported it from the beginning, but
> rsyslog
> > has
> > only supported Solaris fairly recently.
> >
> > If you install rsyslog version 5.x or 6.x (the currently supported
> > stable
> > versions), you should be in good shape.
> >
> > As always, test and report any problems before planning a major
> project
> > :)
> >
> > David Lang
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


Ayelet.Regev at comverse

Sep 19, 2012, 3:58 AM

Post #8 of 22 (388 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

RHEL 6 authentication is being logged with "authpriv.debug", it is shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 + Rsyslog 4.7.4...

Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Rainer Gerhards
Sent: Wednesday, September 19, 2012 1:38 PM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

> How can I test the facility support of authpriv without logger?

You can use rsyslog's tool tcpflood with a specifically-crafted message. Small doc at

http://www.rsyslog.com/how-to-use-tcpflood/

Or you could use the actual application you plan to use.

Rainer
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Wednesday, September 19, 2012 12:23 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
>
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Wednesday, September 19, 2012 11:10 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> > logger: unknown facility name: authpriv
>
> FYI: logger is not part of rsyslog.
> Rainer
> > smu80a:/ ROOT >
> > smu80a:/ ROOT >
> > smu80a:/ ROOT > ps -ef | grep -i rsys
> > root 376 1 0 Aug 29 ? 1:47
> > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-server.pid -
> f
> > /etc/rsy
> > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
> >
> >
> > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> pid="17012"
> > x-info="http://www.rsyslog.com"] (re)start
> > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> > Automatically generated config directives may interfer with your
> > rsyslog.conf settings. We suggest upgrading your config and adding -
> c4
> > as the first rsyslogd option.
> > rsyslogd-2013:CONFIG ERROR: could not interpret master config file
> > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config
> file!
> > rsyslogd:Warning: backward compatibility layer added to following
> > directive to rsyslog.conf: ModLoad immark
> > rsyslogd:Warning: backward compatibility layer added to following
> > directive to rsyslog.conf: MarkMessagePeriod 1200
> > rsyslogd:Warning: backward compatibility layer added to following
> > directive to rsyslog.conf: ModLoad imuxsock
> >
> >
> > Do I need newer version of Rsyslog to be compiled?
> >
> >
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of david [at] lang
> > Sent: Thursday, September 13, 2012 10:31 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> >
> > > Hi,
> > >
> > > I am currently using syslog on solaris server and they don't
> support
> > authpriv.* facility.
> > > They recommended us to try 3rd party.
> > >
> > > Does rsyslog on Solaris support this facility? From what version?
> >
> > I'm pretty sure that it's supported it from the beginning, but
> rsyslog
> > has
> > only supported Solaris fairly recently.
> >
> > If you install rsyslog version 5.x or 6.x (the currently supported
> > stable
> > versions), you should be in good shape.
> >
> > As always, test and report any problems before planning a major
> project
> > :)
> >
> > David Lang
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


rgerhards at hq

Sep 19, 2012, 4:00 AM

Post #9 of 22 (385 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

> RHEL 6 authentication is being logged with "authpriv.debug", it is
> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
> Rsyslog 4.7.4...

Sorry, I don't get what you mean...
Rainer
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Wednesday, September 19, 2012 1:38 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> > How can I test the facility support of authpriv without logger?
>
> You can use rsyslog's tool tcpflood with a specifically-crafted
> message. Small doc at
>
> http://www.rsyslog.com/how-to-use-tcpflood/
>
> Or you could use the actual application you plan to use.
>
> Rainer
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > Sent: Wednesday, September 19, 2012 12:23 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> >
> >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > > Sent: Wednesday, September 19, 2012 11:10 AM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> > > logger: unknown facility name: authpriv
> >
> > FYI: logger is not part of rsyslog.
> > Rainer
> > > smu80a:/ ROOT >
> > > smu80a:/ ROOT >
> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> > > root 376 1 0 Aug 29 ? 1:47
> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-server.pid
> -
> > f
> > > /etc/rsy
> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
> > >
> > >
> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> > pid="17012"
> > > x-info="http://www.rsyslog.com"] (re)start
> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> > > Automatically generated config directives may interfer with your
> > > rsyslog.conf settings. We suggest upgrading your config and adding
> -
> > c4
> > > as the first rsyslogd option.
> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config file
> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config
> > file!
> > > rsyslogd:Warning: backward compatibility layer added to following
> > > directive to rsyslog.conf: ModLoad immark
> > > rsyslogd:Warning: backward compatibility layer added to following
> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> > > rsyslogd:Warning: backward compatibility layer added to following
> > > directive to rsyslog.conf: ModLoad imuxsock
> > >
> > >
> > > Do I need newer version of Rsyslog to be compiled?
> > >
> > >
> > >
> > > Ayelet Regev-Dabah
> > > System Software Platform TL
> > > Comverse
> > > Office: +972 3 6459362
> > > ayelet.regev [at] comverse
> > > www.comverse.com
> > >
> > >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of david [at] lang
> > > Sent: Thursday, September 13, 2012 10:31 PM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> > >
> > > > Hi,
> > > >
> > > > I am currently using syslog on solaris server and they don't
> > support
> > > authpriv.* facility.
> > > > They recommended us to try 3rd party.
> > > >
> > > > Does rsyslog on Solaris support this facility? From what version?
> > >
> > > I'm pretty sure that it's supported it from the beginning, but
> > rsyslog
> > > has
> > > only supported Solaris fairly recently.
> > >
> > > If you install rsyslog version 5.x or 6.x (the currently supported
> > > stable
> > > versions), you should be in good shape.
> > >
> > > As always, test and report any problems before planning a major
> > project
> > > :)
> > >
> > > David Lang
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > >
> > > "This e-mail message may contain confidential, commercial or
> > privileged
> > > information that constitutes proprietary information of Comverse
> > > Technology or its subsidiaries. If you are not the intended
> recipient
> > > of this message, you are hereby notified that any review, use or
> > > distribution of this information is absolutely prohibited and we
> > > request that you delete all copies and contact us by e-mailing to:
> > > security [at] comverse Thank You."
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


Ayelet.Regev at comverse

Sep 19, 2012, 4:35 AM

Post #10 of 22 (409 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

I have few systems here:

RHEL 6 client with rsyslogd 3.22.1as client configured to send to remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)

This is the client configuration of RHEL6:


[root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
$ModLoad immark
$MarkMessagePeriod 3600
$ActionFileEnableSync on
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$ModLoad imuxsock
$ModLoad imklog
*.info;mail.none;authpriv.none;cron.none /var/log/messages
auth,authpriv.* /var/log/secure
mail.* /var/log/maillog
cron.* /var/log/cron
$WorkDirectory /var/spool/rsyslog # default location for work (spool) files
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd # set file name, also enables disk mode
$ActionQueueHighWaterMark 8000 # Default
$ActionQueueLowWaterMark 2000 # Default
$ActionQueueMaxFileSize 10m # Default is 1m
$ActionQueueMaxDiskSpace 8g
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
local0,auth,authpriv.debug @@syslogServer:50514
mail.emerg @@syslogServer:50514
local4.debug @@syslogServer:50514
*.emerg;mail.none *



Authpriv.info is written to /var/log/secure locally and send to syslog server for remote logging.
(RHEL5 clients used auth.info, RHEL6 uses authpriv.info)

When the syslogserver is Linux system the authpriv.* events are written correctly.
When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events are not recorded at all. (other facilities are recorded to log files)


Linux server configuration file:
-----------------------------------------

[root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
$ModLoad immark
$MarkMessagePeriod 3600
$ActionFileEnableSync on
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$ModLoad imklog
$ModLoad imudp
$UDPServerRun 514
$UDPServerRun 1514
$ModLoad imtcp
$InputTCPServerRun 50514
user,daemon,uucp,cron,mark.notice;kern.debug /var/log/messages
*.emerg;mail.none *
auth,authpriv.debug /var/log/central/auth.debug
mail.emerg /var/log/central/MIPSlog
local0.debug /var/log/central/local0.debug
local4.debug /var/log/central/traceall
local1.debug /var/log/central/hbase



Solaris 10 Configuration file:
----------------------------------

smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
$ModLoad immark
$ModLoad imsolaris
$MarkMessagePeriod 3600
$ActionFileEnableSync on
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$ModLoad imklog
$ModLoad imudp
$UDPServerRun 514
$UDPServerRun 1514
$ModLoad imtcp
$InputTCPServerRun 50514

user,daemon,uucp,cron,mark.notice /var/adm/messages
*.emerg;mail.none *
kern.debug /var/adm/messages
auth.debug /var/log/central/auth.debug
authpriv.debug /var/log/central/auth.debug
mail.emerg /var/log/central/MIPSlog
local0.debug /var/log/central/local0.debug
local4.debug /var/log/central/traceall
local6.debug /var/cti/logs/SDT/SDT_Audit_Information.log





Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Rainer Gerhards
Sent: Wednesday, September 19, 2012 2:01 PM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

> RHEL 6 authentication is being logged with "authpriv.debug", it is
> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
> Rsyslog 4.7.4...

Sorry, I don't get what you mean...
Rainer
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Wednesday, September 19, 2012 1:38 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> > How can I test the facility support of authpriv without logger?
>
> You can use rsyslog's tool tcpflood with a specifically-crafted
> message. Small doc at
>
> http://www.rsyslog.com/how-to-use-tcpflood/
>
> Or you could use the actual application you plan to use.
>
> Rainer
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > Sent: Wednesday, September 19, 2012 12:23 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> >
> >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > > Sent: Wednesday, September 19, 2012 11:10 AM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> > > logger: unknown facility name: authpriv
> >
> > FYI: logger is not part of rsyslog.
> > Rainer
> > > smu80a:/ ROOT >
> > > smu80a:/ ROOT >
> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> > > root 376 1 0 Aug 29 ? 1:47
> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-server.pid
> -
> > f
> > > /etc/rsy
> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
> > >
> > >
> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> > pid="17012"
> > > x-info="http://www.rsyslog.com"] (re)start
> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> > > Automatically generated config directives may interfer with your
> > > rsyslog.conf settings. We suggest upgrading your config and adding
> -
> > c4
> > > as the first rsyslogd option.
> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config file
> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config
> > file!
> > > rsyslogd:Warning: backward compatibility layer added to following
> > > directive to rsyslog.conf: ModLoad immark
> > > rsyslogd:Warning: backward compatibility layer added to following
> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> > > rsyslogd:Warning: backward compatibility layer added to following
> > > directive to rsyslog.conf: ModLoad imuxsock
> > >
> > >
> > > Do I need newer version of Rsyslog to be compiled?
> > >
> > >
> > >
> > > Ayelet Regev-Dabah
> > > System Software Platform TL
> > > Comverse
> > > Office: +972 3 6459362
> > > ayelet.regev [at] comverse
> > > www.comverse.com
> > >
> > >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of david [at] lang
> > > Sent: Thursday, September 13, 2012 10:31 PM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> > >
> > > > Hi,
> > > >
> > > > I am currently using syslog on solaris server and they don't
> > support
> > > authpriv.* facility.
> > > > They recommended us to try 3rd party.
> > > >
> > > > Does rsyslog on Solaris support this facility? From what version?
> > >
> > > I'm pretty sure that it's supported it from the beginning, but
> > rsyslog
> > > has
> > > only supported Solaris fairly recently.
> > >
> > > If you install rsyslog version 5.x or 6.x (the currently supported
> > > stable
> > > versions), you should be in good shape.
> > >
> > > As always, test and report any problems before planning a major
> > project
> > > :)
> > >
> > > David Lang
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > >
> > > "This e-mail message may contain confidential, commercial or
> > privileged
> > > information that constitutes proprietary information of Comverse
> > > Technology or its subsidiaries. If you are not the intended
> recipient
> > > of this message, you are hereby notified that any review, use or
> > > distribution of this information is absolutely prohibited and we
> > > request that you delete all copies and contact us by e-mailing to:
> > > security [at] comverse Thank You."
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


david at lang

Sep 19, 2012, 2:21 PM

Post #11 of 22 (407 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

One thing that you need to realize is that the facility names are just a
convienience, when the messages are sent over the wire, everything is
reduced to a number.

As a result, it's possible for one system to know something as one name
and another system to know it as a different name.

looking at the documentation for the perl module Net::Syslog, it looks
like authpriv and security are both facility 10, so if you use 'security'
instead of 'authpriv' on the rsyslog box you should get what you expect.

David Lang


On Wed, 19 Sep 2012, Regev Ayelet wrote:

> Date: Wed, 19 Sep 2012 14:35:01 +0300
> From: Regev Ayelet <Ayelet.Regev [at] comverse>
> Reply-To: rsyslog-users <rsyslog [at] lists>
> To: rsyslog-users <rsyslog [at] lists>
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> I have few systems here:
>
> RHEL 6 client with rsyslogd 3.22.1as client configured to send to remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
>
> This is the client configuration of RHEL6:
>
>
> [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> $ModLoad immark
> $MarkMessagePeriod 3600
> $ActionFileEnableSync on
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imuxsock
> $ModLoad imklog
> *.info;mail.none;authpriv.none;cron.none /var/log/messages
> auth,authpriv.* /var/log/secure
> mail.* /var/log/maillog
> cron.* /var/log/cron
> $WorkDirectory /var/spool/rsyslog # default location for work (spool) files
> $ActionQueueType LinkedList # use asynchronous processing
> $ActionQueueFileName srvrfwd # set file name, also enables disk mode
> $ActionQueueHighWaterMark 8000 # Default
> $ActionQueueLowWaterMark 2000 # Default
> $ActionQueueMaxFileSize 10m # Default is 1m
> $ActionQueueMaxDiskSpace 8g
> $ActionResumeRetryCount -1 # infinite retries on insert failure
> $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
> local0,auth,authpriv.debug @@syslogServer:50514
> mail.emerg @@syslogServer:50514
> local4.debug @@syslogServer:50514
> *.emerg;mail.none *
>
>
>
> Authpriv.info is written to /var/log/secure locally and send to syslog server for remote logging.
> (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
>
> When the syslogserver is Linux system the authpriv.* events are written correctly.
> When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events are not recorded at all. (other facilities are recorded to log files)
>
>
> Linux server configuration file:
> -----------------------------------------
>
> [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> $ModLoad immark
> $MarkMessagePeriod 3600
> $ActionFileEnableSync on
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imklog
> $ModLoad imudp
> $UDPServerRun 514
> $UDPServerRun 1514
> $ModLoad imtcp
> $InputTCPServerRun 50514
> user,daemon,uucp,cron,mark.notice;kern.debug /var/log/messages
> *.emerg;mail.none *
> auth,authpriv.debug /var/log/central/auth.debug
> mail.emerg /var/log/central/MIPSlog
> local0.debug /var/log/central/local0.debug
> local4.debug /var/log/central/traceall
> local1.debug /var/log/central/hbase
>
>
>
> Solaris 10 Configuration file:
> ----------------------------------
>
> smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> $ModLoad immark
> $ModLoad imsolaris
> $MarkMessagePeriod 3600
> $ActionFileEnableSync on
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imklog
> $ModLoad imudp
> $UDPServerRun 514
> $UDPServerRun 1514
> $ModLoad imtcp
> $InputTCPServerRun 50514
>
> user,daemon,uucp,cron,mark.notice /var/adm/messages
> *.emerg;mail.none *
> kern.debug /var/adm/messages
> auth.debug /var/log/central/auth.debug
> authpriv.debug /var/log/central/auth.debug
> mail.emerg /var/log/central/MIPSlog
> local0.debug /var/log/central/local0.debug
> local4.debug /var/log/central/traceall
> local6.debug /var/cti/logs/SDT/SDT_Audit_Information.log
>
>
>
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Wednesday, September 19, 2012 2:01 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
>> RHEL 6 authentication is being logged with "authpriv.debug", it is
>> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
>> Rsyslog 4.7.4...
>
> Sorry, I don't get what you mean...
> Rainer
>>
>> Ayelet Regev-Dabah
>> System Software Platform TL
>> Comverse
>> Office: +972 3 6459362
>> ayelet.regev [at] comverse
>> www.comverse.com
>>
>>
>> -----Original Message-----
>> From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> bounces [at] lists] On Behalf Of Rainer Gerhards
>> Sent: Wednesday, September 19, 2012 1:38 PM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>>
>> > How can I test the facility support of authpriv without logger?
>>
>> You can use rsyslog's tool tcpflood with a specifically-crafted
>> message. Small doc at
>>
>> http://www.rsyslog.com/how-to-use-tcpflood/
>>
>> Or you could use the actual application you plan to use.
>>
>> Rainer
>> > Ayelet Regev-Dabah
>> > System Software Platform TL
>> > Comverse
>> > Office: +972 3 6459362
>> > ayelet.regev [at] comverse
>> > www.comverse.com
>> >
>> >
>> > -----Original Message-----
>> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > bounces [at] lists] On Behalf Of Rainer Gerhards
>> > Sent: Wednesday, September 19, 2012 12:23 PM
>> > To: rsyslog-users
>> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>> >
>> >
>> >
>> > > -----Original Message-----
>> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > > bounces [at] lists] On Behalf Of Regev Ayelet
>> > > Sent: Wednesday, September 19, 2012 11:10 AM
>> > > To: rsyslog-users
>> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
>> Rsyslog
>> > >
>> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
>> > > logger: unknown facility name: authpriv
>> >
>> > FYI: logger is not part of rsyslog.
>> > Rainer
>> > > smu80a:/ ROOT >
>> > > smu80a:/ ROOT >
>> > > smu80a:/ ROOT > ps -ef | grep -i rsys
>> > > root 376 1 0 Aug 29 ? 1:47
>> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-server.pid
>> -
>> > f
>> > > /etc/rsy
>> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
>> > >
>> > >
>> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
>> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
>> > pid="17012"
>> > > x-info="http://www.rsyslog.com"] (re)start
>> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
>> > > Automatically generated config directives may interfer with your
>> > > rsyslog.conf settings. We suggest upgrading your config and adding
>> -
>> > c4
>> > > as the first rsyslogd option.
>> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config file
>> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
>> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config
>> > file!
>> > > rsyslogd:Warning: backward compatibility layer added to following
>> > > directive to rsyslog.conf: ModLoad immark
>> > > rsyslogd:Warning: backward compatibility layer added to following
>> > > directive to rsyslog.conf: MarkMessagePeriod 1200
>> > > rsyslogd:Warning: backward compatibility layer added to following
>> > > directive to rsyslog.conf: ModLoad imuxsock
>> > >
>> > >
>> > > Do I need newer version of Rsyslog to be compiled?
>> > >
>> > >
>> > >
>> > > Ayelet Regev-Dabah
>> > > System Software Platform TL
>> > > Comverse
>> > > Office: +972 3 6459362
>> > > ayelet.regev [at] comverse
>> > > www.comverse.com
>> > >
>> > >
>> > > -----Original Message-----
>> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > > bounces [at] lists] On Behalf Of david [at] lang
>> > > Sent: Thursday, September 13, 2012 10:31 PM
>> > > To: rsyslog-users
>> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
>> Rsyslog
>> > >
>> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
>> > >
>> > > > Hi,
>> > > >
>> > > > I am currently using syslog on solaris server and they don't
>> > support
>> > > authpriv.* facility.
>> > > > They recommended us to try 3rd party.
>> > > >
>> > > > Does rsyslog on Solaris support this facility? From what version?
>> > >
>> > > I'm pretty sure that it's supported it from the beginning, but
>> > rsyslog
>> > > has
>> > > only supported Solaris fairly recently.
>> > >
>> > > If you install rsyslog version 5.x or 6.x (the currently supported
>> > > stable
>> > > versions), you should be in good shape.
>> > >
>> > > As always, test and report any problems before planning a major
>> > project
>> > > :)
>> > >
>> > > David Lang
>> > > _______________________________________________
>> > > rsyslog mailing list
>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > > http://www.rsyslog.com/professional-services/
>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> > POST
>> > > if you DON'T LIKE THAT.
>> > >
>> > > "This e-mail message may contain confidential, commercial or
>> > privileged
>> > > information that constitutes proprietary information of Comverse
>> > > Technology or its subsidiaries. If you are not the intended
>> recipient
>> > > of this message, you are hereby notified that any review, use or
>> > > distribution of this information is absolutely prohibited and we
>> > > request that you delete all copies and contact us by e-mailing to:
>> > > security [at] comverse Thank You."
>> > > _______________________________________________
>> > > rsyslog mailing list
>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > > http://www.rsyslog.com/professional-services/
>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> > POST
>> > > if you DON'T LIKE THAT.
>> > _______________________________________________
>> > rsyslog mailing list
>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> POST
>> > if you DON'T LIKE THAT.
>> >
>> > "This e-mail message may contain confidential, commercial or
>> privileged
>> > information that constitutes proprietary information of Comverse
>> > Technology or its subsidiaries. If you are not the intended recipient
>> > of this message, you are hereby notified that any review, use or
>> > distribution of this information is absolutely prohibited and we
>> > request that you delete all copies and contact us by e-mailing to:
>> > security [at] comverse Thank You."
>> > _______________________________________________
>> > rsyslog mailing list
>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> POST
>> > if you DON'T LIKE THAT.
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>> if you DON'T LIKE THAT.
>>
>> "This e-mail message may contain confidential, commercial or privileged
>> information that constitutes proprietary information of Comverse
>> Technology or its subsidiaries. If you are not the intended recipient
>> of this message, you are hereby notified that any review, use or
>> distribution of this information is absolutely prohibited and we
>> request that you delete all copies and contact us by e-mailing to:
>> security [at] comverse Thank You."
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>> if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
> ?This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.?
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


rgerhards at hq

Sep 19, 2012, 11:22 PM

Post #12 of 22 (374 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of david [at] lang
> Sent: Wednesday, September 19, 2012 11:22 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> One thing that you need to realize is that the facility names are just
> a
> convienience, when the messages are sent over the wire, everything is
> reduced to a number.
>
> As a result, it's possible for one system to know something as one name
> and another system to know it as a different name.
>
> looking at the documentation for the perl module Net::Syslog, it looks
> like authpriv and security are both facility 10, so if you use
> 'security'
> instead of 'authpriv' on the rsyslog box you should get what you
> expect.

If I (finally) understand the OP correctly, some rule seems not to match as he expects. In any case, rsyslog knows authpriv and will check for that. So if the check is there, and the message has the right facility, this probably is a bug. In that case, a debug log is required to see what goes wrong. It must contain at least one such message being processed.

Rainer
>
> David Lang
>
>
> On Wed, 19 Sep 2012, Regev Ayelet wrote:
>
> > Date: Wed, 19 Sep 2012 14:35:01 +0300
> > From: Regev Ayelet <Ayelet.Regev [at] comverse>
> > Reply-To: rsyslog-users <rsyslog [at] lists>
> > To: rsyslog-users <rsyslog [at] lists>
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > I have few systems here:
> >
> > RHEL 6 client with rsyslogd 3.22.1as client configured to send to
> remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
> >
> > This is the client configuration of RHEL6:
> >
> >
> > [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> > $ModLoad immark
> > $MarkMessagePeriod 3600
> > $ActionFileEnableSync on
> > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > $ModLoad imuxsock
> > $ModLoad imklog
> > *.info;mail.none;authpriv.none;cron.none
> /var/log/messages
> > auth,authpriv.*
> /var/log/secure
> > mail.*
> /var/log/maillog
> > cron.* /var/log/cron
> > $WorkDirectory /var/spool/rsyslog # default location for work
> (spool) files
> > $ActionQueueType LinkedList # use asynchronous processing
> > $ActionQueueFileName srvrfwd # set file name, also enables disk
> mode
> > $ActionQueueHighWaterMark 8000 # Default
> > $ActionQueueLowWaterMark 2000 # Default
> > $ActionQueueMaxFileSize 10m # Default is 1m
> > $ActionQueueMaxDiskSpace 8g
> > $ActionResumeRetryCount -1 # infinite retries on insert failure
> > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog
> shuts down
> > local0,auth,authpriv.debug
> @@syslogServer:50514
> > mail.emerg
> @@syslogServer:50514
> > local4.debug
> @@syslogServer:50514
> > *.emerg;mail.none *
> >
> >
> >
> > Authpriv.info is written to /var/log/secure locally and send to
> syslog server for remote logging.
> > (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
> >
> > When the syslogserver is Linux system the authpriv.* events are
> written correctly.
> > When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events
> are not recorded at all. (other facilities are recorded to log files)
> >
> >
> > Linux server configuration file:
> > -----------------------------------------
> >
> > [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> > $ModLoad immark
> > $MarkMessagePeriod 3600
> > $ActionFileEnableSync on
> > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > $ModLoad imklog
> > $ModLoad imudp
> > $UDPServerRun 514
> > $UDPServerRun 1514
> > $ModLoad imtcp
> > $InputTCPServerRun 50514
> > user,daemon,uucp,cron,mark.notice;kern.debug
> /var/log/messages
> > *.emerg;mail.none
> *
> > auth,authpriv.debug
> /var/log/central/auth.debug
> > mail.emerg
> /var/log/central/MIPSlog
> > local0.debug
> /var/log/central/local0.debug
> > local4.debug
> /var/log/central/traceall
> > local1.debug
> /var/log/central/hbase
> >
> >
> >
> > Solaris 10 Configuration file:
> > ----------------------------------
> >
> > smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> > $ModLoad immark
> > $ModLoad imsolaris
> > $MarkMessagePeriod 3600
> > $ActionFileEnableSync on
> > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > $ModLoad imklog
> > $ModLoad imudp
> > $UDPServerRun 514
> > $UDPServerRun 1514
> > $ModLoad imtcp
> > $InputTCPServerRun 50514
> >
> > user,daemon,uucp,cron,mark.notice /var/adm/messages
> > *.emerg;mail.none *
> > kern.debug
> /var/adm/messages
> > auth.debug
> /var/log/central/auth.debug
> > authpriv.debug /var/log/central/auth.debug
> > mail.emerg
> /var/log/central/MIPSlog
> > local0.debug
> /var/log/central/local0.debug
> > local4.debug
> /var/log/central/traceall
> > local6.debug
> /var/cti/logs/SDT/SDT_Audit_Information.log
> >
> >
> >
> >
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> > Sent: Wednesday, September 19, 2012 2:01 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> >> RHEL 6 authentication is being logged with "authpriv.debug", it is
> >> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
> >> Rsyslog 4.7.4...
> >
> > Sorry, I don't get what you mean...
> > Rainer
> >>
> >> Ayelet Regev-Dabah
> >> System Software Platform TL
> >> Comverse
> >> Office: +972 3 6459362
> >> ayelet.regev [at] comverse
> >> www.comverse.com
> >>
> >>
> >> -----Original Message-----
> >> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> bounces [at] lists] On Behalf Of Rainer Gerhards
> >> Sent: Wednesday, September 19, 2012 1:38 PM
> >> To: rsyslog-users
> >> Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> >>
> >> > How can I test the facility support of authpriv without logger?
> >>
> >> You can use rsyslog's tool tcpflood with a specifically-crafted
> >> message. Small doc at
> >>
> >> http://www.rsyslog.com/how-to-use-tcpflood/
> >>
> >> Or you could use the actual application you plan to use.
> >>
> >> Rainer
> >> > Ayelet Regev-Dabah
> >> > System Software Platform TL
> >> > Comverse
> >> > Office: +972 3 6459362
> >> > ayelet.regev [at] comverse
> >> > www.comverse.com
> >> >
> >> >
> >> > -----Original Message-----
> >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > bounces [at] lists] On Behalf Of Rainer Gerhards
> >> > Sent: Wednesday, September 19, 2012 12:23 PM
> >> > To: rsyslog-users
> >> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> >> >
> >> >
> >> >
> >> > > -----Original Message-----
> >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > > bounces [at] lists] On Behalf Of Regev Ayelet
> >> > > Sent: Wednesday, September 19, 2012 11:10 AM
> >> > > To: rsyslog-users
> >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> >> Rsyslog
> >> > >
> >> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> >> > > logger: unknown facility name: authpriv
> >> >
> >> > FYI: logger is not part of rsyslog.
> >> > Rainer
> >> > > smu80a:/ ROOT >
> >> > > smu80a:/ ROOT >
> >> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> >> > > root 376 1 0 Aug 29 ? 1:47
> >> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-
> server.pid
> >> -
> >> > f
> >> > > /etc/rsy
> >> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
> >> > >
> >> > >
> >> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> >> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> >> > pid="17012"
> >> > > x-info="http://www.rsyslog.com"] (re)start
> >> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> >> > > Automatically generated config directives may interfer with your
> >> > > rsyslog.conf settings. We suggest upgrading your config and
> adding
> >> -
> >> > c4
> >> > > as the first rsyslogd option.
> >> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config
> file
> >> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> >> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config
> >> > file!
> >> > > rsyslogd:Warning: backward compatibility layer added to
> following
> >> > > directive to rsyslog.conf: ModLoad immark
> >> > > rsyslogd:Warning: backward compatibility layer added to
> following
> >> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> >> > > rsyslogd:Warning: backward compatibility layer added to
> following
> >> > > directive to rsyslog.conf: ModLoad imuxsock
> >> > >
> >> > >
> >> > > Do I need newer version of Rsyslog to be compiled?
> >> > >
> >> > >
> >> > >
> >> > > Ayelet Regev-Dabah
> >> > > System Software Platform TL
> >> > > Comverse
> >> > > Office: +972 3 6459362
> >> > > ayelet.regev [at] comverse
> >> > > www.comverse.com
> >> > >
> >> > >
> >> > > -----Original Message-----
> >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > > bounces [at] lists] On Behalf Of david [at] lang
> >> > > Sent: Thursday, September 13, 2012 10:31 PM
> >> > > To: rsyslog-users
> >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> >> Rsyslog
> >> > >
> >> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> >> > >
> >> > > > Hi,
> >> > > >
> >> > > > I am currently using syslog on solaris server and they don't
> >> > support
> >> > > authpriv.* facility.
> >> > > > They recommended us to try 3rd party.
> >> > > >
> >> > > > Does rsyslog on Solaris support this facility? From what
> version?
> >> > >
> >> > > I'm pretty sure that it's supported it from the beginning, but
> >> > rsyslog
> >> > > has
> >> > > only supported Solaris fairly recently.
> >> > >
> >> > > If you install rsyslog version 5.x or 6.x (the currently
> supported
> >> > > stable
> >> > > versions), you should be in good shape.
> >> > >
> >> > > As always, test and report any problems before planning a major
> >> > project
> >> > > :)
> >> > >
> >> > > David Lang
> >> > > _______________________________________________
> >> > > rsyslog mailing list
> >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > > http://www.rsyslog.com/professional-services/
> >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> >> > POST
> >> > > if you DON'T LIKE THAT.
> >> > >
> >> > > "This e-mail message may contain confidential, commercial or
> >> > privileged
> >> > > information that constitutes proprietary information of Comverse
> >> > > Technology or its subsidiaries. If you are not the intended
> >> recipient
> >> > > of this message, you are hereby notified that any review, use or
> >> > > distribution of this information is absolutely prohibited and we
> >> > > request that you delete all copies and contact us by e-mailing
> to:
> >> > > security [at] comverse Thank You."
> >> > > _______________________________________________
> >> > > rsyslog mailing list
> >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > > http://www.rsyslog.com/professional-services/
> >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> >> > POST
> >> > > if you DON'T LIKE THAT.
> >> > _______________________________________________
> >> > rsyslog mailing list
> >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > http://www.rsyslog.com/professional-services/
> >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> >> POST
> >> > if you DON'T LIKE THAT.
> >> >
> >> > "This e-mail message may contain confidential, commercial or
> >> privileged
> >> > information that constitutes proprietary information of Comverse
> >> > Technology or its subsidiaries. If you are not the intended
> recipient
> >> > of this message, you are hereby notified that any review, use or
> >> > distribution of this information is absolutely prohibited and we
> >> > request that you delete all copies and contact us by e-mailing to:
> >> > security [at] comverse Thank You."
> >> > _______________________________________________
> >> > rsyslog mailing list
> >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > http://www.rsyslog.com/professional-services/
> >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> >> POST
> >> > if you DON'T LIKE THAT.
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> >> if you DON'T LIKE THAT.
> >>
> >> "This e-mail message may contain confidential, commercial or
> privileged
> >> information that constitutes proprietary information of Comverse
> >> Technology or its subsidiaries. If you are not the intended
> recipient
> >> of this message, you are hereby notified that any review, use or
> >> distribution of this information is absolutely prohibited and we
> >> request that you delete all copies and contact us by e-mailing to:
> >> security [at] comverse Thank You."
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> >> if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
> >
> > ?This e-mail message may contain confidential, commercial or
> privileged information that constitutes proprietary information of
> Comverse Technology or its subsidiaries. If you are not the intended
> recipient of this message, you are hereby notified that any review, use
> or distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You.?
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


Ayelet.Regev at comverse

Sep 19, 2012, 11:47 PM

Post #13 of 22 (382 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

You are right!!!
I configured the facility on the server as security.debug and got all the logs.

Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of david [at] lang
Sent: Thursday, September 20, 2012 12:22 AM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

One thing that you need to realize is that the facility names are just a
convienience, when the messages are sent over the wire, everything is
reduced to a number.

As a result, it's possible for one system to know something as one name
and another system to know it as a different name.

looking at the documentation for the perl module Net::Syslog, it looks
like authpriv and security are both facility 10, so if you use 'security'
instead of 'authpriv' on the rsyslog box you should get what you expect.

David Lang


On Wed, 19 Sep 2012, Regev Ayelet wrote:

> Date: Wed, 19 Sep 2012 14:35:01 +0300
> From: Regev Ayelet <Ayelet.Regev [at] comverse>
> Reply-To: rsyslog-users <rsyslog [at] lists>
> To: rsyslog-users <rsyslog [at] lists>
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> I have few systems here:
>
> RHEL 6 client with rsyslogd 3.22.1as client configured to send to remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
>
> This is the client configuration of RHEL6:
>
>
> [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> $ModLoad immark
> $MarkMessagePeriod 3600
> $ActionFileEnableSync on
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imuxsock
> $ModLoad imklog
> *.info;mail.none;authpriv.none;cron.none /var/log/messages
> auth,authpriv.* /var/log/secure
> mail.* /var/log/maillog
> cron.* /var/log/cron
> $WorkDirectory /var/spool/rsyslog # default location for work (spool) files
> $ActionQueueType LinkedList # use asynchronous processing
> $ActionQueueFileName srvrfwd # set file name, also enables disk mode
> $ActionQueueHighWaterMark 8000 # Default
> $ActionQueueLowWaterMark 2000 # Default
> $ActionQueueMaxFileSize 10m # Default is 1m
> $ActionQueueMaxDiskSpace 8g
> $ActionResumeRetryCount -1 # infinite retries on insert failure
> $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
> local0,auth,authpriv.debug @@syslogServer:50514
> mail.emerg @@syslogServer:50514
> local4.debug @@syslogServer:50514
> *.emerg;mail.none *
>
>
>
> Authpriv.info is written to /var/log/secure locally and send to syslog server for remote logging.
> (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
>
> When the syslogserver is Linux system the authpriv.* events are written correctly.
> When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events are not recorded at all. (other facilities are recorded to log files)
>
>
> Linux server configuration file:
> -----------------------------------------
>
> [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> $ModLoad immark
> $MarkMessagePeriod 3600
> $ActionFileEnableSync on
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imklog
> $ModLoad imudp
> $UDPServerRun 514
> $UDPServerRun 1514
> $ModLoad imtcp
> $InputTCPServerRun 50514
> user,daemon,uucp,cron,mark.notice;kern.debug /var/log/messages
> *.emerg;mail.none *
> auth,authpriv.debug /var/log/central/auth.debug
> mail.emerg /var/log/central/MIPSlog
> local0.debug /var/log/central/local0.debug
> local4.debug /var/log/central/traceall
> local1.debug /var/log/central/hbase
>
>
>
> Solaris 10 Configuration file:
> ----------------------------------
>
> smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> $ModLoad immark
> $ModLoad imsolaris
> $MarkMessagePeriod 3600
> $ActionFileEnableSync on
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imklog
> $ModLoad imudp
> $UDPServerRun 514
> $UDPServerRun 1514
> $ModLoad imtcp
> $InputTCPServerRun 50514
>
> user,daemon,uucp,cron,mark.notice /var/adm/messages
> *.emerg;mail.none *
> kern.debug /var/adm/messages
> auth.debug /var/log/central/auth.debug
> authpriv.debug /var/log/central/auth.debug
> mail.emerg /var/log/central/MIPSlog
> local0.debug /var/log/central/local0.debug
> local4.debug /var/log/central/traceall
> local6.debug /var/cti/logs/SDT/SDT_Audit_Information.log
>
>
>
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Wednesday, September 19, 2012 2:01 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
>> RHEL 6 authentication is being logged with "authpriv.debug", it is
>> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
>> Rsyslog 4.7.4...
>
> Sorry, I don't get what you mean...
> Rainer
>>
>> Ayelet Regev-Dabah
>> System Software Platform TL
>> Comverse
>> Office: +972 3 6459362
>> ayelet.regev [at] comverse
>> www.comverse.com
>>
>>
>> -----Original Message-----
>> From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> bounces [at] lists] On Behalf Of Rainer Gerhards
>> Sent: Wednesday, September 19, 2012 1:38 PM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>>
>> > How can I test the facility support of authpriv without logger?
>>
>> You can use rsyslog's tool tcpflood with a specifically-crafted
>> message. Small doc at
>>
>> http://www.rsyslog.com/how-to-use-tcpflood/
>>
>> Or you could use the actual application you plan to use.
>>
>> Rainer
>> > Ayelet Regev-Dabah
>> > System Software Platform TL
>> > Comverse
>> > Office: +972 3 6459362
>> > ayelet.regev [at] comverse
>> > www.comverse.com
>> >
>> >
>> > -----Original Message-----
>> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > bounces [at] lists] On Behalf Of Rainer Gerhards
>> > Sent: Wednesday, September 19, 2012 12:23 PM
>> > To: rsyslog-users
>> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>> >
>> >
>> >
>> > > -----Original Message-----
>> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > > bounces [at] lists] On Behalf Of Regev Ayelet
>> > > Sent: Wednesday, September 19, 2012 11:10 AM
>> > > To: rsyslog-users
>> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
>> Rsyslog
>> > >
>> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
>> > > logger: unknown facility name: authpriv
>> >
>> > FYI: logger is not part of rsyslog.
>> > Rainer
>> > > smu80a:/ ROOT >
>> > > smu80a:/ ROOT >
>> > > smu80a:/ ROOT > ps -ef | grep -i rsys
>> > > root 376 1 0 Aug 29 ? 1:47
>> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-server.pid
>> -
>> > f
>> > > /etc/rsy
>> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
>> > >
>> > >
>> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
>> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
>> > pid="17012"
>> > > x-info="http://www.rsyslog.com"] (re)start
>> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
>> > > Automatically generated config directives may interfer with your
>> > > rsyslog.conf settings. We suggest upgrading your config and adding
>> -
>> > c4
>> > > as the first rsyslogd option.
>> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config file
>> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
>> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config
>> > file!
>> > > rsyslogd:Warning: backward compatibility layer added to following
>> > > directive to rsyslog.conf: ModLoad immark
>> > > rsyslogd:Warning: backward compatibility layer added to following
>> > > directive to rsyslog.conf: MarkMessagePeriod 1200
>> > > rsyslogd:Warning: backward compatibility layer added to following
>> > > directive to rsyslog.conf: ModLoad imuxsock
>> > >
>> > >
>> > > Do I need newer version of Rsyslog to be compiled?
>> > >
>> > >
>> > >
>> > > Ayelet Regev-Dabah
>> > > System Software Platform TL
>> > > Comverse
>> > > Office: +972 3 6459362
>> > > ayelet.regev [at] comverse
>> > > www.comverse.com
>> > >
>> > >
>> > > -----Original Message-----
>> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > > bounces [at] lists] On Behalf Of david [at] lang
>> > > Sent: Thursday, September 13, 2012 10:31 PM
>> > > To: rsyslog-users
>> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
>> Rsyslog
>> > >
>> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
>> > >
>> > > > Hi,
>> > > >
>> > > > I am currently using syslog on solaris server and they don't
>> > support
>> > > authpriv.* facility.
>> > > > They recommended us to try 3rd party.
>> > > >
>> > > > Does rsyslog on Solaris support this facility? From what version?
>> > >
>> > > I'm pretty sure that it's supported it from the beginning, but
>> > rsyslog
>> > > has
>> > > only supported Solaris fairly recently.
>> > >
>> > > If you install rsyslog version 5.x or 6.x (the currently supported
>> > > stable
>> > > versions), you should be in good shape.
>> > >
>> > > As always, test and report any problems before planning a major
>> > project
>> > > :)
>> > >
>> > > David Lang
>> > > _______________________________________________
>> > > rsyslog mailing list
>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > > http://www.rsyslog.com/professional-services/
>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> > POST
>> > > if you DON'T LIKE THAT.
>> > >
>> > > "This e-mail message may contain confidential, commercial or
>> > privileged
>> > > information that constitutes proprietary information of Comverse
>> > > Technology or its subsidiaries. If you are not the intended
>> recipient
>> > > of this message, you are hereby notified that any review, use or
>> > > distribution of this information is absolutely prohibited and we
>> > > request that you delete all copies and contact us by e-mailing to:
>> > > security [at] comverse Thank You."
>> > > _______________________________________________
>> > > rsyslog mailing list
>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > > http://www.rsyslog.com/professional-services/
>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> > POST
>> > > if you DON'T LIKE THAT.
>> > _______________________________________________
>> > rsyslog mailing list
>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> POST
>> > if you DON'T LIKE THAT.
>> >
>> > "This e-mail message may contain confidential, commercial or
>> privileged
>> > information that constitutes proprietary information of Comverse
>> > Technology or its subsidiaries. If you are not the intended recipient
>> > of this message, you are hereby notified that any review, use or
>> > distribution of this information is absolutely prohibited and we
>> > request that you delete all copies and contact us by e-mailing to:
>> > security [at] comverse Thank You."
>> > _______________________________________________
>> > rsyslog mailing list
>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> POST
>> > if you DON'T LIKE THAT.
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>> if you DON'T LIKE THAT.
>>
>> "This e-mail message may contain confidential, commercial or privileged
>> information that constitutes proprietary information of Comverse
>> Technology or its subsidiaries. If you are not the intended recipient
>> of this message, you are hereby notified that any review, use or
>> distribution of this information is absolutely prohibited and we
>> request that you delete all copies and contact us by e-mailing to:
>> security [at] comverse Thank You."
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>> if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
> ?This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.?
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


Ayelet.Regev at comverse

Sep 19, 2012, 11:58 PM

Post #14 of 22 (372 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

My bad! Still doesn’t work.. (I checked linux server not solaris)
I will send debug events.


Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Regev Ayelet
Sent: Thursday, September 20, 2012 9:47 AM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

You are right!!!
I configured the facility on the server as security.debug and got all the logs.

Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of david [at] lang
Sent: Thursday, September 20, 2012 12:22 AM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

One thing that you need to realize is that the facility names are just a
convienience, when the messages are sent over the wire, everything is
reduced to a number.

As a result, it's possible for one system to know something as one name
and another system to know it as a different name.

looking at the documentation for the perl module Net::Syslog, it looks
like authpriv and security are both facility 10, so if you use 'security'
instead of 'authpriv' on the rsyslog box you should get what you expect.

David Lang


On Wed, 19 Sep 2012, Regev Ayelet wrote:

> Date: Wed, 19 Sep 2012 14:35:01 +0300
> From: Regev Ayelet <Ayelet.Regev [at] comverse>
> Reply-To: rsyslog-users <rsyslog [at] lists>
> To: rsyslog-users <rsyslog [at] lists>
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> I have few systems here:
>
> RHEL 6 client with rsyslogd 3.22.1as client configured to send to remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
>
> This is the client configuration of RHEL6:
>
>
> [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> $ModLoad immark
> $MarkMessagePeriod 3600
> $ActionFileEnableSync on
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imuxsock
> $ModLoad imklog
> *.info;mail.none;authpriv.none;cron.none /var/log/messages
> auth,authpriv.* /var/log/secure
> mail.* /var/log/maillog
> cron.* /var/log/cron
> $WorkDirectory /var/spool/rsyslog # default location for work (spool) files
> $ActionQueueType LinkedList # use asynchronous processing
> $ActionQueueFileName srvrfwd # set file name, also enables disk mode
> $ActionQueueHighWaterMark 8000 # Default
> $ActionQueueLowWaterMark 2000 # Default
> $ActionQueueMaxFileSize 10m # Default is 1m
> $ActionQueueMaxDiskSpace 8g
> $ActionResumeRetryCount -1 # infinite retries on insert failure
> $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
> local0,auth,authpriv.debug @@syslogServer:50514
> mail.emerg @@syslogServer:50514
> local4.debug @@syslogServer:50514
> *.emerg;mail.none *
>
>
>
> Authpriv.info is written to /var/log/secure locally and send to syslog server for remote logging.
> (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
>
> When the syslogserver is Linux system the authpriv.* events are written correctly.
> When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events are not recorded at all. (other facilities are recorded to log files)
>
>
> Linux server configuration file:
> -----------------------------------------
>
> [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> $ModLoad immark
> $MarkMessagePeriod 3600
> $ActionFileEnableSync on
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imklog
> $ModLoad imudp
> $UDPServerRun 514
> $UDPServerRun 1514
> $ModLoad imtcp
> $InputTCPServerRun 50514
> user,daemon,uucp,cron,mark.notice;kern.debug /var/log/messages
> *.emerg;mail.none *
> auth,authpriv.debug /var/log/central/auth.debug
> mail.emerg /var/log/central/MIPSlog
> local0.debug /var/log/central/local0.debug
> local4.debug /var/log/central/traceall
> local1.debug /var/log/central/hbase
>
>
>
> Solaris 10 Configuration file:
> ----------------------------------
>
> smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> $ModLoad immark
> $ModLoad imsolaris
> $MarkMessagePeriod 3600
> $ActionFileEnableSync on
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imklog
> $ModLoad imudp
> $UDPServerRun 514
> $UDPServerRun 1514
> $ModLoad imtcp
> $InputTCPServerRun 50514
>
> user,daemon,uucp,cron,mark.notice /var/adm/messages
> *.emerg;mail.none *
> kern.debug /var/adm/messages
> auth.debug /var/log/central/auth.debug
> authpriv.debug /var/log/central/auth.debug
> mail.emerg /var/log/central/MIPSlog
> local0.debug /var/log/central/local0.debug
> local4.debug /var/log/central/traceall
> local6.debug /var/cti/logs/SDT/SDT_Audit_Information.log
>
>
>
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Wednesday, September 19, 2012 2:01 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
>> RHEL 6 authentication is being logged with "authpriv.debug", it is
>> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
>> Rsyslog 4.7.4...
>
> Sorry, I don't get what you mean...
> Rainer
>>
>> Ayelet Regev-Dabah
>> System Software Platform TL
>> Comverse
>> Office: +972 3 6459362
>> ayelet.regev [at] comverse
>> www.comverse.com
>>
>>
>> -----Original Message-----
>> From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> bounces [at] lists] On Behalf Of Rainer Gerhards
>> Sent: Wednesday, September 19, 2012 1:38 PM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>>
>> > How can I test the facility support of authpriv without logger?
>>
>> You can use rsyslog's tool tcpflood with a specifically-crafted
>> message. Small doc at
>>
>> http://www.rsyslog.com/how-to-use-tcpflood/
>>
>> Or you could use the actual application you plan to use.
>>
>> Rainer
>> > Ayelet Regev-Dabah
>> > System Software Platform TL
>> > Comverse
>> > Office: +972 3 6459362
>> > ayelet.regev [at] comverse
>> > www.comverse.com
>> >
>> >
>> > -----Original Message-----
>> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > bounces [at] lists] On Behalf Of Rainer Gerhards
>> > Sent: Wednesday, September 19, 2012 12:23 PM
>> > To: rsyslog-users
>> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>> >
>> >
>> >
>> > > -----Original Message-----
>> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > > bounces [at] lists] On Behalf Of Regev Ayelet
>> > > Sent: Wednesday, September 19, 2012 11:10 AM
>> > > To: rsyslog-users
>> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
>> Rsyslog
>> > >
>> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
>> > > logger: unknown facility name: authpriv
>> >
>> > FYI: logger is not part of rsyslog.
>> > Rainer
>> > > smu80a:/ ROOT >
>> > > smu80a:/ ROOT >
>> > > smu80a:/ ROOT > ps -ef | grep -i rsys
>> > > root 376 1 0 Aug 29 ? 1:47
>> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-server.pid
>> -
>> > f
>> > > /etc/rsy
>> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
>> > >
>> > >
>> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
>> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
>> > pid="17012"
>> > > x-info="http://www.rsyslog.com"] (re)start
>> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
>> > > Automatically generated config directives may interfer with your
>> > > rsyslog.conf settings. We suggest upgrading your config and adding
>> -
>> > c4
>> > > as the first rsyslogd option.
>> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config file
>> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
>> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config
>> > file!
>> > > rsyslogd:Warning: backward compatibility layer added to following
>> > > directive to rsyslog.conf: ModLoad immark
>> > > rsyslogd:Warning: backward compatibility layer added to following
>> > > directive to rsyslog.conf: MarkMessagePeriod 1200
>> > > rsyslogd:Warning: backward compatibility layer added to following
>> > > directive to rsyslog.conf: ModLoad imuxsock
>> > >
>> > >
>> > > Do I need newer version of Rsyslog to be compiled?
>> > >
>> > >
>> > >
>> > > Ayelet Regev-Dabah
>> > > System Software Platform TL
>> > > Comverse
>> > > Office: +972 3 6459362
>> > > ayelet.regev [at] comverse
>> > > www.comverse.com
>> > >
>> > >
>> > > -----Original Message-----
>> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > > bounces [at] lists] On Behalf Of david [at] lang
>> > > Sent: Thursday, September 13, 2012 10:31 PM
>> > > To: rsyslog-users
>> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
>> Rsyslog
>> > >
>> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
>> > >
>> > > > Hi,
>> > > >
>> > > > I am currently using syslog on solaris server and they don't
>> > support
>> > > authpriv.* facility.
>> > > > They recommended us to try 3rd party.
>> > > >
>> > > > Does rsyslog on Solaris support this facility? From what version?
>> > >
>> > > I'm pretty sure that it's supported it from the beginning, but
>> > rsyslog
>> > > has
>> > > only supported Solaris fairly recently.
>> > >
>> > > If you install rsyslog version 5.x or 6.x (the currently supported
>> > > stable
>> > > versions), you should be in good shape.
>> > >
>> > > As always, test and report any problems before planning a major
>> > project
>> > > :)
>> > >
>> > > David Lang
>> > > _______________________________________________
>> > > rsyslog mailing list
>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > > http://www.rsyslog.com/professional-services/
>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> > POST
>> > > if you DON'T LIKE THAT.
>> > >
>> > > "This e-mail message may contain confidential, commercial or
>> > privileged
>> > > information that constitutes proprietary information of Comverse
>> > > Technology or its subsidiaries. If you are not the intended
>> recipient
>> > > of this message, you are hereby notified that any review, use or
>> > > distribution of this information is absolutely prohibited and we
>> > > request that you delete all copies and contact us by e-mailing to:
>> > > security [at] comverse Thank You."
>> > > _______________________________________________
>> > > rsyslog mailing list
>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > > http://www.rsyslog.com/professional-services/
>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> > POST
>> > > if you DON'T LIKE THAT.
>> > _______________________________________________
>> > rsyslog mailing list
>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> POST
>> > if you DON'T LIKE THAT.
>> >
>> > "This e-mail message may contain confidential, commercial or
>> privileged
>> > information that constitutes proprietary information of Comverse
>> > Technology or its subsidiaries. If you are not the intended recipient
>> > of this message, you are hereby notified that any review, use or
>> > distribution of this information is absolutely prohibited and we
>> > request that you delete all copies and contact us by e-mailing to:
>> > security [at] comverse Thank You."
>> > _______________________________________________
>> > rsyslog mailing list
>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> POST
>> > if you DON'T LIKE THAT.
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>> if you DON'T LIKE THAT.
>>
>> "This e-mail message may contain confidential, commercial or privileged
>> information that constitutes proprietary information of Comverse
>> Technology or its subsidiaries. If you are not the intended recipient
>> of this message, you are hereby notified that any review, use or
>> distribution of this information is absolutely prohibited and we
>> request that you delete all copies and contact us by e-mailing to:
>> security [at] comverse Thank You."
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>> if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
> ?This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.?
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


rgerhards at hq

Sep 20, 2012, 12:06 AM

Post #15 of 22 (369 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 8:59 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> My bad! Still doesn't work.. (I checked linux server not solaris)
> I will send debug events.

Just to make sure we are on the same page: I need a *debug log*, see

http://www.rsyslog.com/doc/troubleshoot.html

Rainer
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 9:47 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> You are right!!!
> I configured the facility on the server as security.debug and got all
> the logs.
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of david [at] lang
> Sent: Thursday, September 20, 2012 12:22 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> One thing that you need to realize is that the facility names are just
> a
> convienience, when the messages are sent over the wire, everything is
> reduced to a number.
>
> As a result, it's possible for one system to know something as one name
> and another system to know it as a different name.
>
> looking at the documentation for the perl module Net::Syslog, it looks
> like authpriv and security are both facility 10, so if you use
> 'security'
> instead of 'authpriv' on the rsyslog box you should get what you
> expect.
>
> David Lang
>
>
> On Wed, 19 Sep 2012, Regev Ayelet wrote:
>
> > Date: Wed, 19 Sep 2012 14:35:01 +0300
> > From: Regev Ayelet <Ayelet.Regev [at] comverse>
> > Reply-To: rsyslog-users <rsyslog [at] lists>
> > To: rsyslog-users <rsyslog [at] lists>
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > I have few systems here:
> >
> > RHEL 6 client with rsyslogd 3.22.1as client configured to send to
> remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
> >
> > This is the client configuration of RHEL6:
> >
> >
> > [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> > $ModLoad immark
> > $MarkMessagePeriod 3600
> > $ActionFileEnableSync on
> > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > $ModLoad imuxsock
> > $ModLoad imklog
> > *.info;mail.none;authpriv.none;cron.none
> /var/log/messages
> > auth,authpriv.*
> /var/log/secure
> > mail.*
> /var/log/maillog
> > cron.* /var/log/cron
> > $WorkDirectory /var/spool/rsyslog # default location for work
> (spool) files
> > $ActionQueueType LinkedList # use asynchronous processing
> > $ActionQueueFileName srvrfwd # set file name, also enables disk
> mode
> > $ActionQueueHighWaterMark 8000 # Default
> > $ActionQueueLowWaterMark 2000 # Default
> > $ActionQueueMaxFileSize 10m # Default is 1m
> > $ActionQueueMaxDiskSpace 8g
> > $ActionResumeRetryCount -1 # infinite retries on insert failure
> > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog
> shuts down
> > local0,auth,authpriv.debug
> @@syslogServer:50514
> > mail.emerg
> @@syslogServer:50514
> > local4.debug
> @@syslogServer:50514
> > *.emerg;mail.none *
> >
> >
> >
> > Authpriv.info is written to /var/log/secure locally and send to
> syslog server for remote logging.
> > (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
> >
> > When the syslogserver is Linux system the authpriv.* events are
> written correctly.
> > When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events
> are not recorded at all. (other facilities are recorded to log files)
> >
> >
> > Linux server configuration file:
> > -----------------------------------------
> >
> > [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> > $ModLoad immark
> > $MarkMessagePeriod 3600
> > $ActionFileEnableSync on
> > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > $ModLoad imklog
> > $ModLoad imudp
> > $UDPServerRun 514
> > $UDPServerRun 1514
> > $ModLoad imtcp
> > $InputTCPServerRun 50514
> > user,daemon,uucp,cron,mark.notice;kern.debug
> /var/log/messages
> > *.emerg;mail.none
> *
> > auth,authpriv.debug
> /var/log/central/auth.debug
> > mail.emerg
> /var/log/central/MIPSlog
> > local0.debug
> /var/log/central/local0.debug
> > local4.debug
> /var/log/central/traceall
> > local1.debug
> /var/log/central/hbase
> >
> >
> >
> > Solaris 10 Configuration file:
> > ----------------------------------
> >
> > smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> > $ModLoad immark
> > $ModLoad imsolaris
> > $MarkMessagePeriod 3600
> > $ActionFileEnableSync on
> > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > $ModLoad imklog
> > $ModLoad imudp
> > $UDPServerRun 514
> > $UDPServerRun 1514
> > $ModLoad imtcp
> > $InputTCPServerRun 50514
> >
> > user,daemon,uucp,cron,mark.notice /var/adm/messages
> > *.emerg;mail.none *
> > kern.debug
> /var/adm/messages
> > auth.debug
> /var/log/central/auth.debug
> > authpriv.debug /var/log/central/auth.debug
> > mail.emerg
> /var/log/central/MIPSlog
> > local0.debug
> /var/log/central/local0.debug
> > local4.debug
> /var/log/central/traceall
> > local6.debug
> /var/cti/logs/SDT/SDT_Audit_Information.log
> >
> >
> >
> >
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> > Sent: Wednesday, September 19, 2012 2:01 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> >> RHEL 6 authentication is being logged with "authpriv.debug", it is
> >> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
> >> Rsyslog 4.7.4...
> >
> > Sorry, I don't get what you mean...
> > Rainer
> >>
> >> Ayelet Regev-Dabah
> >> System Software Platform TL
> >> Comverse
> >> Office: +972 3 6459362
> >> ayelet.regev [at] comverse
> >> www.comverse.com
> >>
> >>
> >> -----Original Message-----
> >> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> bounces [at] lists] On Behalf Of Rainer Gerhards
> >> Sent: Wednesday, September 19, 2012 1:38 PM
> >> To: rsyslog-users
> >> Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> >>
> >> > How can I test the facility support of authpriv without logger?
> >>
> >> You can use rsyslog's tool tcpflood with a specifically-crafted
> >> message. Small doc at
> >>
> >> http://www.rsyslog.com/how-to-use-tcpflood/
> >>
> >> Or you could use the actual application you plan to use.
> >>
> >> Rainer
> >> > Ayelet Regev-Dabah
> >> > System Software Platform TL
> >> > Comverse
> >> > Office: +972 3 6459362
> >> > ayelet.regev [at] comverse
> >> > www.comverse.com
> >> >
> >> >
> >> > -----Original Message-----
> >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > bounces [at] lists] On Behalf Of Rainer Gerhards
> >> > Sent: Wednesday, September 19, 2012 12:23 PM
> >> > To: rsyslog-users
> >> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> >> >
> >> >
> >> >
> >> > > -----Original Message-----
> >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > > bounces [at] lists] On Behalf Of Regev Ayelet
> >> > > Sent: Wednesday, September 19, 2012 11:10 AM
> >> > > To: rsyslog-users
> >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> >> Rsyslog
> >> > >
> >> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> >> > > logger: unknown facility name: authpriv
> >> >
> >> > FYI: logger is not part of rsyslog.
> >> > Rainer
> >> > > smu80a:/ ROOT >
> >> > > smu80a:/ ROOT >
> >> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> >> > > root 376 1 0 Aug 29 ? 1:47
> >> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-
> server.pid
> >> -
> >> > f
> >> > > /etc/rsy
> >> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
> >> > >
> >> > >
> >> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> >> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> >> > pid="17012"
> >> > > x-info="http://www.rsyslog.com"] (re)start
> >> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> >> > > Automatically generated config directives may interfer with your
> >> > > rsyslog.conf settings. We suggest upgrading your config and
> adding
> >> -
> >> > c4
> >> > > as the first rsyslogd option.
> >> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config
> file
> >> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> >> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config
> >> > file!
> >> > > rsyslogd:Warning: backward compatibility layer added to
> following
> >> > > directive to rsyslog.conf: ModLoad immark
> >> > > rsyslogd:Warning: backward compatibility layer added to
> following
> >> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> >> > > rsyslogd:Warning: backward compatibility layer added to
> following
> >> > > directive to rsyslog.conf: ModLoad imuxsock
> >> > >
> >> > >
> >> > > Do I need newer version of Rsyslog to be compiled?
> >> > >
> >> > >
> >> > >
> >> > > Ayelet Regev-Dabah
> >> > > System Software Platform TL
> >> > > Comverse
> >> > > Office: +972 3 6459362
> >> > > ayelet.regev [at] comverse
> >> > > www.comverse.com
> >> > >
> >> > >
> >> > > -----Original Message-----
> >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > > bounces [at] lists] On Behalf Of david [at] lang
> >> > > Sent: Thursday, September 13, 2012 10:31 PM
> >> > > To: rsyslog-users
> >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> >> Rsyslog
> >> > >
> >> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> >> > >
> >> > > > Hi,
> >> > > >
> >> > > > I am currently using syslog on solaris server and they don't
> >> > support
> >> > > authpriv.* facility.
> >> > > > They recommended us to try 3rd party.
> >> > > >
> >> > > > Does rsyslog on Solaris support this facility? From what
> version?
> >> > >
> >> > > I'm pretty sure that it's supported it from the beginning, but
> >> > rsyslog
> >> > > has
> >> > > only supported Solaris fairly recently.
> >> > >
> >> > > If you install rsyslog version 5.x or 6.x (the currently
> supported
> >> > > stable
> >> > > versions), you should be in good shape.
> >> > >
> >> > > As always, test and report any problems before planning a major
> >> > project
> >> > > :)
> >> > >
> >> > > David Lang
> >> > > _______________________________________________
> >> > > rsyslog mailing list
> >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > > http://www.rsyslog.com/professional-services/
> >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> >> > POST
> >> > > if you DON'T LIKE THAT.
> >> > >
> >> > > "This e-mail message may contain confidential, commercial or
> >> > privileged
> >> > > information that constitutes proprietary information of Comverse
> >> > > Technology or its subsidiaries. If you are not the intended
> >> recipient
> >> > > of this message, you are hereby notified that any review, use or
> >> > > distribution of this information is absolutely prohibited and we
> >> > > request that you delete all copies and contact us by e-mailing
> to:
> >> > > security [at] comverse Thank You."
> >> > > _______________________________________________
> >> > > rsyslog mailing list
> >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > > http://www.rsyslog.com/professional-services/
> >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> >> > POST
> >> > > if you DON'T LIKE THAT.
> >> > _______________________________________________
> >> > rsyslog mailing list
> >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > http://www.rsyslog.com/professional-services/
> >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> >> POST
> >> > if you DON'T LIKE THAT.
> >> >
> >> > "This e-mail message may contain confidential, commercial or
> >> privileged
> >> > information that constitutes proprietary information of Comverse
> >> > Technology or its subsidiaries. If you are not the intended
> recipient
> >> > of this message, you are hereby notified that any review, use or
> >> > distribution of this information is absolutely prohibited and we
> >> > request that you delete all copies and contact us by e-mailing to:
> >> > security [at] comverse Thank You."
> >> > _______________________________________________
> >> > rsyslog mailing list
> >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > http://www.rsyslog.com/professional-services/
> >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> >> POST
> >> > if you DON'T LIKE THAT.
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> >> if you DON'T LIKE THAT.
> >>
> >> "This e-mail message may contain confidential, commercial or
> privileged
> >> information that constitutes proprietary information of Comverse
> >> Technology or its subsidiaries. If you are not the intended
> recipient
> >> of this message, you are hereby notified that any review, use or
> >> distribution of this information is absolutely prohibited and we
> >> request that you delete all copies and contact us by e-mailing to:
> >> security [at] comverse Thank You."
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> >> if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
> >
> > ?This e-mail message may contain confidential, commercial or
> privileged information that constitutes proprietary information of
> Comverse Technology or its subsidiaries. If you are not the intended
> recipient of this message, you are hereby notified that any review, use
> or distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You.?
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


Ayelet.Regev at comverse

Sep 20, 2012, 12:11 AM

Post #16 of 22 (370 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

Hope you can see attachments...


Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Rainer Gerhards
Sent: Thursday, September 20, 2012 10:07 AM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 8:59 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> My bad! Still doesn't work.. (I checked linux server not solaris)
> I will send debug events.

Just to make sure we are on the same page: I need a *debug log*, see

http://www.rsyslog.com/doc/troubleshoot.html

Rainer
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 9:47 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> You are right!!!
> I configured the facility on the server as security.debug and got all
> the logs.
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of david [at] lang
> Sent: Thursday, September 20, 2012 12:22 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> One thing that you need to realize is that the facility names are just
> a
> convienience, when the messages are sent over the wire, everything is
> reduced to a number.
>
> As a result, it's possible for one system to know something as one name
> and another system to know it as a different name.
>
> looking at the documentation for the perl module Net::Syslog, it looks
> like authpriv and security are both facility 10, so if you use
> 'security'
> instead of 'authpriv' on the rsyslog box you should get what you
> expect.
>
> David Lang
>
>
> On Wed, 19 Sep 2012, Regev Ayelet wrote:
>
> > Date: Wed, 19 Sep 2012 14:35:01 +0300
> > From: Regev Ayelet <Ayelet.Regev [at] comverse>
> > Reply-To: rsyslog-users <rsyslog [at] lists>
> > To: rsyslog-users <rsyslog [at] lists>
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > I have few systems here:
> >
> > RHEL 6 client with rsyslogd 3.22.1as client configured to send to
> remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
> >
> > This is the client configuration of RHEL6:
> >
> >
> > [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> > $ModLoad immark
> > $MarkMessagePeriod 3600
> > $ActionFileEnableSync on
> > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > $ModLoad imuxsock
> > $ModLoad imklog
> > *.info;mail.none;authpriv.none;cron.none
> /var/log/messages
> > auth,authpriv.*
> /var/log/secure
> > mail.*
> /var/log/maillog
> > cron.* /var/log/cron
> > $WorkDirectory /var/spool/rsyslog # default location for work
> (spool) files
> > $ActionQueueType LinkedList # use asynchronous processing
> > $ActionQueueFileName srvrfwd # set file name, also enables disk
> mode
> > $ActionQueueHighWaterMark 8000 # Default
> > $ActionQueueLowWaterMark 2000 # Default
> > $ActionQueueMaxFileSize 10m # Default is 1m
> > $ActionQueueMaxDiskSpace 8g
> > $ActionResumeRetryCount -1 # infinite retries on insert failure
> > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog
> shuts down
> > local0,auth,authpriv.debug
> @@syslogServer:50514
> > mail.emerg
> @@syslogServer:50514
> > local4.debug
> @@syslogServer:50514
> > *.emerg;mail.none *
> >
> >
> >
> > Authpriv.info is written to /var/log/secure locally and send to
> syslog server for remote logging.
> > (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
> >
> > When the syslogserver is Linux system the authpriv.* events are
> written correctly.
> > When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events
> are not recorded at all. (other facilities are recorded to log files)
> >
> >
> > Linux server configuration file:
> > -----------------------------------------
> >
> > [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> > $ModLoad immark
> > $MarkMessagePeriod 3600
> > $ActionFileEnableSync on
> > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > $ModLoad imklog
> > $ModLoad imudp
> > $UDPServerRun 514
> > $UDPServerRun 1514
> > $ModLoad imtcp
> > $InputTCPServerRun 50514
> > user,daemon,uucp,cron,mark.notice;kern.debug
> /var/log/messages
> > *.emerg;mail.none
> *
> > auth,authpriv.debug
> /var/log/central/auth.debug
> > mail.emerg
> /var/log/central/MIPSlog
> > local0.debug
> /var/log/central/local0.debug
> > local4.debug
> /var/log/central/traceall
> > local1.debug
> /var/log/central/hbase
> >
> >
> >
> > Solaris 10 Configuration file:
> > ----------------------------------
> >
> > smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> > $ModLoad immark
> > $ModLoad imsolaris
> > $MarkMessagePeriod 3600
> > $ActionFileEnableSync on
> > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > $ModLoad imklog
> > $ModLoad imudp
> > $UDPServerRun 514
> > $UDPServerRun 1514
> > $ModLoad imtcp
> > $InputTCPServerRun 50514
> >
> > user,daemon,uucp,cron,mark.notice /var/adm/messages
> > *.emerg;mail.none *
> > kern.debug
> /var/adm/messages
> > auth.debug
> /var/log/central/auth.debug
> > authpriv.debug /var/log/central/auth.debug
> > mail.emerg
> /var/log/central/MIPSlog
> > local0.debug
> /var/log/central/local0.debug
> > local4.debug
> /var/log/central/traceall
> > local6.debug
> /var/cti/logs/SDT/SDT_Audit_Information.log
> >
> >
> >
> >
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> > Sent: Wednesday, September 19, 2012 2:01 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> >> RHEL 6 authentication is being logged with "authpriv.debug", it is
> >> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
> >> Rsyslog 4.7.4...
> >
> > Sorry, I don't get what you mean...
> > Rainer
> >>
> >> Ayelet Regev-Dabah
> >> System Software Platform TL
> >> Comverse
> >> Office: +972 3 6459362
> >> ayelet.regev [at] comverse
> >> www.comverse.com
> >>
> >>
> >> -----Original Message-----
> >> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> bounces [at] lists] On Behalf Of Rainer Gerhards
> >> Sent: Wednesday, September 19, 2012 1:38 PM
> >> To: rsyslog-users
> >> Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> >>
> >> > How can I test the facility support of authpriv without logger?
> >>
> >> You can use rsyslog's tool tcpflood with a specifically-crafted
> >> message. Small doc at
> >>
> >> http://www.rsyslog.com/how-to-use-tcpflood/
> >>
> >> Or you could use the actual application you plan to use.
> >>
> >> Rainer
> >> > Ayelet Regev-Dabah
> >> > System Software Platform TL
> >> > Comverse
> >> > Office: +972 3 6459362
> >> > ayelet.regev [at] comverse
> >> > www.comverse.com
> >> >
> >> >
> >> > -----Original Message-----
> >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > bounces [at] lists] On Behalf Of Rainer Gerhards
> >> > Sent: Wednesday, September 19, 2012 12:23 PM
> >> > To: rsyslog-users
> >> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> >> >
> >> >
> >> >
> >> > > -----Original Message-----
> >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > > bounces [at] lists] On Behalf Of Regev Ayelet
> >> > > Sent: Wednesday, September 19, 2012 11:10 AM
> >> > > To: rsyslog-users
> >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> >> Rsyslog
> >> > >
> >> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> >> > > logger: unknown facility name: authpriv
> >> >
> >> > FYI: logger is not part of rsyslog.
> >> > Rainer
> >> > > smu80a:/ ROOT >
> >> > > smu80a:/ ROOT >
> >> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> >> > > root 376 1 0 Aug 29 ? 1:47
> >> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-
> server.pid
> >> -
> >> > f
> >> > > /etc/rsy
> >> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i rsys
> >> > >
> >> > >
> >> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> >> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> >> > pid="17012"
> >> > > x-info="http://www.rsyslog.com"] (re)start
> >> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> >> > > Automatically generated config directives may interfer with your
> >> > > rsyslog.conf settings. We suggest upgrading your config and
> adding
> >> -
> >> > c4
> >> > > as the first rsyslogd option.
> >> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config
> file
> >> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> >> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog config
> >> > file!
> >> > > rsyslogd:Warning: backward compatibility layer added to
> following
> >> > > directive to rsyslog.conf: ModLoad immark
> >> > > rsyslogd:Warning: backward compatibility layer added to
> following
> >> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> >> > > rsyslogd:Warning: backward compatibility layer added to
> following
> >> > > directive to rsyslog.conf: ModLoad imuxsock
> >> > >
> >> > >
> >> > > Do I need newer version of Rsyslog to be compiled?
> >> > >
> >> > >
> >> > >
> >> > > Ayelet Regev-Dabah
> >> > > System Software Platform TL
> >> > > Comverse
> >> > > Office: +972 3 6459362
> >> > > ayelet.regev [at] comverse
> >> > > www.comverse.com
> >> > >
> >> > >
> >> > > -----Original Message-----
> >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > > bounces [at] lists] On Behalf Of david [at] lang
> >> > > Sent: Thursday, September 13, 2012 10:31 PM
> >> > > To: rsyslog-users
> >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> >> Rsyslog
> >> > >
> >> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> >> > >
> >> > > > Hi,
> >> > > >
> >> > > > I am currently using syslog on solaris server and they don't
> >> > support
> >> > > authpriv.* facility.
> >> > > > They recommended us to try 3rd party.
> >> > > >
> >> > > > Does rsyslog on Solaris support this facility? From what
> version?
> >> > >
> >> > > I'm pretty sure that it's supported it from the beginning, but
> >> > rsyslog
> >> > > has
> >> > > only supported Solaris fairly recently.
> >> > >
> >> > > If you install rsyslog version 5.x or 6.x (the currently
> supported
> >> > > stable
> >> > > versions), you should be in good shape.
> >> > >
> >> > > As always, test and report any problems before planning a major
> >> > project
> >> > > :)
> >> > >
> >> > > David Lang
> >> > > _______________________________________________
> >> > > rsyslog mailing list
> >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > > http://www.rsyslog.com/professional-services/
> >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> >> > POST
> >> > > if you DON'T LIKE THAT.
> >> > >
> >> > > "This e-mail message may contain confidential, commercial or
> >> > privileged
> >> > > information that constitutes proprietary information of Comverse
> >> > > Technology or its subsidiaries. If you are not the intended
> >> recipient
> >> > > of this message, you are hereby notified that any review, use or
> >> > > distribution of this information is absolutely prohibited and we
> >> > > request that you delete all copies and contact us by e-mailing
> to:
> >> > > security [at] comverse Thank You."
> >> > > _______________________________________________
> >> > > rsyslog mailing list
> >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > > http://www.rsyslog.com/professional-services/
> >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> >> > POST
> >> > > if you DON'T LIKE THAT.
> >> > _______________________________________________
> >> > rsyslog mailing list
> >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > http://www.rsyslog.com/professional-services/
> >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> >> POST
> >> > if you DON'T LIKE THAT.
> >> >
> >> > "This e-mail message may contain confidential, commercial or
> >> privileged
> >> > information that constitutes proprietary information of Comverse
> >> > Technology or its subsidiaries. If you are not the intended
> recipient
> >> > of this message, you are hereby notified that any review, use or
> >> > distribution of this information is absolutely prohibited and we
> >> > request that you delete all copies and contact us by e-mailing to:
> >> > security [at] comverse Thank You."
> >> > _______________________________________________
> >> > rsyslog mailing list
> >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > http://www.rsyslog.com/professional-services/
> >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> >> POST
> >> > if you DON'T LIKE THAT.
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> >> if you DON'T LIKE THAT.
> >>
> >> "This e-mail message may contain confidential, commercial or
> privileged
> >> information that constitutes proprietary information of Comverse
> >> Technology or its subsidiaries. If you are not the intended
> recipient
> >> of this message, you are hereby notified that any review, use or
> >> distribution of this information is absolutely prohibited and we
> >> request that you delete all copies and contact us by e-mailing to:
> >> security [at] comverse Thank You."
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> >> if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
> >
> > ?This e-mail message may contain confidential, commercial or
> privileged information that constitutes proprietary information of
> Comverse Technology or its subsidiaries. If you are not the intended
> recipient of this message, you are hereby notified that any review, use
> or distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You.?
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
Attachments: rsyslog-solaris-server-debug.log (99.7 KB)
  rsyslog-client-debug.log (243 KB)


rgerhards at hq

Sep 20, 2012, 12:17 AM

Post #17 of 22 (375 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 9:12 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> Hope you can see attachments...

Can you strip this down so that only the action in question is present? Otherwise it is quite hard to find the right relation.

Please also note that the rsyslog version you use (v4) is legacy and no longer support. I'd still have a look at the debug log as I don't remember I fixed anything in that area. But I may ask you later to update, and be it only to get more to the point debug output.

Rainer
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Thursday, September 20, 2012 10:07 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Thursday, September 20, 2012 8:59 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > My bad! Still doesn't work.. (I checked linux server not solaris)
> > I will send debug events.
>
> Just to make sure we are on the same page: I need a *debug log*, see
>
> http://www.rsyslog.com/doc/troubleshoot.html
>
> Rainer
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Thursday, September 20, 2012 9:47 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > You are right!!!
> > I configured the facility on the server as security.debug and got all
> > the logs.
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of david [at] lang
> > Sent: Thursday, September 20, 2012 12:22 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > One thing that you need to realize is that the facility names are
> just
> > a
> > convienience, when the messages are sent over the wire, everything is
> > reduced to a number.
> >
> > As a result, it's possible for one system to know something as one
> name
> > and another system to know it as a different name.
> >
> > looking at the documentation for the perl module Net::Syslog, it
> looks
> > like authpriv and security are both facility 10, so if you use
> > 'security'
> > instead of 'authpriv' on the rsyslog box you should get what you
> > expect.
> >
> > David Lang
> >
> >
> > On Wed, 19 Sep 2012, Regev Ayelet wrote:
> >
> > > Date: Wed, 19 Sep 2012 14:35:01 +0300
> > > From: Regev Ayelet <Ayelet.Regev [at] comverse>
> > > Reply-To: rsyslog-users <rsyslog [at] lists>
> > > To: rsyslog-users <rsyslog [at] lists>
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > I have few systems here:
> > >
> > > RHEL 6 client with rsyslogd 3.22.1as client configured to send to
> > remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
> > >
> > > This is the client configuration of RHEL6:
> > >
> > >
> > > [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> > > $ModLoad immark
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imuxsock
> > > $ModLoad imklog
> > > *.info;mail.none;authpriv.none;cron.none
> > /var/log/messages
> > > auth,authpriv.*
> > /var/log/secure
> > > mail.*
> > /var/log/maillog
> > > cron.*
> /var/log/cron
> > > $WorkDirectory /var/spool/rsyslog # default location for work
> > (spool) files
> > > $ActionQueueType LinkedList # use asynchronous processing
> > > $ActionQueueFileName srvrfwd # set file name, also enables disk
> > mode
> > > $ActionQueueHighWaterMark 8000 # Default
> > > $ActionQueueLowWaterMark 2000 # Default
> > > $ActionQueueMaxFileSize 10m # Default is 1m
> > > $ActionQueueMaxDiskSpace 8g
> > > $ActionResumeRetryCount -1 # infinite retries on insert
> failure
> > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog
> > shuts down
> > > local0,auth,authpriv.debug
> > @@syslogServer:50514
> > > mail.emerg
> > @@syslogServer:50514
> > > local4.debug
> > @@syslogServer:50514
> > > *.emerg;mail.none *
> > >
> > >
> > >
> > > Authpriv.info is written to /var/log/secure locally and send to
> > syslog server for remote logging.
> > > (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
> > >
> > > When the syslogserver is Linux system the authpriv.* events are
> > written correctly.
> > > When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events
> > are not recorded at all. (other facilities are recorded to log files)
> > >
> > >
> > > Linux server configuration file:
> > > -----------------------------------------
> > >
> > > [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> > > $ModLoad immark
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imklog
> > > $ModLoad imudp
> > > $UDPServerRun 514
> > > $UDPServerRun 1514
> > > $ModLoad imtcp
> > > $InputTCPServerRun 50514
> > > user,daemon,uucp,cron,mark.notice;kern.debug
> > /var/log/messages
> > > *.emerg;mail.none
> > *
> > > auth,authpriv.debug
> > /var/log/central/auth.debug
> > > mail.emerg
> > /var/log/central/MIPSlog
> > > local0.debug
> > /var/log/central/local0.debug
> > > local4.debug
> > /var/log/central/traceall
> > > local1.debug
> > /var/log/central/hbase
> > >
> > >
> > >
> > > Solaris 10 Configuration file:
> > > ----------------------------------
> > >
> > > smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> > > $ModLoad immark
> > > $ModLoad imsolaris
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imklog
> > > $ModLoad imudp
> > > $UDPServerRun 514
> > > $UDPServerRun 1514
> > > $ModLoad imtcp
> > > $InputTCPServerRun 50514
> > >
> > > user,daemon,uucp,cron,mark.notice /var/adm/messages
> > > *.emerg;mail.none *
> > > kern.debug
> > /var/adm/messages
> > > auth.debug
> > /var/log/central/auth.debug
> > > authpriv.debug /var/log/central/auth.debug
> > > mail.emerg
> > /var/log/central/MIPSlog
> > > local0.debug
> > /var/log/central/local0.debug
> > > local4.debug
> > /var/log/central/traceall
> > > local6.debug
> > /var/cti/logs/SDT/SDT_Audit_Information.log
> > >
> > >
> > >
> > >
> > >
> > > Ayelet Regev-Dabah
> > > System Software Platform TL
> > > Comverse
> > > Office: +972 3 6459362
> > > ayelet.regev [at] comverse
> > > www.comverse.com
> > >
> > >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > > Sent: Wednesday, September 19, 2012 2:01 PM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > >> RHEL 6 authentication is being logged with "authpriv.debug", it is
> > >> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
> > >> Rsyslog 4.7.4...
> > >
> > > Sorry, I don't get what you mean...
> > > Rainer
> > >>
> > >> Ayelet Regev-Dabah
> > >> System Software Platform TL
> > >> Comverse
> > >> Office: +972 3 6459362
> > >> ayelet.regev [at] comverse
> > >> www.comverse.com
> > >>
> > >>
> > >> -----Original Message-----
> > >> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> bounces [at] lists] On Behalf Of Rainer Gerhards
> > >> Sent: Wednesday, September 19, 2012 1:38 PM
> > >> To: rsyslog-users
> > >> Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > >>
> > >> > How can I test the facility support of authpriv without logger?
> > >>
> > >> You can use rsyslog's tool tcpflood with a specifically-crafted
> > >> message. Small doc at
> > >>
> > >> http://www.rsyslog.com/how-to-use-tcpflood/
> > >>
> > >> Or you could use the actual application you plan to use.
> > >>
> > >> Rainer
> > >> > Ayelet Regev-Dabah
> > >> > System Software Platform TL
> > >> > Comverse
> > >> > Office: +972 3 6459362
> > >> > ayelet.regev [at] comverse
> > >> > www.comverse.com
> > >> >
> > >> >
> > >> > -----Original Message-----
> > >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > >> > Sent: Wednesday, September 19, 2012 12:23 PM
> > >> > To: rsyslog-users
> > >> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > >> >
> > >> >
> > >> >
> > >> > > -----Original Message-----
> > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > >> > > Sent: Wednesday, September 19, 2012 11:10 AM
> > >> > > To: rsyslog-users
> > >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > >> Rsyslog
> > >> > >
> > >> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> > >> > > logger: unknown facility name: authpriv
> > >> >
> > >> > FYI: logger is not part of rsyslog.
> > >> > Rainer
> > >> > > smu80a:/ ROOT >
> > >> > > smu80a:/ ROOT >
> > >> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> > >> > > root 376 1 0 Aug 29 ? 1:47
> > >> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-
> > server.pid
> > >> -
> > >> > f
> > >> > > /etc/rsy
> > >> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i
> rsys
> > >> > >
> > >> > >
> > >> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> > >> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> > >> > pid="17012"
> > >> > > x-info="http://www.rsyslog.com"] (re)start
> > >> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> > >> > > Automatically generated config directives may interfer with
> your
> > >> > > rsyslog.conf settings. We suggest upgrading your config and
> > adding
> > >> -
> > >> > c4
> > >> > > as the first rsyslogd option.
> > >> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config
> > file
> > >> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> > >> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog
> config
> > >> > file!
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: ModLoad immark
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: ModLoad imuxsock
> > >> > >
> > >> > >
> > >> > > Do I need newer version of Rsyslog to be compiled?
> > >> > >
> > >> > >
> > >> > >
> > >> > > Ayelet Regev-Dabah
> > >> > > System Software Platform TL
> > >> > > Comverse
> > >> > > Office: +972 3 6459362
> > >> > > ayelet.regev [at] comverse
> > >> > > www.comverse.com
> > >> > >
> > >> > >
> > >> > > -----Original Message-----
> > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > > bounces [at] lists] On Behalf Of david [at] lang
> > >> > > Sent: Thursday, September 13, 2012 10:31 PM
> > >> > > To: rsyslog-users
> > >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > >> Rsyslog
> > >> > >
> > >> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> > >> > >
> > >> > > > Hi,
> > >> > > >
> > >> > > > I am currently using syslog on solaris server and they don't
> > >> > support
> > >> > > authpriv.* facility.
> > >> > > > They recommended us to try 3rd party.
> > >> > > >
> > >> > > > Does rsyslog on Solaris support this facility? From what
> > version?
> > >> > >
> > >> > > I'm pretty sure that it's supported it from the beginning, but
> > >> > rsyslog
> > >> > > has
> > >> > > only supported Solaris fairly recently.
> > >> > >
> > >> > > If you install rsyslog version 5.x or 6.x (the currently
> > supported
> > >> > > stable
> > >> > > versions), you should be in good shape.
> > >> > >
> > >> > > As always, test and report any problems before planning a
> major
> > >> > project
> > >> > > :)
> > >> > >
> > >> > > David Lang
> > >> > > _______________________________________________
> > >> > > rsyslog mailing list
> > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > http://www.rsyslog.com/professional-services/
> > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > >> > POST
> > >> > > if you DON'T LIKE THAT.
> > >> > >
> > >> > > "This e-mail message may contain confidential, commercial or
> > >> > privileged
> > >> > > information that constitutes proprietary information of
> Comverse
> > >> > > Technology or its subsidiaries. If you are not the intended
> > >> recipient
> > >> > > of this message, you are hereby notified that any review, use
> or
> > >> > > distribution of this information is absolutely prohibited and
> we
> > >> > > request that you delete all copies and contact us by e-mailing
> > to:
> > >> > > security [at] comverse Thank You."
> > >> > > _______________________________________________
> > >> > > rsyslog mailing list
> > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > http://www.rsyslog.com/professional-services/
> > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > >> > POST
> > >> > > if you DON'T LIKE THAT.
> > >> > _______________________________________________
> > >> > rsyslog mailing list
> > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > http://www.rsyslog.com/professional-services/
> > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > >> POST
> > >> > if you DON'T LIKE THAT.
> > >> >
> > >> > "This e-mail message may contain confidential, commercial or
> > >> privileged
> > >> > information that constitutes proprietary information of Comverse
> > >> > Technology or its subsidiaries. If you are not the intended
> > recipient
> > >> > of this message, you are hereby notified that any review, use or
> > >> > distribution of this information is absolutely prohibited and we
> > >> > request that you delete all copies and contact us by e-mailing
> to:
> > >> > security [at] comverse Thank You."
> > >> > _______________________________________________
> > >> > rsyslog mailing list
> > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > http://www.rsyslog.com/professional-services/
> > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > >> POST
> > >> > if you DON'T LIKE THAT.
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com/professional-services/
> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > >> if you DON'T LIKE THAT.
> > >>
> > >> "This e-mail message may contain confidential, commercial or
> > privileged
> > >> information that constitutes proprietary information of Comverse
> > >> Technology or its subsidiaries. If you are not the intended
> > recipient
> > >> of this message, you are hereby notified that any review, use or
> > >> distribution of this information is absolutely prohibited and we
> > >> request that you delete all copies and contact us by e-mailing to:
> > >> security [at] comverse Thank You."
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com/professional-services/
> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > >> if you DON'T LIKE THAT.
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> > >
> > > ?This e-mail message may contain confidential, commercial or
> > privileged information that constitutes proprietary information of
> > Comverse Technology or its subsidiaries. If you are not the intended
> > recipient of this message, you are hereby notified that any review,
> use
> > or distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You.?
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


rgerhards at hq

Sep 20, 2012, 12:22 AM

Post #18 of 22 (370 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 9:12 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> Hope you can see attachments...
Maybe that's already the problem. Do you think this is an authpriv message?

"<134>Sep 20 10:08:05 AAS_API [ E=2205 P=Warning IP=10.106.101.80 L=https://AAS:50451/aas/api U=ossp_app_user D=Unauthorized access; null"

It is not, as 134 means local0.=info (see RFC5424) => fac 16, sev 6

Rainer
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Thursday, September 20, 2012 10:07 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Thursday, September 20, 2012 8:59 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > My bad! Still doesn't work.. (I checked linux server not solaris)
> > I will send debug events.
>
> Just to make sure we are on the same page: I need a *debug log*, see
>
> http://www.rsyslog.com/doc/troubleshoot.html
>
> Rainer
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Thursday, September 20, 2012 9:47 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > You are right!!!
> > I configured the facility on the server as security.debug and got all
> > the logs.
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of david [at] lang
> > Sent: Thursday, September 20, 2012 12:22 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > One thing that you need to realize is that the facility names are
> just
> > a
> > convienience, when the messages are sent over the wire, everything is
> > reduced to a number.
> >
> > As a result, it's possible for one system to know something as one
> name
> > and another system to know it as a different name.
> >
> > looking at the documentation for the perl module Net::Syslog, it
> looks
> > like authpriv and security are both facility 10, so if you use
> > 'security'
> > instead of 'authpriv' on the rsyslog box you should get what you
> > expect.
> >
> > David Lang
> >
> >
> > On Wed, 19 Sep 2012, Regev Ayelet wrote:
> >
> > > Date: Wed, 19 Sep 2012 14:35:01 +0300
> > > From: Regev Ayelet <Ayelet.Regev [at] comverse>
> > > Reply-To: rsyslog-users <rsyslog [at] lists>
> > > To: rsyslog-users <rsyslog [at] lists>
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > I have few systems here:
> > >
> > > RHEL 6 client with rsyslogd 3.22.1as client configured to send to
> > remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
> > >
> > > This is the client configuration of RHEL6:
> > >
> > >
> > > [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> > > $ModLoad immark
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imuxsock
> > > $ModLoad imklog
> > > *.info;mail.none;authpriv.none;cron.none
> > /var/log/messages
> > > auth,authpriv.*
> > /var/log/secure
> > > mail.*
> > /var/log/maillog
> > > cron.*
> /var/log/cron
> > > $WorkDirectory /var/spool/rsyslog # default location for work
> > (spool) files
> > > $ActionQueueType LinkedList # use asynchronous processing
> > > $ActionQueueFileName srvrfwd # set file name, also enables disk
> > mode
> > > $ActionQueueHighWaterMark 8000 # Default
> > > $ActionQueueLowWaterMark 2000 # Default
> > > $ActionQueueMaxFileSize 10m # Default is 1m
> > > $ActionQueueMaxDiskSpace 8g
> > > $ActionResumeRetryCount -1 # infinite retries on insert
> failure
> > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog
> > shuts down
> > > local0,auth,authpriv.debug
> > @@syslogServer:50514
> > > mail.emerg
> > @@syslogServer:50514
> > > local4.debug
> > @@syslogServer:50514
> > > *.emerg;mail.none *
> > >
> > >
> > >
> > > Authpriv.info is written to /var/log/secure locally and send to
> > syslog server for remote logging.
> > > (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
> > >
> > > When the syslogserver is Linux system the authpriv.* events are
> > written correctly.
> > > When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events
> > are not recorded at all. (other facilities are recorded to log files)
> > >
> > >
> > > Linux server configuration file:
> > > -----------------------------------------
> > >
> > > [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> > > $ModLoad immark
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imklog
> > > $ModLoad imudp
> > > $UDPServerRun 514
> > > $UDPServerRun 1514
> > > $ModLoad imtcp
> > > $InputTCPServerRun 50514
> > > user,daemon,uucp,cron,mark.notice;kern.debug
> > /var/log/messages
> > > *.emerg;mail.none
> > *
> > > auth,authpriv.debug
> > /var/log/central/auth.debug
> > > mail.emerg
> > /var/log/central/MIPSlog
> > > local0.debug
> > /var/log/central/local0.debug
> > > local4.debug
> > /var/log/central/traceall
> > > local1.debug
> > /var/log/central/hbase
> > >
> > >
> > >
> > > Solaris 10 Configuration file:
> > > ----------------------------------
> > >
> > > smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> > > $ModLoad immark
> > > $ModLoad imsolaris
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imklog
> > > $ModLoad imudp
> > > $UDPServerRun 514
> > > $UDPServerRun 1514
> > > $ModLoad imtcp
> > > $InputTCPServerRun 50514
> > >
> > > user,daemon,uucp,cron,mark.notice /var/adm/messages
> > > *.emerg;mail.none *
> > > kern.debug
> > /var/adm/messages
> > > auth.debug
> > /var/log/central/auth.debug
> > > authpriv.debug /var/log/central/auth.debug
> > > mail.emerg
> > /var/log/central/MIPSlog
> > > local0.debug
> > /var/log/central/local0.debug
> > > local4.debug
> > /var/log/central/traceall
> > > local6.debug
> > /var/cti/logs/SDT/SDT_Audit_Information.log
> > >
> > >
> > >
> > >
> > >
> > > Ayelet Regev-Dabah
> > > System Software Platform TL
> > > Comverse
> > > Office: +972 3 6459362
> > > ayelet.regev [at] comverse
> > > www.comverse.com
> > >
> > >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > > Sent: Wednesday, September 19, 2012 2:01 PM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > >> RHEL 6 authentication is being logged with "authpriv.debug", it is
> > >> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
> > >> Rsyslog 4.7.4...
> > >
> > > Sorry, I don't get what you mean...
> > > Rainer
> > >>
> > >> Ayelet Regev-Dabah
> > >> System Software Platform TL
> > >> Comverse
> > >> Office: +972 3 6459362
> > >> ayelet.regev [at] comverse
> > >> www.comverse.com
> > >>
> > >>
> > >> -----Original Message-----
> > >> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> bounces [at] lists] On Behalf Of Rainer Gerhards
> > >> Sent: Wednesday, September 19, 2012 1:38 PM
> > >> To: rsyslog-users
> > >> Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > >>
> > >> > How can I test the facility support of authpriv without logger?
> > >>
> > >> You can use rsyslog's tool tcpflood with a specifically-crafted
> > >> message. Small doc at
> > >>
> > >> http://www.rsyslog.com/how-to-use-tcpflood/
> > >>
> > >> Or you could use the actual application you plan to use.
> > >>
> > >> Rainer
> > >> > Ayelet Regev-Dabah
> > >> > System Software Platform TL
> > >> > Comverse
> > >> > Office: +972 3 6459362
> > >> > ayelet.regev [at] comverse
> > >> > www.comverse.com
> > >> >
> > >> >
> > >> > -----Original Message-----
> > >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > >> > Sent: Wednesday, September 19, 2012 12:23 PM
> > >> > To: rsyslog-users
> > >> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > >> >
> > >> >
> > >> >
> > >> > > -----Original Message-----
> > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > >> > > Sent: Wednesday, September 19, 2012 11:10 AM
> > >> > > To: rsyslog-users
> > >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > >> Rsyslog
> > >> > >
> > >> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> > >> > > logger: unknown facility name: authpriv
> > >> >
> > >> > FYI: logger is not part of rsyslog.
> > >> > Rainer
> > >> > > smu80a:/ ROOT >
> > >> > > smu80a:/ ROOT >
> > >> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> > >> > > root 376 1 0 Aug 29 ? 1:47
> > >> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-
> > server.pid
> > >> -
> > >> > f
> > >> > > /etc/rsy
> > >> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i
> rsys
> > >> > >
> > >> > >
> > >> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> > >> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> > >> > pid="17012"
> > >> > > x-info="http://www.rsyslog.com"] (re)start
> > >> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> > >> > > Automatically generated config directives may interfer with
> your
> > >> > > rsyslog.conf settings. We suggest upgrading your config and
> > adding
> > >> -
> > >> > c4
> > >> > > as the first rsyslogd option.
> > >> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config
> > file
> > >> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> > >> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog
> config
> > >> > file!
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: ModLoad immark
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: ModLoad imuxsock
> > >> > >
> > >> > >
> > >> > > Do I need newer version of Rsyslog to be compiled?
> > >> > >
> > >> > >
> > >> > >
> > >> > > Ayelet Regev-Dabah
> > >> > > System Software Platform TL
> > >> > > Comverse
> > >> > > Office: +972 3 6459362
> > >> > > ayelet.regev [at] comverse
> > >> > > www.comverse.com
> > >> > >
> > >> > >
> > >> > > -----Original Message-----
> > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > > bounces [at] lists] On Behalf Of david [at] lang
> > >> > > Sent: Thursday, September 13, 2012 10:31 PM
> > >> > > To: rsyslog-users
> > >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > >> Rsyslog
> > >> > >
> > >> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> > >> > >
> > >> > > > Hi,
> > >> > > >
> > >> > > > I am currently using syslog on solaris server and they don't
> > >> > support
> > >> > > authpriv.* facility.
> > >> > > > They recommended us to try 3rd party.
> > >> > > >
> > >> > > > Does rsyslog on Solaris support this facility? From what
> > version?
> > >> > >
> > >> > > I'm pretty sure that it's supported it from the beginning, but
> > >> > rsyslog
> > >> > > has
> > >> > > only supported Solaris fairly recently.
> > >> > >
> > >> > > If you install rsyslog version 5.x or 6.x (the currently
> > supported
> > >> > > stable
> > >> > > versions), you should be in good shape.
> > >> > >
> > >> > > As always, test and report any problems before planning a
> major
> > >> > project
> > >> > > :)
> > >> > >
> > >> > > David Lang
> > >> > > _______________________________________________
> > >> > > rsyslog mailing list
> > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > http://www.rsyslog.com/professional-services/
> > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > >> > POST
> > >> > > if you DON'T LIKE THAT.
> > >> > >
> > >> > > "This e-mail message may contain confidential, commercial or
> > >> > privileged
> > >> > > information that constitutes proprietary information of
> Comverse
> > >> > > Technology or its subsidiaries. If you are not the intended
> > >> recipient
> > >> > > of this message, you are hereby notified that any review, use
> or
> > >> > > distribution of this information is absolutely prohibited and
> we
> > >> > > request that you delete all copies and contact us by e-mailing
> > to:
> > >> > > security [at] comverse Thank You."
> > >> > > _______________________________________________
> > >> > > rsyslog mailing list
> > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > http://www.rsyslog.com/professional-services/
> > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > >> > POST
> > >> > > if you DON'T LIKE THAT.
> > >> > _______________________________________________
> > >> > rsyslog mailing list
> > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > http://www.rsyslog.com/professional-services/
> > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > >> POST
> > >> > if you DON'T LIKE THAT.
> > >> >
> > >> > "This e-mail message may contain confidential, commercial or
> > >> privileged
> > >> > information that constitutes proprietary information of Comverse
> > >> > Technology or its subsidiaries. If you are not the intended
> > recipient
> > >> > of this message, you are hereby notified that any review, use or
> > >> > distribution of this information is absolutely prohibited and we
> > >> > request that you delete all copies and contact us by e-mailing
> to:
> > >> > security [at] comverse Thank You."
> > >> > _______________________________________________
> > >> > rsyslog mailing list
> > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > http://www.rsyslog.com/professional-services/
> > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > >> POST
> > >> > if you DON'T LIKE THAT.
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com/professional-services/
> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > >> if you DON'T LIKE THAT.
> > >>
> > >> "This e-mail message may contain confidential, commercial or
> > privileged
> > >> information that constitutes proprietary information of Comverse
> > >> Technology or its subsidiaries. If you are not the intended
> > recipient
> > >> of this message, you are hereby notified that any review, use or
> > >> distribution of this information is absolutely prohibited and we
> > >> request that you delete all copies and contact us by e-mailing to:
> > >> security [at] comverse Thank You."
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com/professional-services/
> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > >> if you DON'T LIKE THAT.
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> > >
> > > ?This e-mail message may contain confidential, commercial or
> > privileged information that constitutes proprietary information of
> > Comverse Technology or its subsidiaries. If you are not the intended
> > recipient of this message, you are hereby notified that any review,
> use
> > or distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You.?
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


Ayelet.Regev at comverse

Sep 20, 2012, 12:31 AM

Post #19 of 22 (375 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

I didn't understand your email.
Im sure it's using authpriv.* facility..
I change the client to send authpriv.* to /var/log/secure2
All events are being recorder locally to /var/log/secure2 but not recorded to the server.


[root [at] rhel ~]# tail -10 /var/log/secure2
Sep 20 11:26:03 rhel6 sshd[4479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=root
Sep 20 11:26:05 rhel6 sshd[4479]: Failed password for root from ::1 port 35103 ssh2
Sep 20 11:26:05 rhel6 sshd[4479]: Accepted password for root from ::1 port 35103 ssh2
Sep 20 11:26:05 rhel6 sshd[4479]: pam_unix(sshd:session): session opened for user root by (uid=0)




Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Rainer Gerhards
Sent: Thursday, September 20, 2012 10:22 AM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 9:12 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> Hope you can see attachments...
Maybe that's already the problem. Do you think this is an authpriv message?

"<134>Sep 20 10:08:05 AAS_API [ E=2205 P=Warning IP=10.106.101.80 L=https://AAS:50451/aas/api U=ossp_app_user D=Unauthorized access; null"

It is not, as 134 means local0.=info (see RFC5424) => fac 16, sev 6

Rainer
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Thursday, September 20, 2012 10:07 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Thursday, September 20, 2012 8:59 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > My bad! Still doesn't work.. (I checked linux server not solaris)
> > I will send debug events.
>
> Just to make sure we are on the same page: I need a *debug log*, see
>
> http://www.rsyslog.com/doc/troubleshoot.html
>
> Rainer
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Thursday, September 20, 2012 9:47 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > You are right!!!
> > I configured the facility on the server as security.debug and got all
> > the logs.
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of david [at] lang
> > Sent: Thursday, September 20, 2012 12:22 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > One thing that you need to realize is that the facility names are
> just
> > a
> > convienience, when the messages are sent over the wire, everything is
> > reduced to a number.
> >
> > As a result, it's possible for one system to know something as one
> name
> > and another system to know it as a different name.
> >
> > looking at the documentation for the perl module Net::Syslog, it
> looks
> > like authpriv and security are both facility 10, so if you use
> > 'security'
> > instead of 'authpriv' on the rsyslog box you should get what you
> > expect.
> >
> > David Lang
> >
> >
> > On Wed, 19 Sep 2012, Regev Ayelet wrote:
> >
> > > Date: Wed, 19 Sep 2012 14:35:01 +0300
> > > From: Regev Ayelet <Ayelet.Regev [at] comverse>
> > > Reply-To: rsyslog-users <rsyslog [at] lists>
> > > To: rsyslog-users <rsyslog [at] lists>
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > I have few systems here:
> > >
> > > RHEL 6 client with rsyslogd 3.22.1as client configured to send to
> > remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
> > >
> > > This is the client configuration of RHEL6:
> > >
> > >
> > > [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> > > $ModLoad immark
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imuxsock
> > > $ModLoad imklog
> > > *.info;mail.none;authpriv.none;cron.none
> > /var/log/messages
> > > auth,authpriv.*
> > /var/log/secure
> > > mail.*
> > /var/log/maillog
> > > cron.*
> /var/log/cron
> > > $WorkDirectory /var/spool/rsyslog # default location for work
> > (spool) files
> > > $ActionQueueType LinkedList # use asynchronous processing
> > > $ActionQueueFileName srvrfwd # set file name, also enables disk
> > mode
> > > $ActionQueueHighWaterMark 8000 # Default
> > > $ActionQueueLowWaterMark 2000 # Default
> > > $ActionQueueMaxFileSize 10m # Default is 1m
> > > $ActionQueueMaxDiskSpace 8g
> > > $ActionResumeRetryCount -1 # infinite retries on insert
> failure
> > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog
> > shuts down
> > > local0,auth,authpriv.debug
> > @@syslogServer:50514
> > > mail.emerg
> > @@syslogServer:50514
> > > local4.debug
> > @@syslogServer:50514
> > > *.emerg;mail.none *
> > >
> > >
> > >
> > > Authpriv.info is written to /var/log/secure locally and send to
> > syslog server for remote logging.
> > > (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
> > >
> > > When the syslogserver is Linux system the authpriv.* events are
> > written correctly.
> > > When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events
> > are not recorded at all. (other facilities are recorded to log files)
> > >
> > >
> > > Linux server configuration file:
> > > -----------------------------------------
> > >
> > > [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> > > $ModLoad immark
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imklog
> > > $ModLoad imudp
> > > $UDPServerRun 514
> > > $UDPServerRun 1514
> > > $ModLoad imtcp
> > > $InputTCPServerRun 50514
> > > user,daemon,uucp,cron,mark.notice;kern.debug
> > /var/log/messages
> > > *.emerg;mail.none
> > *
> > > auth,authpriv.debug
> > /var/log/central/auth.debug
> > > mail.emerg
> > /var/log/central/MIPSlog
> > > local0.debug
> > /var/log/central/local0.debug
> > > local4.debug
> > /var/log/central/traceall
> > > local1.debug
> > /var/log/central/hbase
> > >
> > >
> > >
> > > Solaris 10 Configuration file:
> > > ----------------------------------
> > >
> > > smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> > > $ModLoad immark
> > > $ModLoad imsolaris
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imklog
> > > $ModLoad imudp
> > > $UDPServerRun 514
> > > $UDPServerRun 1514
> > > $ModLoad imtcp
> > > $InputTCPServerRun 50514
> > >
> > > user,daemon,uucp,cron,mark.notice /var/adm/messages
> > > *.emerg;mail.none *
> > > kern.debug
> > /var/adm/messages
> > > auth.debug
> > /var/log/central/auth.debug
> > > authpriv.debug /var/log/central/auth.debug
> > > mail.emerg
> > /var/log/central/MIPSlog
> > > local0.debug
> > /var/log/central/local0.debug
> > > local4.debug
> > /var/log/central/traceall
> > > local6.debug
> > /var/cti/logs/SDT/SDT_Audit_Information.log
> > >
> > >
> > >
> > >
> > >
> > > Ayelet Regev-Dabah
> > > System Software Platform TL
> > > Comverse
> > > Office: +972 3 6459362
> > > ayelet.regev [at] comverse
> > > www.comverse.com
> > >
> > >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > > Sent: Wednesday, September 19, 2012 2:01 PM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > >> RHEL 6 authentication is being logged with "authpriv.debug", it is
> > >> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
> > >> Rsyslog 4.7.4...
> > >
> > > Sorry, I don't get what you mean...
> > > Rainer
> > >>
> > >> Ayelet Regev-Dabah
> > >> System Software Platform TL
> > >> Comverse
> > >> Office: +972 3 6459362
> > >> ayelet.regev [at] comverse
> > >> www.comverse.com
> > >>
> > >>
> > >> -----Original Message-----
> > >> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> bounces [at] lists] On Behalf Of Rainer Gerhards
> > >> Sent: Wednesday, September 19, 2012 1:38 PM
> > >> To: rsyslog-users
> > >> Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > >>
> > >> > How can I test the facility support of authpriv without logger?
> > >>
> > >> You can use rsyslog's tool tcpflood with a specifically-crafted
> > >> message. Small doc at
> > >>
> > >> http://www.rsyslog.com/how-to-use-tcpflood/
> > >>
> > >> Or you could use the actual application you plan to use.
> > >>
> > >> Rainer
> > >> > Ayelet Regev-Dabah
> > >> > System Software Platform TL
> > >> > Comverse
> > >> > Office: +972 3 6459362
> > >> > ayelet.regev [at] comverse
> > >> > www.comverse.com
> > >> >
> > >> >
> > >> > -----Original Message-----
> > >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > >> > Sent: Wednesday, September 19, 2012 12:23 PM
> > >> > To: rsyslog-users
> > >> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > >> >
> > >> >
> > >> >
> > >> > > -----Original Message-----
> > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > >> > > Sent: Wednesday, September 19, 2012 11:10 AM
> > >> > > To: rsyslog-users
> > >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > >> Rsyslog
> > >> > >
> > >> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> > >> > > logger: unknown facility name: authpriv
> > >> >
> > >> > FYI: logger is not part of rsyslog.
> > >> > Rainer
> > >> > > smu80a:/ ROOT >
> > >> > > smu80a:/ ROOT >
> > >> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> > >> > > root 376 1 0 Aug 29 ? 1:47
> > >> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-
> > server.pid
> > >> -
> > >> > f
> > >> > > /etc/rsy
> > >> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i
> rsys
> > >> > >
> > >> > >
> > >> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> > >> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> > >> > pid="17012"
> > >> > > x-info="http://www.rsyslog.com"] (re)start
> > >> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> > >> > > Automatically generated config directives may interfer with
> your
> > >> > > rsyslog.conf settings. We suggest upgrading your config and
> > adding
> > >> -
> > >> > c4
> > >> > > as the first rsyslogd option.
> > >> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config
> > file
> > >> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> > >> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog
> config
> > >> > file!
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: ModLoad immark
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: ModLoad imuxsock
> > >> > >
> > >> > >
> > >> > > Do I need newer version of Rsyslog to be compiled?
> > >> > >
> > >> > >
> > >> > >
> > >> > > Ayelet Regev-Dabah
> > >> > > System Software Platform TL
> > >> > > Comverse
> > >> > > Office: +972 3 6459362
> > >> > > ayelet.regev [at] comverse
> > >> > > www.comverse.com
> > >> > >
> > >> > >
> > >> > > -----Original Message-----
> > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > > bounces [at] lists] On Behalf Of david [at] lang
> > >> > > Sent: Thursday, September 13, 2012 10:31 PM
> > >> > > To: rsyslog-users
> > >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > >> Rsyslog
> > >> > >
> > >> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> > >> > >
> > >> > > > Hi,
> > >> > > >
> > >> > > > I am currently using syslog on solaris server and they don't
> > >> > support
> > >> > > authpriv.* facility.
> > >> > > > They recommended us to try 3rd party.
> > >> > > >
> > >> > > > Does rsyslog on Solaris support this facility? From what
> > version?
> > >> > >
> > >> > > I'm pretty sure that it's supported it from the beginning, but
> > >> > rsyslog
> > >> > > has
> > >> > > only supported Solaris fairly recently.
> > >> > >
> > >> > > If you install rsyslog version 5.x or 6.x (the currently
> > supported
> > >> > > stable
> > >> > > versions), you should be in good shape.
> > >> > >
> > >> > > As always, test and report any problems before planning a
> major
> > >> > project
> > >> > > :)
> > >> > >
> > >> > > David Lang
> > >> > > _______________________________________________
> > >> > > rsyslog mailing list
> > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > http://www.rsyslog.com/professional-services/
> > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > >> > POST
> > >> > > if you DON'T LIKE THAT.
> > >> > >
> > >> > > "This e-mail message may contain confidential, commercial or
> > >> > privileged
> > >> > > information that constitutes proprietary information of
> Comverse
> > >> > > Technology or its subsidiaries. If you are not the intended
> > >> recipient
> > >> > > of this message, you are hereby notified that any review, use
> or
> > >> > > distribution of this information is absolutely prohibited and
> we
> > >> > > request that you delete all copies and contact us by e-mailing
> > to:
> > >> > > security [at] comverse Thank You."
> > >> > > _______________________________________________
> > >> > > rsyslog mailing list
> > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > http://www.rsyslog.com/professional-services/
> > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > >> > POST
> > >> > > if you DON'T LIKE THAT.
> > >> > _______________________________________________
> > >> > rsyslog mailing list
> > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > http://www.rsyslog.com/professional-services/
> > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > >> POST
> > >> > if you DON'T LIKE THAT.
> > >> >
> > >> > "This e-mail message may contain confidential, commercial or
> > >> privileged
> > >> > information that constitutes proprietary information of Comverse
> > >> > Technology or its subsidiaries. If you are not the intended
> > recipient
> > >> > of this message, you are hereby notified that any review, use or
> > >> > distribution of this information is absolutely prohibited and we
> > >> > request that you delete all copies and contact us by e-mailing
> to:
> > >> > security [at] comverse Thank You."
> > >> > _______________________________________________
> > >> > rsyslog mailing list
> > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > http://www.rsyslog.com/professional-services/
> > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > >> POST
> > >> > if you DON'T LIKE THAT.
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com/professional-services/
> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > >> if you DON'T LIKE THAT.
> > >>
> > >> "This e-mail message may contain confidential, commercial or
> > privileged
> > >> information that constitutes proprietary information of Comverse
> > >> Technology or its subsidiaries. If you are not the intended
> > recipient
> > >> of this message, you are hereby notified that any review, use or
> > >> distribution of this information is absolutely prohibited and we
> > >> request that you delete all copies and contact us by e-mailing to:
> > >> security [at] comverse Thank You."
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com/professional-services/
> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > >> if you DON'T LIKE THAT.
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> > >
> > > ?This e-mail message may contain confidential, commercial or
> > privileged information that constitutes proprietary information of
> > Comverse Technology or its subsidiaries. If you are not the intended
> > recipient of this message, you are hereby notified that any review,
> use
> > or distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You.?
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
Attachments: rsyslog-debug.log (221 KB)


Ayelet.Regev at comverse

Sep 20, 2012, 12:40 AM

Post #20 of 22 (377 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

Is it possible that RHEL 5 used:

3950.290234000:main thread: symbolic name: auth ==> 32
3950.290241000:main thread: symbolic name: authpriv ==> 80

Also on RHEL6 it seems that suthpriv is "80"

But on solaris:

symbolic name: security ==> 32
4849.062915669:1: symbolic name: authpriv ==> 32




Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Regev Ayelet
Sent: Thursday, September 20, 2012 10:32 AM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

I didn't understand your email.
Im sure it's using authpriv.* facility..
I change the client to send authpriv.* to /var/log/secure2
All events are being recorder locally to /var/log/secure2 but not recorded to the server.


[root [at] rhel ~]# tail -10 /var/log/secure2
Sep 20 11:26:03 rhel6 sshd[4479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=root
Sep 20 11:26:05 rhel6 sshd[4479]: Failed password for root from ::1 port 35103 ssh2
Sep 20 11:26:05 rhel6 sshd[4479]: Accepted password for root from ::1 port 35103 ssh2
Sep 20 11:26:05 rhel6 sshd[4479]: pam_unix(sshd:session): session opened for user root by (uid=0)




Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Rainer Gerhards
Sent: Thursday, September 20, 2012 10:22 AM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 9:12 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> Hope you can see attachments...
Maybe that's already the problem. Do you think this is an authpriv message?

"<134>Sep 20 10:08:05 AAS_API [ E=2205 P=Warning IP=10.106.101.80 L=https://AAS:50451/aas/api U=ossp_app_user D=Unauthorized access; null"

It is not, as 134 means local0.=info (see RFC5424) => fac 16, sev 6

Rainer
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Thursday, September 20, 2012 10:07 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Thursday, September 20, 2012 8:59 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > My bad! Still doesn't work.. (I checked linux server not solaris)
> > I will send debug events.
>
> Just to make sure we are on the same page: I need a *debug log*, see
>
> http://www.rsyslog.com/doc/troubleshoot.html
>
> Rainer
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Thursday, September 20, 2012 9:47 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > You are right!!!
> > I configured the facility on the server as security.debug and got all
> > the logs.
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of david [at] lang
> > Sent: Thursday, September 20, 2012 12:22 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > One thing that you need to realize is that the facility names are
> just
> > a
> > convienience, when the messages are sent over the wire, everything is
> > reduced to a number.
> >
> > As a result, it's possible for one system to know something as one
> name
> > and another system to know it as a different name.
> >
> > looking at the documentation for the perl module Net::Syslog, it
> looks
> > like authpriv and security are both facility 10, so if you use
> > 'security'
> > instead of 'authpriv' on the rsyslog box you should get what you
> > expect.
> >
> > David Lang
> >
> >
> > On Wed, 19 Sep 2012, Regev Ayelet wrote:
> >
> > > Date: Wed, 19 Sep 2012 14:35:01 +0300
> > > From: Regev Ayelet <Ayelet.Regev [at] comverse>
> > > Reply-To: rsyslog-users <rsyslog [at] lists>
> > > To: rsyslog-users <rsyslog [at] lists>
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > I have few systems here:
> > >
> > > RHEL 6 client with rsyslogd 3.22.1as client configured to send to
> > remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
> > >
> > > This is the client configuration of RHEL6:
> > >
> > >
> > > [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> > > $ModLoad immark
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imuxsock
> > > $ModLoad imklog
> > > *.info;mail.none;authpriv.none;cron.none
> > /var/log/messages
> > > auth,authpriv.*
> > /var/log/secure
> > > mail.*
> > /var/log/maillog
> > > cron.*
> /var/log/cron
> > > $WorkDirectory /var/spool/rsyslog # default location for work
> > (spool) files
> > > $ActionQueueType LinkedList # use asynchronous processing
> > > $ActionQueueFileName srvrfwd # set file name, also enables disk
> > mode
> > > $ActionQueueHighWaterMark 8000 # Default
> > > $ActionQueueLowWaterMark 2000 # Default
> > > $ActionQueueMaxFileSize 10m # Default is 1m
> > > $ActionQueueMaxDiskSpace 8g
> > > $ActionResumeRetryCount -1 # infinite retries on insert
> failure
> > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog
> > shuts down
> > > local0,auth,authpriv.debug
> > @@syslogServer:50514
> > > mail.emerg
> > @@syslogServer:50514
> > > local4.debug
> > @@syslogServer:50514
> > > *.emerg;mail.none *
> > >
> > >
> > >
> > > Authpriv.info is written to /var/log/secure locally and send to
> > syslog server for remote logging.
> > > (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
> > >
> > > When the syslogserver is Linux system the authpriv.* events are
> > written correctly.
> > > When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.* events
> > are not recorded at all. (other facilities are recorded to log files)
> > >
> > >
> > > Linux server configuration file:
> > > -----------------------------------------
> > >
> > > [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> > > $ModLoad immark
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imklog
> > > $ModLoad imudp
> > > $UDPServerRun 514
> > > $UDPServerRun 1514
> > > $ModLoad imtcp
> > > $InputTCPServerRun 50514
> > > user,daemon,uucp,cron,mark.notice;kern.debug
> > /var/log/messages
> > > *.emerg;mail.none
> > *
> > > auth,authpriv.debug
> > /var/log/central/auth.debug
> > > mail.emerg
> > /var/log/central/MIPSlog
> > > local0.debug
> > /var/log/central/local0.debug
> > > local4.debug
> > /var/log/central/traceall
> > > local1.debug
> > /var/log/central/hbase
> > >
> > >
> > >
> > > Solaris 10 Configuration file:
> > > ----------------------------------
> > >
> > > smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> > > $ModLoad immark
> > > $ModLoad imsolaris
> > > $MarkMessagePeriod 3600
> > > $ActionFileEnableSync on
> > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > $ModLoad imklog
> > > $ModLoad imudp
> > > $UDPServerRun 514
> > > $UDPServerRun 1514
> > > $ModLoad imtcp
> > > $InputTCPServerRun 50514
> > >
> > > user,daemon,uucp,cron,mark.notice /var/adm/messages
> > > *.emerg;mail.none *
> > > kern.debug
> > /var/adm/messages
> > > auth.debug
> > /var/log/central/auth.debug
> > > authpriv.debug /var/log/central/auth.debug
> > > mail.emerg
> > /var/log/central/MIPSlog
> > > local0.debug
> > /var/log/central/local0.debug
> > > local4.debug
> > /var/log/central/traceall
> > > local6.debug
> > /var/cti/logs/SDT/SDT_Audit_Information.log
> > >
> > >
> > >
> > >
> > >
> > > Ayelet Regev-Dabah
> > > System Software Platform TL
> > > Comverse
> > > Office: +972 3 6459362
> > > ayelet.regev [at] comverse
> > > www.comverse.com
> > >
> > >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > > Sent: Wednesday, September 19, 2012 2:01 PM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > >> RHEL 6 authentication is being logged with "authpriv.debug", it is
> > >> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10 +
> > >> Rsyslog 4.7.4...
> > >
> > > Sorry, I don't get what you mean...
> > > Rainer
> > >>
> > >> Ayelet Regev-Dabah
> > >> System Software Platform TL
> > >> Comverse
> > >> Office: +972 3 6459362
> > >> ayelet.regev [at] comverse
> > >> www.comverse.com
> > >>
> > >>
> > >> -----Original Message-----
> > >> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> bounces [at] lists] On Behalf Of Rainer Gerhards
> > >> Sent: Wednesday, September 19, 2012 1:38 PM
> > >> To: rsyslog-users
> > >> Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > >>
> > >> > How can I test the facility support of authpriv without logger?
> > >>
> > >> You can use rsyslog's tool tcpflood with a specifically-crafted
> > >> message. Small doc at
> > >>
> > >> http://www.rsyslog.com/how-to-use-tcpflood/
> > >>
> > >> Or you could use the actual application you plan to use.
> > >>
> > >> Rainer
> > >> > Ayelet Regev-Dabah
> > >> > System Software Platform TL
> > >> > Comverse
> > >> > Office: +972 3 6459362
> > >> > ayelet.regev [at] comverse
> > >> > www.comverse.com
> > >> >
> > >> >
> > >> > -----Original Message-----
> > >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > >> > Sent: Wednesday, September 19, 2012 12:23 PM
> > >> > To: rsyslog-users
> > >> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > >> >
> > >> >
> > >> >
> > >> > > -----Original Message-----
> > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > >> > > Sent: Wednesday, September 19, 2012 11:10 AM
> > >> > > To: rsyslog-users
> > >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > >> Rsyslog
> > >> > >
> > >> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> > >> > > logger: unknown facility name: authpriv
> > >> >
> > >> > FYI: logger is not part of rsyslog.
> > >> > Rainer
> > >> > > smu80a:/ ROOT >
> > >> > > smu80a:/ ROOT >
> > >> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> > >> > > root 376 1 0 Aug 29 ? 1:47
> > >> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-
> > server.pid
> > >> -
> > >> > f
> > >> > > /etc/rsy
> > >> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i
> rsys
> > >> > >
> > >> > >
> > >> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> > >> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> > >> > pid="17012"
> > >> > > x-info="http://www.rsyslog.com"] (re)start
> > >> > > rsyslogd:WARNING: rsyslogd is running in compatibility mode.
> > >> > > Automatically generated config directives may interfer with
> your
> > >> > > rsyslog.conf settings. We suggest upgrading your config and
> > adding
> > >> -
> > >> > c4
> > >> > > as the first rsyslogd option.
> > >> > > rsyslogd-2013:CONFIG ERROR: could not interpret master config
> > file
> > >> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> > >> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog
> config
> > >> > file!
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: ModLoad immark
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> > >> > > rsyslogd:Warning: backward compatibility layer added to
> > following
> > >> > > directive to rsyslog.conf: ModLoad imuxsock
> > >> > >
> > >> > >
> > >> > > Do I need newer version of Rsyslog to be compiled?
> > >> > >
> > >> > >
> > >> > >
> > >> > > Ayelet Regev-Dabah
> > >> > > System Software Platform TL
> > >> > > Comverse
> > >> > > Office: +972 3 6459362
> > >> > > ayelet.regev [at] comverse
> > >> > > www.comverse.com
> > >> > >
> > >> > >
> > >> > > -----Original Message-----
> > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > > bounces [at] lists] On Behalf Of david [at] lang
> > >> > > Sent: Thursday, September 13, 2012 10:31 PM
> > >> > > To: rsyslog-users
> > >> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > >> Rsyslog
> > >> > >
> > >> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> > >> > >
> > >> > > > Hi,
> > >> > > >
> > >> > > > I am currently using syslog on solaris server and they don't
> > >> > support
> > >> > > authpriv.* facility.
> > >> > > > They recommended us to try 3rd party.
> > >> > > >
> > >> > > > Does rsyslog on Solaris support this facility? From what
> > version?
> > >> > >
> > >> > > I'm pretty sure that it's supported it from the beginning, but
> > >> > rsyslog
> > >> > > has
> > >> > > only supported Solaris fairly recently.
> > >> > >
> > >> > > If you install rsyslog version 5.x or 6.x (the currently
> > supported
> > >> > > stable
> > >> > > versions), you should be in good shape.
> > >> > >
> > >> > > As always, test and report any problems before planning a
> major
> > >> > project
> > >> > > :)
> > >> > >
> > >> > > David Lang
> > >> > > _______________________________________________
> > >> > > rsyslog mailing list
> > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > http://www.rsyslog.com/professional-services/
> > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > >> > POST
> > >> > > if you DON'T LIKE THAT.
> > >> > >
> > >> > > "This e-mail message may contain confidential, commercial or
> > >> > privileged
> > >> > > information that constitutes proprietary information of
> Comverse
> > >> > > Technology or its subsidiaries. If you are not the intended
> > >> recipient
> > >> > > of this message, you are hereby notified that any review, use
> or
> > >> > > distribution of this information is absolutely prohibited and
> we
> > >> > > request that you delete all copies and contact us by e-mailing
> > to:
> > >> > > security [at] comverse Thank You."
> > >> > > _______________________________________________
> > >> > > rsyslog mailing list
> > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > http://www.rsyslog.com/professional-services/
> > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > >> > POST
> > >> > > if you DON'T LIKE THAT.
> > >> > _______________________________________________
> > >> > rsyslog mailing list
> > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > http://www.rsyslog.com/professional-services/
> > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > >> POST
> > >> > if you DON'T LIKE THAT.
> > >> >
> > >> > "This e-mail message may contain confidential, commercial or
> > >> privileged
> > >> > information that constitutes proprietary information of Comverse
> > >> > Technology or its subsidiaries. If you are not the intended
> > recipient
> > >> > of this message, you are hereby notified that any review, use or
> > >> > distribution of this information is absolutely prohibited and we
> > >> > request that you delete all copies and contact us by e-mailing
> to:
> > >> > security [at] comverse Thank You."
> > >> > _______________________________________________
> > >> > rsyslog mailing list
> > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > http://www.rsyslog.com/professional-services/
> > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > >> POST
> > >> > if you DON'T LIKE THAT.
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com/professional-services/
> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > >> if you DON'T LIKE THAT.
> > >>
> > >> "This e-mail message may contain confidential, commercial or
> > privileged
> > >> information that constitutes proprietary information of Comverse
> > >> Technology or its subsidiaries. If you are not the intended
> > recipient
> > >> of this message, you are hereby notified that any review, use or
> > >> distribution of this information is absolutely prohibited and we
> > >> request that you delete all copies and contact us by e-mailing to:
> > >> security [at] comverse Thank You."
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com/professional-services/
> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > >> if you DON'T LIKE THAT.
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> > >
> > > ?This e-mail message may contain confidential, commercial or
> > privileged information that constitutes proprietary information of
> > Comverse Technology or its subsidiaries. If you are not the intended
> > recipient of this message, you are hereby notified that any review,
> use
> > or distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You.?
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


rgerhards at hq

Sep 20, 2012, 12:44 AM

Post #21 of 22 (375 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 9:41 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> Is it possible that RHEL 5 used:
>
> 3950.290234000:main thread: symbolic name: auth ==> 32
> 3950.290241000:main thread: symbolic name: authpriv ==> 80
>
> Also on RHEL6 it seems that suthpriv is "80"
>
> But on solaris:
>
> symbolic name: security ==> 32
> 4849.062915669:1: symbolic name: authpriv ==> 32

Oh, that's interesting. It may be that rsyslog takes the names from system includes. I need to check that. If that's the case, and the system is so different, I have no immediate idea of how to handle that. If I hardcode in rsyslog, thinks local to solaris will break. Mhhh...

Rainer
>
>
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 10:32 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> I didn't understand your email.
> Im sure it's using authpriv.* facility..
> I change the client to send authpriv.* to /var/log/secure2
> All events are being recorder locally to /var/log/secure2 but not
> recorded to the server.
>
>
> [root [at] rhel ~]# tail -10 /var/log/secure2
> Sep 20 11:26:03 rhel6 sshd[4479]: pam_unix(sshd:auth): authentication
> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost
> user=root
> Sep 20 11:26:05 rhel6 sshd[4479]: Failed password for root from ::1
> port 35103 ssh2
> Sep 20 11:26:05 rhel6 sshd[4479]: Accepted password for root from ::1
> port 35103 ssh2
> Sep 20 11:26:05 rhel6 sshd[4479]: pam_unix(sshd:session): session
> opened for user root by (uid=0)
>
>
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Thursday, September 20, 2012 10:22 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Thursday, September 20, 2012 9:12 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > Hope you can see attachments...
> Maybe that's already the problem. Do you think this is an authpriv
> message?
>
> "<134>Sep 20 10:08:05 AAS_API [ E=2205 P=Warning IP=10.106.101.80
> L=https://AAS:50451/aas/api U=ossp_app_user D=Unauthorized access;
> null"
>
> It is not, as 134 means local0.=info (see RFC5424) => fac 16, sev 6
>
> Rainer
> >
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > Sent: Thursday, September 20, 2012 10:07 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > > Sent: Thursday, September 20, 2012 8:59 AM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > My bad! Still doesn't work.. (I checked linux server not solaris)
> > > I will send debug events.
> >
> > Just to make sure we are on the same page: I need a *debug log*, see
> >
> > http://www.rsyslog.com/doc/troubleshoot.html
> >
> > Rainer
> > >
> > > Ayelet Regev-Dabah
> > > System Software Platform TL
> > > Comverse
> > > Office: +972 3 6459362
> > > ayelet.regev [at] comverse
> > > www.comverse.com
> > >
> > >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > > Sent: Thursday, September 20, 2012 9:47 AM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > You are right!!!
> > > I configured the facility on the server as security.debug and got
> all
> > > the logs.
> > >
> > > Ayelet Regev-Dabah
> > > System Software Platform TL
> > > Comverse
> > > Office: +972 3 6459362
> > > ayelet.regev [at] comverse
> > > www.comverse.com
> > >
> > >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of david [at] lang
> > > Sent: Thursday, September 20, 2012 12:22 AM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > One thing that you need to realize is that the facility names are
> > just
> > > a
> > > convienience, when the messages are sent over the wire, everything
> is
> > > reduced to a number.
> > >
> > > As a result, it's possible for one system to know something as one
> > name
> > > and another system to know it as a different name.
> > >
> > > looking at the documentation for the perl module Net::Syslog, it
> > looks
> > > like authpriv and security are both facility 10, so if you use
> > > 'security'
> > > instead of 'authpriv' on the rsyslog box you should get what you
> > > expect.
> > >
> > > David Lang
> > >
> > >
> > > On Wed, 19 Sep 2012, Regev Ayelet wrote:
> > >
> > > > Date: Wed, 19 Sep 2012 14:35:01 +0300
> > > > From: Regev Ayelet <Ayelet.Regev [at] comverse>
> > > > Reply-To: rsyslog-users <rsyslog [at] lists>
> > > > To: rsyslog-users <rsyslog [at] lists>
> > > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > > >
> > > > I have few systems here:
> > > >
> > > > RHEL 6 client with rsyslogd 3.22.1as client configured to send to
> > > remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
> > > >
> > > > This is the client configuration of RHEL6:
> > > >
> > > >
> > > > [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> > > > $ModLoad immark
> > > > $MarkMessagePeriod 3600
> > > > $ActionFileEnableSync on
> > > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > > $ModLoad imuxsock
> > > > $ModLoad imklog
> > > > *.info;mail.none;authpriv.none;cron.none
> > > /var/log/messages
> > > > auth,authpriv.*
> > > /var/log/secure
> > > > mail.*
> > > /var/log/maillog
> > > > cron.*
> > /var/log/cron
> > > > $WorkDirectory /var/spool/rsyslog # default location for work
> > > (spool) files
> > > > $ActionQueueType LinkedList # use asynchronous processing
> > > > $ActionQueueFileName srvrfwd # set file name, also enables
> disk
> > > mode
> > > > $ActionQueueHighWaterMark 8000 # Default
> > > > $ActionQueueLowWaterMark 2000 # Default
> > > > $ActionQueueMaxFileSize 10m # Default is 1m
> > > > $ActionQueueMaxDiskSpace 8g
> > > > $ActionResumeRetryCount -1 # infinite retries on insert
> > failure
> > > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog
> > > shuts down
> > > > local0,auth,authpriv.debug
> > > @@syslogServer:50514
> > > > mail.emerg
> > > @@syslogServer:50514
> > > > local4.debug
> > > @@syslogServer:50514
> > > > *.emerg;mail.none *
> > > >
> > > >
> > > >
> > > > Authpriv.info is written to /var/log/secure locally and send to
> > > syslog server for remote logging.
> > > > (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
> > > >
> > > > When the syslogserver is Linux system the authpriv.* events are
> > > written correctly.
> > > > When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.*
> events
> > > are not recorded at all. (other facilities are recorded to log
> files)
> > > >
> > > >
> > > > Linux server configuration file:
> > > > -----------------------------------------
> > > >
> > > > [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> > > > $ModLoad immark
> > > > $MarkMessagePeriod 3600
> > > > $ActionFileEnableSync on
> > > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > > $ModLoad imklog
> > > > $ModLoad imudp
> > > > $UDPServerRun 514
> > > > $UDPServerRun 1514
> > > > $ModLoad imtcp
> > > > $InputTCPServerRun 50514
> > > > user,daemon,uucp,cron,mark.notice;kern.debug
> > > /var/log/messages
> > > > *.emerg;mail.none
> > > *
> > > > auth,authpriv.debug
> > > /var/log/central/auth.debug
> > > > mail.emerg
> > > /var/log/central/MIPSlog
> > > > local0.debug
> > > /var/log/central/local0.debug
> > > > local4.debug
> > > /var/log/central/traceall
> > > > local1.debug
> > > /var/log/central/hbase
> > > >
> > > >
> > > >
> > > > Solaris 10 Configuration file:
> > > > ----------------------------------
> > > >
> > > > smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> > > > $ModLoad immark
> > > > $ModLoad imsolaris
> > > > $MarkMessagePeriod 3600
> > > > $ActionFileEnableSync on
> > > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > > $ModLoad imklog
> > > > $ModLoad imudp
> > > > $UDPServerRun 514
> > > > $UDPServerRun 1514
> > > > $ModLoad imtcp
> > > > $InputTCPServerRun 50514
> > > >
> > > > user,daemon,uucp,cron,mark.notice /var/adm/messages
> > > > *.emerg;mail.none *
> > > > kern.debug
> > > /var/adm/messages
> > > > auth.debug
> > > /var/log/central/auth.debug
> > > > authpriv.debug /var/log/central/auth.debug
> > > > mail.emerg
> > > /var/log/central/MIPSlog
> > > > local0.debug
> > > /var/log/central/local0.debug
> > > > local4.debug
> > > /var/log/central/traceall
> > > > local6.debug
> > > /var/cti/logs/SDT/SDT_Audit_Information.log
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > Ayelet Regev-Dabah
> > > > System Software Platform TL
> > > > Comverse
> > > > Office: +972 3 6459362
> > > > ayelet.regev [at] comverse
> > > > www.comverse.com
> > > >
> > > >
> > > > -----Original Message-----
> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of Rainer Gerhards
> > > > Sent: Wednesday, September 19, 2012 2:01 PM
> > > > To: rsyslog-users
> > > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > > >
> > > >> RHEL 6 authentication is being logged with "authpriv.debug", it
> is
> > > >> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10
> +
> > > >> Rsyslog 4.7.4...
> > > >
> > > > Sorry, I don't get what you mean...
> > > > Rainer
> > > >>
> > > >> Ayelet Regev-Dabah
> > > >> System Software Platform TL
> > > >> Comverse
> > > >> Office: +972 3 6459362
> > > >> ayelet.regev [at] comverse
> > > >> www.comverse.com
> > > >>
> > > >>
> > > >> -----Original Message-----
> > > >> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > >> bounces [at] lists] On Behalf Of Rainer Gerhards
> > > >> Sent: Wednesday, September 19, 2012 1:38 PM
> > > >> To: rsyslog-users
> > > >> Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > > Rsyslog
> > > >>
> > > >> > How can I test the facility support of authpriv without
> logger?
> > > >>
> > > >> You can use rsyslog's tool tcpflood with a specifically-crafted
> > > >> message. Small doc at
> > > >>
> > > >> http://www.rsyslog.com/how-to-use-tcpflood/
> > > >>
> > > >> Or you could use the actual application you plan to use.
> > > >>
> > > >> Rainer
> > > >> > Ayelet Regev-Dabah
> > > >> > System Software Platform TL
> > > >> > Comverse
> > > >> > Office: +972 3 6459362
> > > >> > ayelet.regev [at] comverse
> > > >> > www.comverse.com
> > > >> >
> > > >> >
> > > >> > -----Original Message-----
> > > >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > >> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > > >> > Sent: Wednesday, September 19, 2012 12:23 PM
> > > >> > To: rsyslog-users
> > > >> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > > Rsyslog
> > > >> >
> > > >> >
> > > >> >
> > > >> > > -----Original Message-----
> > > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > >> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > > >> > > Sent: Wednesday, September 19, 2012 11:10 AM
> > > >> > > To: rsyslog-users
> > > >> > > Subject: Re: [rsyslog] authpriv.* facility support in
> Solaris
> > > >> Rsyslog
> > > >> > >
> > > >> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> > > >> > > logger: unknown facility name: authpriv
> > > >> >
> > > >> > FYI: logger is not part of rsyslog.
> > > >> > Rainer
> > > >> > > smu80a:/ ROOT >
> > > >> > > smu80a:/ ROOT >
> > > >> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> > > >> > > root 376 1 0 Aug 29 ? 1:47
> > > >> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-
> > > server.pid
> > > >> -
> > > >> > f
> > > >> > > /etc/rsy
> > > >> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i
> > rsys
> > > >> > >
> > > >> > >
> > > >> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> > > >> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> > > >> > pid="17012"
> > > >> > > x-info="http://www.rsyslog.com"] (re)start
> > > >> > > rsyslogd:WARNING: rsyslogd is running in compatibility
> mode.
> > > >> > > Automatically generated config directives may interfer with
> > your
> > > >> > > rsyslog.conf settings. We suggest upgrading your config and
> > > adding
> > > >> -
> > > >> > c4
> > > >> > > as the first rsyslogd option.
> > > >> > > rsyslogd-2013:CONFIG ERROR: could not interpret master
> config
> > > file
> > > >> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> > > >> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog
> > config
> > > >> > file!
> > > >> > > rsyslogd:Warning: backward compatibility layer added to
> > > following
> > > >> > > directive to rsyslog.conf: ModLoad immark
> > > >> > > rsyslogd:Warning: backward compatibility layer added to
> > > following
> > > >> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> > > >> > > rsyslogd:Warning: backward compatibility layer added to
> > > following
> > > >> > > directive to rsyslog.conf: ModLoad imuxsock
> > > >> > >
> > > >> > >
> > > >> > > Do I need newer version of Rsyslog to be compiled?
> > > >> > >
> > > >> > >
> > > >> > >
> > > >> > > Ayelet Regev-Dabah
> > > >> > > System Software Platform TL
> > > >> > > Comverse
> > > >> > > Office: +972 3 6459362
> > > >> > > ayelet.regev [at] comverse
> > > >> > > www.comverse.com
> > > >> > >
> > > >> > >
> > > >> > > -----Original Message-----
> > > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > >> > > bounces [at] lists] On Behalf Of david [at] lang
> > > >> > > Sent: Thursday, September 13, 2012 10:31 PM
> > > >> > > To: rsyslog-users
> > > >> > > Subject: Re: [rsyslog] authpriv.* facility support in
> Solaris
> > > >> Rsyslog
> > > >> > >
> > > >> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> > > >> > >
> > > >> > > > Hi,
> > > >> > > >
> > > >> > > > I am currently using syslog on solaris server and they
> don't
> > > >> > support
> > > >> > > authpriv.* facility.
> > > >> > > > They recommended us to try 3rd party.
> > > >> > > >
> > > >> > > > Does rsyslog on Solaris support this facility? From what
> > > version?
> > > >> > >
> > > >> > > I'm pretty sure that it's supported it from the beginning,
> but
> > > >> > rsyslog
> > > >> > > has
> > > >> > > only supported Solaris fairly recently.
> > > >> > >
> > > >> > > If you install rsyslog version 5.x or 6.x (the currently
> > > supported
> > > >> > > stable
> > > >> > > versions), you should be in good shape.
> > > >> > >
> > > >> > > As always, test and report any problems before planning a
> > major
> > > >> > project
> > > >> > > :)
> > > >> > >
> > > >> > > David Lang
> > > >> > > _______________________________________________
> > > >> > > rsyslog mailing list
> > > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> > > http://www.rsyslog.com/professional-services/
> > > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> > by
> > > a
> > > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and
> DO
> > > NOT
> > > >> > POST
> > > >> > > if you DON'T LIKE THAT.
> > > >> > >
> > > >> > > "This e-mail message may contain confidential, commercial or
> > > >> > privileged
> > > >> > > information that constitutes proprietary information of
> > Comverse
> > > >> > > Technology or its subsidiaries. If you are not the intended
> > > >> recipient
> > > >> > > of this message, you are hereby notified that any review,
> use
> > or
> > > >> > > distribution of this information is absolutely prohibited
> and
> > we
> > > >> > > request that you delete all copies and contact us by e-
> mailing
> > > to:
> > > >> > > security [at] comverse Thank You."
> > > >> > > _______________________________________________
> > > >> > > rsyslog mailing list
> > > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> > > http://www.rsyslog.com/professional-services/
> > > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> > by
> > > a
> > > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and
> DO
> > > NOT
> > > >> > POST
> > > >> > > if you DON'T LIKE THAT.
> > > >> > _______________________________________________
> > > >> > rsyslog mailing list
> > > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> > http://www.rsyslog.com/professional-services/
> > > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > > >> POST
> > > >> > if you DON'T LIKE THAT.
> > > >> >
> > > >> > "This e-mail message may contain confidential, commercial or
> > > >> privileged
> > > >> > information that constitutes proprietary information of
> Comverse
> > > >> > Technology or its subsidiaries. If you are not the intended
> > > recipient
> > > >> > of this message, you are hereby notified that any review, use
> or
> > > >> > distribution of this information is absolutely prohibited and
> we
> > > >> > request that you delete all copies and contact us by e-mailing
> > to:
> > > >> > security [at] comverse Thank You."
> > > >> > _______________________________________________
> > > >> > rsyslog mailing list
> > > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> > http://www.rsyslog.com/professional-services/
> > > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > > >> POST
> > > >> > if you DON'T LIKE THAT.
> > > >> _______________________________________________
> > > >> rsyslog mailing list
> > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> http://www.rsyslog.com/professional-services/
> > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > > POST
> > > >> if you DON'T LIKE THAT.
> > > >>
> > > >> "This e-mail message may contain confidential, commercial or
> > > privileged
> > > >> information that constitutes proprietary information of Comverse
> > > >> Technology or its subsidiaries. If you are not the intended
> > > recipient
> > > >> of this message, you are hereby notified that any review, use or
> > > >> distribution of this information is absolutely prohibited and we
> > > >> request that you delete all copies and contact us by e-mailing
> to:
> > > >> security [at] comverse Thank You."
> > > >> _______________________________________________
> > > >> rsyslog mailing list
> > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> http://www.rsyslog.com/professional-services/
> > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > > POST
> > > >> if you DON'T LIKE THAT.
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > > >
> > > > ?This e-mail message may contain confidential, commercial or
> > > privileged information that constitutes proprietary information of
> > > Comverse Technology or its subsidiaries. If you are not the
> intended
> > > recipient of this message, you are hereby notified that any review,
> > use
> > > or distribution of this information is absolutely prohibited and we
> > > request that you delete all copies and contact us by e-mailing to:
> > > security [at] comverse Thank You.?
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > >
> > > "This e-mail message may contain confidential, commercial or
> > privileged
> > > information that constitutes proprietary information of Comverse
> > > Technology or its subsidiaries. If you are not the intended
> recipient
> > > of this message, you are hereby notified that any review, use or
> > > distribution of this information is absolutely prohibited and we
> > > request that you delete all copies and contact us by e-mailing to:
> > > security [at] comverse Thank You."
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > >
> > > "This e-mail message may contain confidential, commercial or
> > privileged
> > > information that constitutes proprietary information of Comverse
> > > Technology or its subsidiaries. If you are not the intended
> recipient
> > > of this message, you are hereby notified that any review, use or
> > > distribution of this information is absolutely prohibited and we
> > > request that you delete all copies and contact us by e-mailing to:
> > > security [at] comverse Thank You."
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


Ayelet.Regev at comverse

Sep 20, 2012, 12:51 AM

Post #22 of 22 (375 views)
Permalink
Re: authpriv.* facility support in Solaris Rsyslog [In reply to]

Just update us if its limitation or it can be fixed...
If its limitation we will force our users to use rsyslog-server only on linux hosts.


Ayelet Regev-Dabah
System Software Platform TL
Comverse
Office: +972 3 6459362
ayelet.regev [at] comverse
www.comverse.com


-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of Rainer Gerhards
Sent: Thursday, September 20, 2012 10:44 AM
To: rsyslog-users
Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 9:41 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> Is it possible that RHEL 5 used:
>
> 3950.290234000:main thread: symbolic name: auth ==> 32
> 3950.290241000:main thread: symbolic name: authpriv ==> 80
>
> Also on RHEL6 it seems that suthpriv is "80"
>
> But on solaris:
>
> symbolic name: security ==> 32
> 4849.062915669:1: symbolic name: authpriv ==> 32

Oh, that's interesting. It may be that rsyslog takes the names from system includes. I need to check that. If that's the case, and the system is so different, I have no immediate idea of how to handle that. If I hardcode in rsyslog, thinks local to solaris will break. Mhhh...

Rainer
>
>
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Regev Ayelet
> Sent: Thursday, September 20, 2012 10:32 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> I didn't understand your email.
> Im sure it's using authpriv.* facility..
> I change the client to send authpriv.* to /var/log/secure2
> All events are being recorder locally to /var/log/secure2 but not
> recorded to the server.
>
>
> [root [at] rhel ~]# tail -10 /var/log/secure2
> Sep 20 11:26:03 rhel6 sshd[4479]: pam_unix(sshd:auth): authentication
> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost
> user=root
> Sep 20 11:26:05 rhel6 sshd[4479]: Failed password for root from ::1
> port 35103 ssh2
> Sep 20 11:26:05 rhel6 sshd[4479]: Accepted password for root from ::1
> port 35103 ssh2
> Sep 20 11:26:05 rhel6 sshd[4479]: pam_unix(sshd:session): session
> opened for user root by (uid=0)
>
>
>
>
> Ayelet Regev-Dabah
> System Software Platform TL
> Comverse
> Office: +972 3 6459362
> ayelet.regev [at] comverse
> www.comverse.com
>
>
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Rainer Gerhards
> Sent: Thursday, September 20, 2012 10:22 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Regev Ayelet
> > Sent: Thursday, September 20, 2012 9:12 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > Hope you can see attachments...
> Maybe that's already the problem. Do you think this is an authpriv
> message?
>
> "<134>Sep 20 10:08:05 AAS_API [ E=2205 P=Warning IP=10.106.101.80
> L=https://AAS:50451/aas/api U=ossp_app_user D=Unauthorized access;
> null"
>
> It is not, as 134 means local0.=info (see RFC5424) => fac 16, sev 6
>
> Rainer
> >
> >
> > Ayelet Regev-Dabah
> > System Software Platform TL
> > Comverse
> > Office: +972 3 6459362
> > ayelet.regev [at] comverse
> > www.comverse.com
> >
> >
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > Sent: Thursday, September 20, 2012 10:07 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris Rsyslog
> >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > > Sent: Thursday, September 20, 2012 8:59 AM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > My bad! Still doesn't work.. (I checked linux server not solaris)
> > > I will send debug events.
> >
> > Just to make sure we are on the same page: I need a *debug log*, see
> >
> > http://www.rsyslog.com/doc/troubleshoot.html
> >
> > Rainer
> > >
> > > Ayelet Regev-Dabah
> > > System Software Platform TL
> > > Comverse
> > > Office: +972 3 6459362
> > > ayelet.regev [at] comverse
> > > www.comverse.com
> > >
> > >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > > Sent: Thursday, September 20, 2012 9:47 AM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > You are right!!!
> > > I configured the facility on the server as security.debug and got
> all
> > > the logs.
> > >
> > > Ayelet Regev-Dabah
> > > System Software Platform TL
> > > Comverse
> > > Office: +972 3 6459362
> > > ayelet.regev [at] comverse
> > > www.comverse.com
> > >
> > >
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of david [at] lang
> > > Sent: Thursday, September 20, 2012 12:22 AM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> Rsyslog
> > >
> > > One thing that you need to realize is that the facility names are
> > just
> > > a
> > > convienience, when the messages are sent over the wire, everything
> is
> > > reduced to a number.
> > >
> > > As a result, it's possible for one system to know something as one
> > name
> > > and another system to know it as a different name.
> > >
> > > looking at the documentation for the perl module Net::Syslog, it
> > looks
> > > like authpriv and security are both facility 10, so if you use
> > > 'security'
> > > instead of 'authpriv' on the rsyslog box you should get what you
> > > expect.
> > >
> > > David Lang
> > >
> > >
> > > On Wed, 19 Sep 2012, Regev Ayelet wrote:
> > >
> > > > Date: Wed, 19 Sep 2012 14:35:01 +0300
> > > > From: Regev Ayelet <Ayelet.Regev [at] comverse>
> > > > Reply-To: rsyslog-users <rsyslog [at] lists>
> > > > To: rsyslog-users <rsyslog [at] lists>
> > > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > > >
> > > > I have few systems here:
> > > >
> > > > RHEL 6 client with rsyslogd 3.22.1as client configured to send to
> > > remote rsyslog servers RHEL5 and solaris 10 (with Rsyslog 4.7.4)
> > > >
> > > > This is the client configuration of RHEL6:
> > > >
> > > >
> > > > [root [at] linu ~]# more /etc/rsyslog.conf | grep -v ^#
> > > > $ModLoad immark
> > > > $MarkMessagePeriod 3600
> > > > $ActionFileEnableSync on
> > > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > > $ModLoad imuxsock
> > > > $ModLoad imklog
> > > > *.info;mail.none;authpriv.none;cron.none
> > > /var/log/messages
> > > > auth,authpriv.*
> > > /var/log/secure
> > > > mail.*
> > > /var/log/maillog
> > > > cron.*
> > /var/log/cron
> > > > $WorkDirectory /var/spool/rsyslog # default location for work
> > > (spool) files
> > > > $ActionQueueType LinkedList # use asynchronous processing
> > > > $ActionQueueFileName srvrfwd # set file name, also enables
> disk
> > > mode
> > > > $ActionQueueHighWaterMark 8000 # Default
> > > > $ActionQueueLowWaterMark 2000 # Default
> > > > $ActionQueueMaxFileSize 10m # Default is 1m
> > > > $ActionQueueMaxDiskSpace 8g
> > > > $ActionResumeRetryCount -1 # infinite retries on insert
> > failure
> > > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog
> > > shuts down
> > > > local0,auth,authpriv.debug
> > > @@syslogServer:50514
> > > > mail.emerg
> > > @@syslogServer:50514
> > > > local4.debug
> > > @@syslogServer:50514
> > > > *.emerg;mail.none *
> > > >
> > > >
> > > >
> > > > Authpriv.info is written to /var/log/secure locally and send to
> > > syslog server for remote logging.
> > > > (RHEL5 clients used auth.info, RHEL6 uses authpriv.info)
> > > >
> > > > When the syslogserver is Linux system the authpriv.* events are
> > > written correctly.
> > > > When syslogServer is solaris 10 (rsyslogd 4.7.4) authpriv.*
> events
> > > are not recorded at all. (other facilities are recorded to log
> files)
> > > >
> > > >
> > > > Linux server configuration file:
> > > > -----------------------------------------
> > > >
> > > > [root [at] smu164 ~]# more /etc/rsyslog-server.conf | grep -v ^#
> > > > $ModLoad immark
> > > > $MarkMessagePeriod 3600
> > > > $ActionFileEnableSync on
> > > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > > $ModLoad imklog
> > > > $ModLoad imudp
> > > > $UDPServerRun 514
> > > > $UDPServerRun 1514
> > > > $ModLoad imtcp
> > > > $InputTCPServerRun 50514
> > > > user,daemon,uucp,cron,mark.notice;kern.debug
> > > /var/log/messages
> > > > *.emerg;mail.none
> > > *
> > > > auth,authpriv.debug
> > > /var/log/central/auth.debug
> > > > mail.emerg
> > > /var/log/central/MIPSlog
> > > > local0.debug
> > > /var/log/central/local0.debug
> > > > local4.debug
> > > /var/log/central/traceall
> > > > local1.debug
> > > /var/log/central/hbase
> > > >
> > > >
> > > >
> > > > Solaris 10 Configuration file:
> > > > ----------------------------------
> > > >
> > > > smu80a:/ ROOT > more /etc/rsyslog-server.conf | grep -v ^#
> > > > $ModLoad immark
> > > > $ModLoad imsolaris
> > > > $MarkMessagePeriod 3600
> > > > $ActionFileEnableSync on
> > > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> > > > $ModLoad imklog
> > > > $ModLoad imudp
> > > > $UDPServerRun 514
> > > > $UDPServerRun 1514
> > > > $ModLoad imtcp
> > > > $InputTCPServerRun 50514
> > > >
> > > > user,daemon,uucp,cron,mark.notice /var/adm/messages
> > > > *.emerg;mail.none *
> > > > kern.debug
> > > /var/adm/messages
> > > > auth.debug
> > > /var/log/central/auth.debug
> > > > authpriv.debug /var/log/central/auth.debug
> > > > mail.emerg
> > > /var/log/central/MIPSlog
> > > > local0.debug
> > > /var/log/central/local0.debug
> > > > local4.debug
> > > /var/log/central/traceall
> > > > local6.debug
> > > /var/cti/logs/SDT/SDT_Audit_Information.log
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > Ayelet Regev-Dabah
> > > > System Software Platform TL
> > > > Comverse
> > > > Office: +972 3 6459362
> > > > ayelet.regev [at] comverse
> > > > www.comverse.com
> > > >
> > > >
> > > > -----Original Message-----
> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of Rainer Gerhards
> > > > Sent: Wednesday, September 19, 2012 2:01 PM
> > > > To: rsyslog-users
> > > > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > Rsyslog
> > > >
> > > >> RHEL 6 authentication is being logged with "authpriv.debug", it
> is
> > > >> shown on RHEL5 and RHEL 6 rsyslog server, but not on Solaris 10
> +
> > > >> Rsyslog 4.7.4...
> > > >
> > > > Sorry, I don't get what you mean...
> > > > Rainer
> > > >>
> > > >> Ayelet Regev-Dabah
> > > >> System Software Platform TL
> > > >> Comverse
> > > >> Office: +972 3 6459362
> > > >> ayelet.regev [at] comverse
> > > >> www.comverse.com
> > > >>
> > > >>
> > > >> -----Original Message-----
> > > >> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > >> bounces [at] lists] On Behalf Of Rainer Gerhards
> > > >> Sent: Wednesday, September 19, 2012 1:38 PM
> > > >> To: rsyslog-users
> > > >> Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > > Rsyslog
> > > >>
> > > >> > How can I test the facility support of authpriv without
> logger?
> > > >>
> > > >> You can use rsyslog's tool tcpflood with a specifically-crafted
> > > >> message. Small doc at
> > > >>
> > > >> http://www.rsyslog.com/how-to-use-tcpflood/
> > > >>
> > > >> Or you could use the actual application you plan to use.
> > > >>
> > > >> Rainer
> > > >> > Ayelet Regev-Dabah
> > > >> > System Software Platform TL
> > > >> > Comverse
> > > >> > Office: +972 3 6459362
> > > >> > ayelet.regev [at] comverse
> > > >> > www.comverse.com
> > > >> >
> > > >> >
> > > >> > -----Original Message-----
> > > >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > >> > bounces [at] lists] On Behalf Of Rainer Gerhards
> > > >> > Sent: Wednesday, September 19, 2012 12:23 PM
> > > >> > To: rsyslog-users
> > > >> > Subject: Re: [rsyslog] authpriv.* facility support in Solaris
> > > Rsyslog
> > > >> >
> > > >> >
> > > >> >
> > > >> > > -----Original Message-----
> > > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > >> > > bounces [at] lists] On Behalf Of Regev Ayelet
> > > >> > > Sent: Wednesday, September 19, 2012 11:10 AM
> > > >> > > To: rsyslog-users
> > > >> > > Subject: Re: [rsyslog] authpriv.* facility support in
> Solaris
> > > >> Rsyslog
> > > >> > >
> > > >> > > smu80a:/ ROOT > logger -p "authpriv.debug" lala
> > > >> > > logger: unknown facility name: authpriv
> > > >> >
> > > >> > FYI: logger is not part of rsyslog.
> > > >> > Rainer
> > > >> > > smu80a:/ ROOT >
> > > >> > > smu80a:/ ROOT >
> > > >> > > smu80a:/ ROOT > ps -ef | grep -i rsys
> > > >> > > root 376 1 0 Aug 29 ? 1:47
> > > >> > > /usr/local/Rsyslog/sbin/rsyslogd -c4 -i /var/run/rsyslog-
> > > server.pid
> > > >> -
> > > >> > f
> > > >> > > /etc/rsy
> > > >> > > root 16527 16270 0 12:06:35 pts/1 0:00 grep -i
> > rsys
> > > >> > >
> > > >> > >
> > > >> > > smu80a:/ ROOT > /usr/local/Rsyslog/sbin/rsyslogd -usage
> > > >> > > rsyslogd: [origin software="rsyslogd" swVersion="4.7.4" x-
> > > >> > pid="17012"
> > > >> > > x-info="http://www.rsyslog.com"] (re)start
> > > >> > > rsyslogd:WARNING: rsyslogd is running in compatibility
> mode.
> > > >> > > Automatically generated config directives may interfer with
> > your
> > > >> > > rsyslog.conf settings. We suggest upgrading your config and
> > > adding
> > > >> -
> > > >> > c4
> > > >> > > as the first rsyslogd option.
> > > >> > > rsyslogd-2013:CONFIG ERROR: could not interpret master
> config
> > > file
> > > >> > > '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2013 ]
> > > >> > > rsyslogd:EMERGENCY CONFIGURATION ACTIVATED - fix rsyslog
> > config
> > > >> > file!
> > > >> > > rsyslogd:Warning: backward compatibility layer added to
> > > following
> > > >> > > directive to rsyslog.conf: ModLoad immark
> > > >> > > rsyslogd:Warning: backward compatibility layer added to
> > > following
> > > >> > > directive to rsyslog.conf: MarkMessagePeriod 1200
> > > >> > > rsyslogd:Warning: backward compatibility layer added to
> > > following
> > > >> > > directive to rsyslog.conf: ModLoad imuxsock
> > > >> > >
> > > >> > >
> > > >> > > Do I need newer version of Rsyslog to be compiled?
> > > >> > >
> > > >> > >
> > > >> > >
> > > >> > > Ayelet Regev-Dabah
> > > >> > > System Software Platform TL
> > > >> > > Comverse
> > > >> > > Office: +972 3 6459362
> > > >> > > ayelet.regev [at] comverse
> > > >> > > www.comverse.com
> > > >> > >
> > > >> > >
> > > >> > > -----Original Message-----
> > > >> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > >> > > bounces [at] lists] On Behalf Of david [at] lang
> > > >> > > Sent: Thursday, September 13, 2012 10:31 PM
> > > >> > > To: rsyslog-users
> > > >> > > Subject: Re: [rsyslog] authpriv.* facility support in
> Solaris
> > > >> Rsyslog
> > > >> > >
> > > >> > > On Thu, 13 Sep 2012, Regev Ayelet wrote:
> > > >> > >
> > > >> > > > Hi,
> > > >> > > >
> > > >> > > > I am currently using syslog on solaris server and they
> don't
> > > >> > support
> > > >> > > authpriv.* facility.
> > > >> > > > They recommended us to try 3rd party.
> > > >> > > >
> > > >> > > > Does rsyslog on Solaris support this facility? From what
> > > version?
> > > >> > >
> > > >> > > I'm pretty sure that it's supported it from the beginning,
> but
> > > >> > rsyslog
> > > >> > > has
> > > >> > > only supported Solaris fairly recently.
> > > >> > >
> > > >> > > If you install rsyslog version 5.x or 6.x (the currently
> > > supported
> > > >> > > stable
> > > >> > > versions), you should be in good shape.
> > > >> > >
> > > >> > > As always, test and report any problems before planning a
> > major
> > > >> > project
> > > >> > > :)
> > > >> > >
> > > >> > > David Lang
> > > >> > > _______________________________________________
> > > >> > > rsyslog mailing list
> > > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> > > http://www.rsyslog.com/professional-services/
> > > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> > by
> > > a
> > > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and
> DO
> > > NOT
> > > >> > POST
> > > >> > > if you DON'T LIKE THAT.
> > > >> > >
> > > >> > > "This e-mail message may contain confidential, commercial or
> > > >> > privileged
> > > >> > > information that constitutes proprietary information of
> > Comverse
> > > >> > > Technology or its subsidiaries. If you are not the intended
> > > >> recipient
> > > >> > > of this message, you are hereby notified that any review,
> use
> > or
> > > >> > > distribution of this information is absolutely prohibited
> and
> > we
> > > >> > > request that you delete all copies and contact us by e-
> mailing
> > > to:
> > > >> > > security [at] comverse Thank You."
> > > >> > > _______________________________________________
> > > >> > > rsyslog mailing list
> > > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> > > http://www.rsyslog.com/professional-services/
> > > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> > by
> > > a
> > > >> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and
> DO
> > > NOT
> > > >> > POST
> > > >> > > if you DON'T LIKE THAT.
> > > >> > _______________________________________________
> > > >> > rsyslog mailing list
> > > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> > http://www.rsyslog.com/professional-services/
> > > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > > >> POST
> > > >> > if you DON'T LIKE THAT.
> > > >> >
> > > >> > "This e-mail message may contain confidential, commercial or
> > > >> privileged
> > > >> > information that constitutes proprietary information of
> Comverse
> > > >> > Technology or its subsidiaries. If you are not the intended
> > > recipient
> > > >> > of this message, you are hereby notified that any review, use
> or
> > > >> > distribution of this information is absolutely prohibited and
> we
> > > >> > request that you delete all copies and contact us by e-mailing
> > to:
> > > >> > security [at] comverse Thank You."
> > > >> > _______________________________________________
> > > >> > rsyslog mailing list
> > > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> > http://www.rsyslog.com/professional-services/
> > > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > a
> > > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT
> > > >> POST
> > > >> > if you DON'T LIKE THAT.
> > > >> _______________________________________________
> > > >> rsyslog mailing list
> > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> http://www.rsyslog.com/professional-services/
> > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > > POST
> > > >> if you DON'T LIKE THAT.
> > > >>
> > > >> "This e-mail message may contain confidential, commercial or
> > > privileged
> > > >> information that constitutes proprietary information of Comverse
> > > >> Technology or its subsidiaries. If you are not the intended
> > > recipient
> > > >> of this message, you are hereby notified that any review, use or
> > > >> distribution of this information is absolutely prohibited and we
> > > >> request that you delete all copies and contact us by e-mailing
> to:
> > > >> security [at] comverse Thank You."
> > > >> _______________________________________________
> > > >> rsyslog mailing list
> > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > >> http://www.rsyslog.com/professional-services/
> > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> NOT
> > > POST
> > > >> if you DON'T LIKE THAT.
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > > >
> > > > ?This e-mail message may contain confidential, commercial or
> > > privileged information that constitutes proprietary information of
> > > Comverse Technology or its subsidiaries. If you are not the
> intended
> > > recipient of this message, you are hereby notified that any review,
> > use
> > > or distribution of this information is absolutely prohibited and we
> > > request that you delete all copies and contact us by e-mailing to:
> > > security [at] comverse Thank You.?
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > >
> > > "This e-mail message may contain confidential, commercial or
> > privileged
> > > information that constitutes proprietary information of Comverse
> > > Technology or its subsidiaries. If you are not the intended
> recipient
> > > of this message, you are hereby notified that any review, use or
> > > distribution of this information is absolutely prohibited and we
> > > request that you delete all copies and contact us by e-mailing to:
> > > security [at] comverse Thank You."
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > >
> > > "This e-mail message may contain confidential, commercial or
> > privileged
> > > information that constitutes proprietary information of Comverse
> > > Technology or its subsidiaries. If you are not the intended
> recipient
> > > of this message, you are hereby notified that any review, use or
> > > distribution of this information is absolutely prohibited and we
> > > request that you delete all copies and contact us by e-mailing to:
> > > security [at] comverse Thank You."
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > POST
> > > if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > if you DON'T LIKE THAT.
> >
> > "This e-mail message may contain confidential, commercial or
> privileged
> > information that constitutes proprietary information of Comverse
> > Technology or its subsidiaries. If you are not the intended recipient
> > of this message, you are hereby notified that any review, use or
> > distribution of this information is absolutely prohibited and we
> > request that you delete all copies and contact us by e-mailing to:
> > security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
>
> "This e-mail message may contain confidential, commercial or privileged
> information that constitutes proprietary information of Comverse
> Technology or its subsidiaries. If you are not the intended recipient
> of this message, you are hereby notified that any review, use or
> distribution of this information is absolutely prohibited and we
> request that you delete all copies and contact us by e-mailing to:
> security [at] comverse Thank You."
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

“This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security [at] comverse Thank You.”
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

RSyslog users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.