Enabling Syslog on a Unix Server

Problem

You want to configure a Unix server to accept syslog messages from routers.

Solution

For most flavors of Unix and Linux, you simply need to modify the /etc/syslog.conf file on your Unix server to include the following entry (basic configuration):

local7.info /var/log/rtrlog

This example stores all router messages using the default logging facility for Cisco routers, local7. It also stipulates that router log messages with a severity level of informational or greater (refer to Table 18-1) will be directed to the file /var/log/rtrlog. The syntax of the syslog.conf file is log facility.priority notation, followed by a filename.

Note that the syslog.conf file needs tabs, and not spaces, between the various fields.

Discussion

By default, your syslog server may not be equipped to handle router log messages. The above configuration entry will caused the syslog daemon to store all router messages, of informational severity level and higher, to a file called /var/log/rtrlog. Before the server will begin forwarding messages to this file, it must exist and have the proper file attributes:

Freebsd# cd /var/log
/var/log
Freebsd# touch rtrlog
Freebsd# chmod 644 rtrlog
Freebsd#

Then you should reload or HUP the syslog daemon to force it to read your new configuration file and begin storing router log messages. On System V-based Unix servers, use the following commands:

Solaris# ps -ef | grep syslogd
 root 142 1 0 Nov 12 ? 1:21 /usr/sbin/syslogd -m 30
Solaris# kill -HUP 142
Solaris#

On BSD-based Unix and Linux servers, use the following commands:

Freebsd# ps -aux | grep syslogd
root 66 0.0 0.2 960 624 ?? Ss 3Mar02 0:28.66 syslogd -m 30
Freebsd# kill -HUP 66
Freebsd#

For more information on your syslog daemon and its configuration options, check your system's manual pages by using the Unix commands man syslog and man syslog.conf.

Note that some Unix flavors, including most Linux distributions, require the syslog daemon be initialized with the -r switch before they will accept remote syslog messages. See your manual pages for more information (man syslogd).