From owner-freebsd-questions Sun Sep 20 06:44:25 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id GAA26543 for freebsd-questions-outgoing; Sun, 20 Sep 1998 06:44:25 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from lucy.bedford.net (lucy.bedford.net [206.99.145.54]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id GAA26538 for ; Sun, 20 Sep 1998 06:44:21 -0700 (PDT) (envelope-from listread@lucy.bedford.net) Received: (from listread@localhost) by lucy.bedford.net (8.8.8/8.8.8) id JAA03997; Sun, 20 Sep 1998 09:26:20 -0400 (EDT) (envelope-from listread) Message-Id: <199809201326.JAA03997@lucy.bedford.net> Subject: Re: 2nd try + update: whats wrong with this sylog.conf? In-Reply-To: <004301bde319$d3d54960$0cf896d0@work2.insolwwb.net> from Mike Grommet at "Sep 18, 98 10:34:30 am" To: mgrommet@insolwwb.net (Mike Grommet) Date: Sun, 20 Sep 1998 09:26:20 -0400 (EDT) Cc: freebsd-questions@FreeBSD.ORG X-notice: Copyright (C) 1998, by the author, "Woodchuck" djv@bedford.net X-notice: All rights reserved. X-no-archive: yes Reply-to: djv@bedford.net From: "Woodchuck" X-Mailer: ELM [version 2.4ME+ PL38 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Mike Grommet wrote: [Charset iso-8859-1 unsupported, filtering to ASCII...] > I did recently install tcp_wrappers, but I've tried this with both the > pre-tcp_wrapper inetd.conf file > and the current one, and still did the same thing. Not relevant. tcp_wrapper uses LOG_AUTH, syslogd is not tcp_wrapped, or inetd'd, for that matter. You're not starting it with inetd, I hope. > here's the conf file. Despite my cut and paste here, there really are tabs > between the lhs and the rhs... It's better to 'attach' or uuencode. It is not just the presence of tabs, but also an absence of spaces, ^M's ^L's etc, that matters. syslogd looks explicitly for a run of tabs as delimiter. > Heck I even copied this off of a working bsdi 3.1 machine that works fine... > still didnt work for me. > the /var/log/secure file has been created and has permissions > ->rw------- 1 root bin 0 Sep 17 11:01 secure All that matters is that the file exist and be accessible by root. The comments in the distribution source syslog.conf are misleading on this and other points. You are starting syslogd as root, I hope :) Otherwise, we have an answer. > Also, when I put my syslogd into debug mode, it never says anything about > logging into /var/log/secure... Yes, it does. > so what have I missed here? > > > ----- START OF CONF ----- This is a simple conf file, but doesnt work.... > > *.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console > kern.*;auth.notice;authpriv.none;mail.crit /dev/console > *.notice;authpriv,ftp,uucp,cron,news.none;kern.debug;mail.crit > /var/log/messages > authpriv.* /var/log/secure > lpr.info /var/log/lpd-errs > mail.* /var/log/maillog > uucp.* /var/spool/uucp/errors > cron.* /var/log/cron > ftp.* /var/log/ftp.log > daemon.* /var/log/daemon.log > *.emerg * > *.notice;auth.debug;authpriv.none root > > --- END OF CONF ----- > > > here is the syslogd -d output.... This is only some of the output; it would be more interesting to see what comes forth when authpriv is exercised. > 8 3 2 3 5 3 3 3 3 3 X 3 3 3 3 3 3 3 3 3 3 3 3 3 X CONSOLE: /dev/console > 8 X 2 X 5 X X X X X X X X X X X X X X X X X X X X CONSOLE: /dev/console > 7 5 2 5 5 5 5 X X X X X 5 5 5 5 5 5 5 5 5 5 5 5 X FILE: /var/log/messages > X X X X X X X X X X 8 X X X X X X X X X X X X X X FILE: /var/log/secure This is the correct output. > X X X X X X 6 X X X X X X X X X X X X X X X X X X FILE: /var/log/lpd-errs > X X 8 X X X X X X X X X X X X X X X X X X X X X X FILE: /var/log/maillog > X X X X X X X X 8 X X X X X X X X X X X X X X X X UNUSED: > X X X X X X X X X 8 X X X X X X X X X X X X X X X UNUSED: > X X X X X X X X X X X 8 X X X X X X X X X X X X X FILE: /var/log/ftp.log > X X X 8 X X X X X X X X X X X X X X X X X X X X X FILE: /var/log/daemon.log > 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 X WALL: > 5 5 5 5 7 5 5 5 5 5 X 5 5 5 5 5 5 5 5 5 5 5 5 5 X USERS: root, > logmsg: pri 56, flags 4, from backup, msg syslogd: restart > syslogd: restarted I have appended a syslog.conf that is correct and works on 2.2.6R. To exercise the LOG_AUTHPRIV facility, use logger(1) like so: logger -p authpriv.info Some happy message to log syslogd won't log any messages unless told to. It is instructive to use logger as in the example, observing the output of syslogd -d, and following /var/log/secure with tail -f. Dave -- begin 644 syslog.conf M*BYE