<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Thank you Balazs<br><br>I've added this, which seems to be working now just fine:<br><br>#<br># Syslog Client Config Addtitions/Changes<br>#<br> <br>authpriv,auth.info;local2.info /var/log/userslog<br>authpriv,auth.notice /var/log/userslog<br>authpriv,auth.error;local2.error /var/log/userslog<br> <br>authpriv,auth.*,user.notice @@syslog-NG:514<br><br><hr>Date: Tue, 19 May 2015 21:50:47 +0200<br>From: bazsi77@gmail.com<br>To: syslog-ng@lists.balabit.hu<br>Subject: Re: [syslog-ng] Solaris & Linux (RH6) Console and SSH Use Logging<br><br><p dir=ltr>Generally you'll need a filter facility (auth) but you should check that first by sending the logs. </p>
<div class=ecxgmail_quote>On Apr 28, 2015 7:06 PM, <<a href="mailto:wiskbroom@hotmail.com">wiskbroom@hotmail.com</a>> wrote:<br><blockquote class=ecxgmail_quote style="border-left:1px #ccc solid;padding-left:1ex;">
<div><div dir=ltr>Greetings;<br><br>This is question is slightly OT, but I can't imagine a better place to ask; so please, no flames.<br><br>I would like to begin logging all attempts (succesful, failed, no password given, etc) to login to Sparc/Solaris machines, as well as RedHat 6 Linux boxes.  My clients are using stock syslog, but my server is running syslog-NG; my second goal is to redirect all login type logs to just one file for ALL of my Solaris & Linux servers.<br><br>Does anyone have a known good syslog config file for both Solaris, and Linux?<br><br>Also, a good syslog-NG entry to force just the console and ssh data into a separate file?<br><br>Thank you!<br><br>.vp<br> </div></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target=_blank>https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target=_blank>http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target=_blank>http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>
<br>______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq </div></body>
</html>