[syslog-ng] Reg; Syslog-ng does not recognize the audit facility

[Justin Kala]

Hi Evan..thanks for the reply but both sending and receiving servers are
same OS.. Solaris 10
On Jul 28, 2015 12:18 PM, "Evan Rempel" <erempel at uvic.ca> wrote:

>  Well, that is probably because the host where syslog-ng was compiled is
> a different OS than that where the "audit" facility log line was created.
>
> For instance, on a Linux host, the syslog.h file from the system only has
> these facilities defined.
>
> CODE facilitynames[] =
>   {
>     { "auth", LOG_AUTH },
>     { "authpriv", LOG_AUTHPRIV },
>     { "cron", LOG_CRON },
>     { "daemon", LOG_DAEMON },
>     { "ftp", LOG_FTP },
>     { "kern", LOG_KERN },
>     { "lpr", LOG_LPR },
>     { "mail", LOG_MAIL },
>     { "mark", INTERNAL_MARK },          /* INTERNAL */
>     { "news", LOG_NEWS },
>     { "security", LOG_AUTH },           /* DEPRECATED */
>     { "syslog", LOG_SYSLOG },
>     { "user", LOG_USER },
>     { "uucp", LOG_UUCP },
>     { "local0", LOG_LOCAL0 },
>     { "local1", LOG_LOCAL1 },
>     { "local2", LOG_LOCAL2 },
>     { "local3", LOG_LOCAL3 },
>     { "local4", LOG_LOCAL4 },
>     { "local5", LOG_LOCAL5 },
>     { "local6", LOG_LOCAL6 },
>     { "local7", LOG_LOCAL7 },
>
>
> with values of
>
> /* facility codes */
> #define LOG_KERN        (0<<3)  /* kernel messages */
> #define LOG_USER        (1<<3)  /* random user-level messages */
> #define LOG_MAIL        (2<<3)  /* mail system */
> #define LOG_DAEMON      (3<<3)  /* system daemons */
> #define LOG_AUTH        (4<<3)  /* security/authorization messages */
> #define LOG_SYSLOG      (5<<3)  /* messages generated internally by
> syslogd */
> #define LOG_LPR         (6<<3)  /* line printer subsystem */
> #define LOG_NEWS        (7<<3)  /* network news subsystem */
> #define LOG_UUCP        (8<<3)  /* UUCP subsystem */
> #define LOG_CRON        (9<<3)  /* clock daemon */
> #define LOG_AUTHPRIV    (10<<3) /* security/authorization messages
> (private) */
> #define LOG_FTP         (11<<3) /* ftp daemon */
>
>         /* other codes through 15 reserved for system use */
> #define LOG_LOCAL0      (16<<3) /* reserved for local use */
> #define LOG_LOCAL1      (17<<3) /* reserved for local use */
> #define LOG_LOCAL2      (18<<3) /* reserved for local use */
> #define LOG_LOCAL3      (19<<3) /* reserved for local use */
> #define LOG_LOCAL4      (20<<3) /* reserved for local use */
> #define LOG_LOCAL5      (21<<3) /* reserved for local use */
> #define LOG_LOCAL6      (22<<3) /* reserved for local use */
> #define LOG_LOCAL7      (23<<3) /* reserved for local use */
>
>
> so there is no audit facility.
>
> Hope that explains it.
>
>
> On 07/28/2015 09:08 AM, Justin Kala wrote:
>
>
> Hi
>
>  Syslog-ng is unable to recognize the facility audit. When I put filter
> as audit and restart syslog-ng it errors out. When I put the facility code
> as 13 ,it does not error on restarting the service but does not capture the
> syslog message received through this filter code  13 as well.
>
>  Please advise.
> --
>  Kaladhar
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
> --
> Evan Rempel                                      erempel at uvic.ca
> Senior Systems Administrator                        250.721.7691
> Data Centre Services, University Systems, University of Victoria
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20150728/d85ce878/attachment.htm