[syslog-ng] Reg; Syslog-ng does not recognize the audit facility

[Evan Rempel]

Can you look at the syslog facility definitions

/usr/include/sys/syslog.h

or

/usr/include/syslog.h

to see if audit is a defined facility?


On 07/28/2015 09:32 AM, Justin Kala wrote:
>
> Hi Evan..thanks for the reply but both sending and receiving servers are same OS.. Solaris 10
>
> On Jul 28, 2015 12:18 PM, "Evan Rempel" <erempel at uvic.ca <mailto:erempel at uvic.ca>> wrote:
>
>     Well, that is probably because the host where syslog-ng was compiled is a different OS than that where the "audit" facility log line was created.
>
>     For instance, on a Linux host, the syslog.h file from the system only has these facilities defined.
>
>     CODE facilitynames[] =
>       {
>         { "auth", LOG_AUTH },
>         { "authpriv", LOG_AUTHPRIV },
>         { "cron", LOG_CRON },
>         { "daemon", LOG_DAEMON },
>         { "ftp", LOG_FTP },
>         { "kern", LOG_KERN },
>         { "lpr", LOG_LPR },
>         { "mail", LOG_MAIL },
>         { "mark", INTERNAL_MARK },          /* INTERNAL */
>         { "news", LOG_NEWS },
>         { "security", LOG_AUTH },           /* DEPRECATED */
>         { "syslog", LOG_SYSLOG },
>         { "user", LOG_USER },
>         { "uucp", LOG_UUCP },
>         { "local0", LOG_LOCAL0 },
>         { "local1", LOG_LOCAL1 },
>         { "local2", LOG_LOCAL2 },
>         { "local3", LOG_LOCAL3 },
>         { "local4", LOG_LOCAL4 },
>         { "local5", LOG_LOCAL5 },
>         { "local6", LOG_LOCAL6 },
>         { "local7", LOG_LOCAL7 },
>
>
>     with values of
>
>     /* facility codes */
>     #define LOG_KERN        (0<<3)  /* kernel messages */
>     #define LOG_USER        (1<<3)  /* random user-level messages */
>     #define LOG_MAIL        (2<<3)  /* mail system */
>     #define LOG_DAEMON      (3<<3)  /* system daemons */
>     #define LOG_AUTH        (4<<3)  /* security/authorization messages */
>     #define LOG_SYSLOG      (5<<3)  /* messages generated internally by syslogd */
>     #define LOG_LPR         (6<<3)  /* line printer subsystem */
>     #define LOG_NEWS        (7<<3)  /* network news subsystem */
>     #define LOG_UUCP        (8<<3)  /* UUCP subsystem */
>     #define LOG_CRON        (9<<3)  /* clock daemon */
>     #define LOG_AUTHPRIV    (10<<3) /* security/authorization messages (private) */
>     #define LOG_FTP         (11<<3) /* ftp daemon */
>
>             /* other codes through 15 reserved for system use */
>     #define LOG_LOCAL0      (16<<3) /* reserved for local use */
>     #define LOG_LOCAL1      (17<<3) /* reserved for local use */
>     #define LOG_LOCAL2      (18<<3) /* reserved for local use */
>     #define LOG_LOCAL3      (19<<3) /* reserved for local use */
>     #define LOG_LOCAL4      (20<<3) /* reserved for local use */
>     #define LOG_LOCAL5      (21<<3) /* reserved for local use */
>     #define LOG_LOCAL6      (22<<3) /* reserved for local use */
>     #define LOG_LOCAL7      (23<<3) /* reserved for local use */
>
>
>     so there is no audit facility.
>
>     Hope that explains it.
>
>
>     On 07/28/2015 09:08 AM, Justin Kala wrote:
>>
>>     Hi
>>
>>     Syslog-ng is unable to recognize the facility audit. When I put filter as audit and restart syslog-ng it errors out. When I put the facility code as 13 ,it does not error on restarting the service but does not capture the syslog message received through this filter code  13 as well.
>>
>>     Please advise.
>>     -- 
>>     Kaladhar
>>
>>
>>     ______________________________________________________________________________
>>     Member info:https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>     Documentation:http://www.balabit.com/support/documentation/?product=syslog-ng
>>     FAQ:http://www.balabit.com/wiki/syslog-ng-faq
>>
>
>
>     -- 
>     Evan Rempelerempel at uvic.ca <mailto:erempel at uvic.ca>
>     Senior Systems Administrator250.721.7691 <tel:250.721.7691>
>     Data Centre Services, University Systems, University of Victoria
>
>
>     ______________________________________________________________________________
>     Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>     Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
>     FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>


-- 
Evan Rempel                                      erempel at uvic.ca
Senior Systems Administrator                        250.721.7691
Data Centre Services, University Systems, University of Victoria

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20150728/40da63ce/attachment-0001.htm