I am trying to capture some of my activities in SYSLOG file, /var/log/messages.
To do this I created and dropped some test files and directories and users. But these activities are not captured in /var/log/messages. What should I do to make these activities appear in /var/log/messages file?
I see /var/log/audit/audit.log file in /etc/audit/auditd.conf
Is /var/log/audit/audit.log file another SYSLOG file?
I don't see my activities in both /var/log/messages and /var/log/audit/audit.log files.
The syslog is usually configured by either /etc/syslog.conf or /etc/rsyslog.conf depending on your version (which I don't have, so cannot check)
Be aware that the files usually need to exist when the syslog daemon (re-)reads the config file.
What do you have configured? Are you wanting to actively log messages (use logger and the syslog daemon) or are you wanting to track activities automatically (user audit daemon) I've had real trouble with auditing flooding the server, so I've never persisted.
audit is what you need if you like to capture users commands on your system. Audit is another subsystem and doesn't work through syslog.
For SLES take a look at this documentation:
agent.kgb
I'll go over the articles you recommend. Thank you,
rbatte1
I don't see /etc/syslog.conf or /etc/rsyslog.conf in my server.
Instead I have /etc/syslog-ng. This file has multiple lines of filter and destination. Is this the same file as /etc/syslog.conf or /etc/rsyslog.conf and I have to cofigure?
You said, "Be aware that the files usually need to exist when the syslog daemon (re-)reads the config file."
Do you mean the files under /var/log such as messages and mail.info files?
IRS wants my company to capture below items and send them to a SYSLOG server which is LogRhythm server for auditing purposes. I'd like to capture any activity listed and send them to SYSLOG server(LogRhythm).
I created some test files and directories and users and dropped them. I expected to see these activies in /var/log/messages and /etc/audit/audit.log files but didn't see them. How to collect these information and send them to SYSLOG server? What do I change or add in /etc/sysconfig-ng file?
Thank you,
List of Log information IRS requires to collect in SYSLOG
Successful login and logoff attempts
Unsuccessful login and authorization attempts
All identification and authentication attempts
All actions, connections and requests performed by privileged users
All changes to logical access control authorities (e.g., rights, permissions
System changes with the potential to compromise the integrity of audit -policy configurations, security policy configurations and audit record generation services.
Creation, modification and deletion of objects including files, directories and user accounts
Creation, modification and deletion of user accounts and group accounts
Creation, modification and deletion of user account and group account privileges
The date of the system event; ii)the time of the system event; iii) the type of system event initiated; and
the user account, system account, service or process responsible for initiating the system event.
System start-up and shutdown functions.
Modifications to administrator account(s) and administrator group account(s)including: i) escalation of user account privileges
commensurate with administrator-equivalent account(s); and ii) adding or deleting users from the administrator group account(s).
enabling or disabling of audit report generation services
command line changes, batch file changes and queries made to the system (e.g., operating system, application, and database
Some content of /var/syslog-ng file/********************
filter f_iptables { facility(kern) and match("IN=") and match("OUT="); };
filter f_console { level(warn) and facility(kern) and not filter(f_iptables)
or level(err) and not facility(authpriv); };
filter f_newsnotice { level(notice) and facility(news); };
filter f_newscrit { level(crit) and facility(news); };
filter f_newserr { level(err) and facility(news); };
filter f_news { facility(news); };
filter f_mailinfo { level(info) and facility(mail); };
filter f_mailwarn { level(warn) and facility(mail); };
filter f_mailerr { level(err, crit) and facility(mail); };
filter f_mail { facility(mail); };
filter f_cron { facility(cron); };
filter f_local { facility(local0, local1, local2, local3,
local4, local5, local6, local7); };
#
# acpid messages
#
filter f_acpid_full { match('^acpid:'); };
filter f_acpid { level(emerg..notice) and match('^acpid:'); };
# this is for the old acpid < 1.0.6
filter f_acpid_old { match('^\[acpid\]:'); };
filter f_netmgm { match('^NetworkManager:'); };
filter f_messages { not facility(news, mail) and not filter(f_iptables); };
filter f_warn { level(warn, err, crit) and not filter(f_iptables); };
filter f_alert { level(alert); };
destination netmgm { file("/var/log/NetworkManager"); };
log { source(src); filter(f_netmgm); destination(netmgm); flags(final); };
.
.
.
.
#
# Some boot scripts use/require local[1-7]:
#
destination localmessages { file("/var/log/localmessages"); };
log { source(src); filter(f_local); destination(localmessages); };
#
# All messages except iptables and the facilities news and mail:
#
destination messages { file("/var/log/messages"); };
log { source(src); filter(f_messages); destination(messages); };
Yes, the output files (usually in /var/log) need to exist. I've not come accross /etc/syslog-ng before. Can you clarify which version you are running by pasting the output from uname -a ? Remove the server name if you wish.
I am not sure that it is possible to throw audit messages direct to syslog and I don't know which version of syslog-ng comes with SLES. The last you can check with the command rpm -qa | grep syslog-ng .
The first is more difficult. You will need to define in your syslog-ng configuration one more source and destination for logs.