Re: way to duplicate logs?

From: Nielsen (nielsen_at_memberwebs.com)
Date: 12/11/04

  • Next message: Vasil Dimov: "need some advice on connections logs" 
    Date: Sat, 11 Dec 2004 01:25:58 +0000 (GMT)

    Bob Ababurko wrote:
    > Also, is there a way to make more than one copy of these logs?....I am
    > not sure how this is set up and but I would like to possibly have
    > another set of logs in place so if someone is editing them, I can catch
    > it. I know there is a chance that I may be overreacting., but just in
    > case I want to know.

    You can forward them to another machine. Add a line like this to your
    syslog.conf:

    *.* @hostname

    And then on the other machine change syslogd to accept (udp log packets)
    connections from other machines by removing the '-s' flags.

    Of course if someone is really messing around they'll be able to send
    bogus logs to your other logging machine too.

    Cheers,
    Nate

    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Vasil Dimov: "need some advice on connections logs"

    Relevant Pages

    • Re: Syslog not logging remote host
      ... The m0n0wall is configured to send logs to 10.61.70.100, ... logging machine. ... What am I missing? ... If 10.61.70.100 runs FreeBSD, syslogd_flags defaults to -s, which ...
      (freebsd-questions)
    • Syslog not logging remote host
      ... I'm trying capture logs from m0n0wall, but the log file is empty. ... Here is my configuration: ... On the logging machine, in /etc/rc.conf: ...
      (freebsd-questions)