[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1048
  • Last Modified:

setting up syslog server on an OS X network

I have 4 OS X devices (2 iMacs, 3 Mac Minis)  that I believe I have configured the /etc/syslog.conf to send their logs to my syslog server (IP 192.168.1.30) but I'm not seeing any logs going to the host. I must be missing something. I have rebooted all of systems just incase I didn't stop / start syslog correctly.

———————————--
Clients all have:
imac:~ $ cat /etc/syslog.conf
# Note that flat file logs are now configured in /etc/asl.conf

install.*						@127.0.0.1:32376
*.*							@192.168.1.30

Open in new window


———————————--
Server has:
syslog:~$ cat /etc/syslog.conf
# Note that flat file logs are now configured in /etc/asl.conf

install.*						@127.0.0.1:32376

Open in new window

0
bs98909
Asked:
bs98909
  • 2
  • 2
1 Solution
 
SimonCommented:
Have you:
Used TAB characters to separate The selector and action fields in syslog.conf?

Checked that data is being sent from the workstation to the server using tcpdump?
         sudo tcpdump -i en1 host 192.168.1.30 and udp port 514

Allowed the traffic from the workstations through the firewall(s)?

Try Googling "osx send syslog to server" for more details.
0
 
bs98909Author Commented:
I have confirmed via "od" that intact there are tabs on the line. and the tcpdump has been running for about 24 hours and NADA.

I just got off the phone with Alex from apple support. He doesn't believe that the normal OS X can send logs only the Server can. That seems odd to me. His suggestion is to allow for file sharing and have the server mount the /var for all the systems I want to monitor.

Well being a Solaris and Linux guy, I think that is all hewey!

Apple now uses "asl" which seems to allow applications to log data. I don't know if it is asl that now needs to be configured. I'm not finding much on that.
0
 
bs98909Author Commented:
I retraced the steps from the Splunk page: http://wiki.splunk.com/Community:HowTo_Configure_Mac_OS_X_Syslog_To_Forward_Data

I now can see the data leaving, so the syslog for the client is working!

not a clue why it didn't work the first two times — but third time is a charm.

Thank you
0
 
SimonCommented:
> being a Solaris and Linux guy, I think that is all hewey!
lol :)

Glad you persevered and made it work.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now