-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160
Longstreth, Lance wrote:
> I am in need of some direction or advice
Hey, Lance. Aren't we all? :)
> We are running peoplesoft process schedulers under Unix .
I'm slightly confused with this sentence. By Unix, do you mean z/Linux
or something other than that? If so, could you please be more specific?
Just what operating systems are being used to generate those log
records, and what operating system is running on the machine used to
accumulate log records? Also, what system logger is being used?
I am going to assume you're talking about the common Linux syslogd
though (syslog-ng shipped with newer versions of linux is rather
similar, but not entirely; alas, it uses the same terminology, and
somewhat expanded in terms of functionality).
> What I want to do is log activities of these process schedulers to a
> log file. In particuliar is when it is started and stopped. I am also
> going to ship the log to another system for monitoring. I have gotten
> the log shipping process to work, but am not picking up any activity
> from the process schedulers. In the syslog.conf I thought I could
> specify as below... Maybe I can't do what I am trying to do, this
> way.
>
> PSSQLID.* /var/log/pserver
>
> Or
>
> *.* /var/log/daemons
There are two levels of criteria in syslog, that decide what goes where.
One is called facility, and the other's name is uttered either as level
(the usual UNIX name) or priority (the syslog-ng way).
The capability to filter by process name, hostname or the entire log
record identity mask, has been added in syslog-ng. I don't think there
are any capabilities to filter by username present in syslog-ng to date.
The easiest way you can redirect messages from the scheduler to a
particular log file is to find out what facility it uses to identify its
log records to the system logger. Usually (and hopefully, as lots of
other services use the more common ones), it will be one of the local0
to local7 facilities; the rest include auth (also security), authpriv,
cron, daemon, kern, lpr, mail, mark, news, syslog, user and uucp.
If you have no documentation on what the processes actually use to
communicate with the system logger, you can strace(1) them and watch out
for lines that look like this:
connect(1, {sa_family=AF_FILE, path="/dev/log"}, ...
send(1, "<13><Mon> <Day> <HH>:<MM>:<SS> <process>: ...
The other option is to sniff on /dev/log using some application that can
monitor AF_UNIX traffic.
Yet another, but rather unrelated and somewhat costly (in terms of time
spent to set it up) option, of monitoring what goes on with your
processes, would be patching your kernel with grsecurity or using a
SELinux module that monitors the exec() family of functions, and filter
those records according to some filter to make them show up in the
appropriate log.
Hope to have helped.
Kind regards,
- --
Grega Bremec
gregab at p0f dot net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFC8j7cfu4IwuB3+XoRA+ikAJ44ROlUvUgj34YQP+R/zZSt+0A/iACeI9Ww
DlWTvrXTnNTy3JC2ldeoBRY=
=zln6
-----END PGP SIGNATURE-----
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
