SV-Administration-Management-Syslogd

Syslogd

Syslogd messages are generated by certain router processes (deamons). Once enabled, syslogd will broadcast all syslogd messages to a single nominated ip address. To capture the broadcast of syslogd, utilise a logging capture program (ie Kiwi System Log) on the receiving machine, listening on UDP port 514.

syslodg example output

13-01-2004   15:49:21   Cron.Info   192.168.1.1   syslog[16322]: (root) MAIL (mailed 51 bytes of output but got status 0x0001 )
13-01-2004   15:49:20   Cron.Info   192.168.1.1   syslog[16323]: (root) CMD (/sbin/monitor_ps)
13-01-2004   15:47:20   Cron.Info   192.168.1.1   syslog[16313]: (root) MAIL (mailed 51 bytes of output but got status 0x0001 )
13-01-2004   15:47:20   Cron.Info   192.168.1.1   syslog[16314]: (root) CMD (/sbin/monitor_ps)
13-01-2004   15:46:41   Cron.Info   192.168.1.1   syslog[16304]: (root) MAIL (mailed 51 bytes of output but got status 0x0001 )
13-01-2004   15:46:40   Cron.Info   192.168.1.1   syslog[16305]: (root) CMD (/sbin/monitor_ps)
13-01-2004   15:46:40   Cron.Info   192.168.1.1   syslog[16252]: (*system*) RELOAD (/tmp/crontab)
13-01-2004   15:46:38   Daemon.Info   192.168.1.1   dnsmasq[16293]: reading /tmp/udhcpd.leases
13-01-2004   15:46:38   Daemon.Info   192.168.1.1   dnsmasq[16293]: using nameserver 210.15.254.240
13-01-2004   15:46:38   Daemon.Info   192.168.1.1   dnsmasq[16293]: using nameserver 210.15.254.241
13-01-2004   15:46:38   Daemon.Info   192.168.1.1   dnsmasq[16293]: reading /tmp/resolv.conf
13-01-2004   15:46:38   Daemon.Info   192.168.1.1   dnsmasq[16293]: reading /etc/hosts
13-01-2004   15:46:38   Daemon.Warning   192.168.1.1   dnsmasq[16293]: failed to drop root privs
13-01-2004   15:46:38   Daemon.Info   192.168.1.1   dnsmasq[16293]: started, version 1.10 cachesize 150
13-01-2004   15:46:37   Daemon.Notice   192.168.1.1   pppd[16280]: pppd 2.4.1 started by root, uid 0
13-01-2004   15:46:36   Daemon.Info   192.168.1.1   dnsmasq[16258]: reading /tmp/udhcpd.leases
13-01-2004   15:46:36   Daemon.Info   192.168.1.1   dnsmasq[16258]: using nameserver 210.15.254.240
13-01-2004   15:46:36   Daemon.Info   192.168.1.1   dnsmasq[16258]: using nameserver 210.15.254.241
13-01-2004   15:46:36   Daemon.Info   192.168.1.1   dnsmasq[16258]: reading /tmp/resolv.conf
13-01-2004   15:46:36   Daemon.Info   192.168.1.1   dnsmasq[16258]: reading /etc/hosts
13-01-2004   15:46:36   Daemon.Warning   192.168.1.1   dnsmasq[16258]: failed to drop root privs
13-01-2004   15:46:36   Daemon.Info   192.168.1.1   dnsmasq[16258]: started, version 1.10 cachesize 150
13-01-2004   15:46:35   Cron.Info   192.168.1.1   syslog[16252]: (CRON) STARTUP (fork ok)
13-01-2004   15:46:35   Syslog.Info   192.168.1.1   syslogd started: BusyBox v0.60.0 (2004.01.09-23:27+0000)

NOTE: Syslogd messages cannot be utilised as Packet / Traffic Based Logging.

---