CIT 470 Advanced Network and System Administration: Lab #15: syslog

Lab #15: syslog
Date: April 7, 2008

In this lab, we'll be working with syslog, the standard UNIX logging framework. Syslog is also available for Windows and is used widely as a remote logging protocol by network switches and routers.

Syslog Basics
1. Verify that syslog is running. If it is not running, start it.
```
ps auxw|grep syslog
```
2. Read the syslog configuration file. Where do messages about failed logins go? What is the general log file that receives most syslog messages?
```
less /etc/syslog.conf
```
3. Use the logger command to send a sample syslog message, using the local0 facility, which one of 8 user-defined syslog facilities. This command is useful when you want to test syslog or use syslog from a shell script.
```
logger -p local0.alert -t TEST "Test from $USER"
```
4. Verify that your message was logged.
```
tail /var/log/messages
```
5. Backup the syslog configuration file before changing it.
```
cp -p /etc/syslog.conf /etc/syslog.conf.dist
```
6. Configure syslog so that messages of type local5 go to /var/log/local5.
```
vim /etc/syslog.conf
```
7. Restart syslog so that the configuration change takes effect.
```
service syslog restart
```
8. Verify that your configuration change is correct.
```
logger -p local5.info -t TEST "Test from $USER"
tail /var/log/local5
```
9. Configure syslog so that only local5 messages of emerg priority go to /var/log/local5.
```
vim /etc/syslog.conf
```
10. Restart syslog so that the configuration change takes effect.
```
service syslog restart
```
11. Verify that your configuration change is correct.
```
logger -p local5.info -t TEST "Test from $USER"
tail /var/log/local5
```
Log Rotation
1. Find the cron file that runs logrotate to rotate the log files every night.
```
locate logrotate
```
2. Run logrotate in debug mode to determine which log files are currently being rotated.
```
logrotate -d /etc/logrotate.conf >/tmp/logrotate.out 2>&1
```
3. Add your new local5 file to the rotation list. Use the information gathered from running logrotate in debug mode to determine which system file you need to modify. Reading the man page will help you modify the file correctly.
```
man logrotate
```
4. Verify that your change is correct by running logrotate in debugging mode again. The difference between the output of the two runs of logrotate should mention your local5 file.
```
logrotate -d /etc/logrotate.conf >/tmp/logrotate.new 2>&1
diff /tmp/logrotate.out /tmp/logrotate.new
```
5. Run logrotate with verbose output to manually force a log rotation. We don't want to wait until the daily cron jobs run.
```
logrotate -v /etc/logrotate.conf
```
6. Check to see if your log file has been rotated.
```
ls /var/log
```
7. Since your log file wasn't rotated, modify your logrotate command to rotate it now. The man page may prove helpful again.
```
man logrotate
```
Remote Logging
1. Configure syslog to permit remote logging.
```
vim /etc/sysconfig/syslog
```
2. Restart syslog so that the configuration change takes effect.
```
service syslog restart
```
3. Lookup the protocol and port used by syslog.
```
grep syslog /etc/services
```
4. Modify the firewall configuration to enable remote access to syslog.
```
cp -p /etc/sysconfig/iptables /etc/sysconfig/iptables.old
vim /etc/sysconfig/iptables
service iptables restart
```
5. On your virtual machine, reconfigure syslog to log to your physical machine.
```
cp -p /etc/syslog.conf /etc/syslog.conf.dist
vim /etc/syslog.conf
```
6. Restart syslog on the virtual machine.
```
service syslog restart
```
7. Start Wireshark and begin capturing files so you can observe syslog packets moving across the network.
8. On the virtual machine, send a test message to syslog.
```
logger -p local0.alert -t TEST "Test from virtual machine user $USER"
```
9. Observe the message as it travels across the network. Is syslog a secure protocol? Why or why not?
10. Verify that the message appears on your physical machine, the syslog server. Record how this message differs from a similar test you did in the first part of the lab.
```
tail /var/log/messages
```