Thursday, June 19, 2008

OpenBSD Syslogd Centralized Server

I setup OpenBSD 4.2 as a Central Loggin Server. with awesome results (no need for any other 3rd party logging software OpenBSD has it all)

Paranoid Fishies check this out:

my /etc/rc.conf

syslogd_flags= "-u -a "

my /etc/syslog.conf

# $OpenBSD: syslog.conf,v 1.17 2005/05/25 07:35:38 david Exp $
#

*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none /var/log/messages
kern.debug;syslog,user.info /var/log/messages
auth.info /var/log/authlog
authpriv.debug /var/log/secure
cron.info /var/cron/log
daemon.info /var/log/daemon
ftp.info /var/log/xferlog
lpr.debug /var/log/lpd-errs
mail.info /var/log/maillog
local7.debug //
#uucp.info /var/log/uucp

# Uncomment this line to send "important" messages to the system
# console: be aware that this could create lots of output.
#*.err;auth.notice;authpriv.none;kern.debug;mail.crit /dev/console

# Uncomment this to have all messages of notice level and higher
# as well as all authentication messages sent to root.
#*.notice;auth.debug root

# Everyone gets emergency messages.
*.emerg *

# Uncomment to log to a central host named "loghost". You need to run
# syslogd with the -u option on the remote host if you are using this.
# (This is also required to log info from things like routers and
# ISDN-equipment). If you run -u, you are vulnerable to syslog bombing,
# and should consider blocking external syslog packets.
#*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none @loghost
#auth,daemon,syslog,user.info;authpriv,kern.debug @loghost

# Uncomment to log messages from sudo(8) and chat(8) to their own
# respective log files. Matches are done based on the program name.
# Program-specific logs:
#!sudo
#*.* /var/log/sudo
#!chat
#*.* /var/log/chat


touch filename.log
chmod 644 filename.log


now for the Device Part:

Cisco Router: 7200Series

conf te
service timestamps log datetime
logging host transport udp port 514
logging facility local7
logging trap debugging
logging on