Wednesday, January 28, 2009

Syslog on Solaris 10 - Remote Loghosts

Just a quick note here to help others that may run into the same issue. I have had a Solaris 10 FTP server running for several years. I have grossly neglected it and only recently decided to give it any attention whatsoever.

I wanted to have the server send syslog messages to a remote loghost. Normally, this is very simple. I would just add a line in /etc/hosts to define the remote loghost, and then add a line in /etc/syslog.conf to tell syslogd which events to send to the loghost.

My problem was that syslogd kept determining that the local system was "loghost", and not the server that I defined in /etc/hosts. I could verify this by killing the syslogd process and then running it manually with the "-d" parameter.

It turns out that there was another entry on the system, defining the localhost as "loghost" in the file /etc/inet/ipnodes.

I simply removed the line altogether, restarted syslogd and voila! The remote loghost started receiving messages from my estranged FTP server.

1 comment:

Anonymous said...

I had a similar problem, but ipnodes was linked to hosts. Turned out ipnodes in nsswitch.conf was pointing to NIS before files.