Forum Discussion
nitass
May 23, 2013Employee
after you change auth-priv-from (modify sys syslog...) and save (i.e. tmsh save sys config), can you check /etc/syslog-ng/syslog-ng.conf? is syslog-ng configuration changed accordingly?
this is mine.
authpriv.* /var/log/secure
filter f_authpriv {
(facility(auth, authpriv) and level(err..emerg))
or program(sshd)
or (facility(auth,authpriv) and (program(httpd) or program(tamd)))
or match("pam_audit")
;
};
destination d_secure {
file("/var/log/secure" create_dirs(yes));
};
log {
source(s_syslog_pipe);
filter(f_authpriv);
destination(d_secure);
};
by the way, have you customized syslog-ng configuration?