Linux

Ask something
Discussion Locked

AIX - System Logs

0 helpful
6 replies

by rz.men 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have been advised by our auditors to collect and retain AIX syslogs. Is this a normal practice that is being done,(like the event log in NT, which is a lot easier to read and archive), and if so, what is your recommended size for the log, spacewise. How does one get to the syslog, as a secadmin, to view it. Is a script needed to archive the syslog on a regular basis?
Thanx for all your info.

6 replies

by shanghai sam

It is common to collect AIX logs.
The primary syslog configuration file is syslog.conf. to see how to config the syslog.

man syslogd

It is hard to say how large your log should be.
Ours is only 5M (5 log files together).
Anyway Don't letlog files take over 5% of your disk space, that will slow your system a lot.

To configure the size of the log, start smit (type smit at command line)
go to "Problem Determination", goto "Error Log" or "Alog" then "Change/Show Characteristics of an Alog File", press [F4], choose the log you want to modify, then you see the log size setting.

If you wang secadmin to be able to read logs, make sure this user account have read permition on the log files (try su to this account and read the log file). Use smit to read logs.

Some logs are binary files so you need smit to read them. In smit, go to "Problem Determination", goto "Alog" then "Show an ALog File"; or goto "Error Log" to generate a error report.

We do have a script to archive the logs bi-weekly and we keep the log for at least a year (on tapes/CDRs).

The following is a sample syslog.conf you can copy and paste to your syslog.conf
auth.notice /var/adm/authlog
kern.debug /var/adm/messages
*.emerg;*.alert /var/adm/messages
*.crit;*.warning /var/adm/messages
*.err;*.notice /var/adm/messages
*.info /var/adm/messages

by eresquigal

It's a normal practice in security-paranoid areas (banking, law enforcement, and some government shops).
There are TWO system logs in AIX, syslog and errorlog.
The first you can configure in /etc/syslog.conf, the second is accessed with the errpt command and automaticaly purged by the system (soft errors last 30 days, hard errors last 90 days - change it in the root's crontab).
If you decide to send the syslog to a file, rotate it every month (at least, depends on the activity of your system) with a cron-invoked command like like this:

/usr/cron/monthly:
mv /var/adm/messages /var/adm/messages.$(date +"%M")
touch /var/adm/messages
refresh -s syslogd
compress /var/adm/messages.$(date +"%M")

PS: It's a wonder how fast the record keeping "requirements" drop, when you quote them the price of "TWO 36.8GB drives for record-keeping".

This discussion is closed to new replies.