[tac_plus] Re: pipe accounting info to syslog?

[Jimmy Oliver]

Hi John,

Thanks for your fast response to my message.  I am able to get the log
messages to go to a centralized syslog server.  My issue is with the
accounting  information.  This is a snippet from the tac_plus config
file:

accounting file = /var/log/tac_plus.acct
logging = local6

from syslog.conf:

# Send tac_plus messages to central server
local6.*
@syslog.somehost.com


With this setup, all tac_plus log messages are sent via the local6
facility to syslog.somehost.com.  The problem is the accounting data.  I
*could use a hack like this to get them into syslog, but it is ugly at
best.

tail -f /var/log/tac_plus.acct | logger -t "tac_plus accounting" -p
local6.info  &	

This works, but I end up with a double timestamp on all of my messages
like so:

May 14 14:16:14 centos tac_plus accounting: Mon May 14 14:16:13 2007
192.168.1.1     joliver tty2     192.168.1.2     stop    task_id=217
timezone=UTC    service=shell   priv-lvl=1      cmd=show ip interface
brief <cr>


I checked the man pages you provided (which are by the way very good)
and could not find a way to send accounting data to syslog.  I guess I'm
looking for something like this:

accounting file = syslog local6

Is this even possible, or would it require a code change?  

Also, thank you for your maintenance of this tac_plus version.  I have
been looking for a clean version for a while, and settled on your fork.
You guys are doing a great job.  I created a Redhat Enterprise Linux
SRPM/RPM of your fork that I would gladly offer anyone who was
interested. It includes an init script that works great with Redhat's
init/chkconfig system.  

Thanks again,
-Jimmy 

-----Original Message-----
From: john heasley [mailto:heas at shrubbery.net] 
Sent: Monday, May 14, 2007 5:43 PM
To: Jimmy Oliver
Cc: tac_plus at shrubbery.net
Subject: Re: [tac_plus] pipe accounting info to syslog?

Mon, May 14, 2007 at 01:46:17PM -0400, Jimmy Oliver:
>  
> 
> Is there any way to pipe accouning information to syslog?  I would
like
> to ping this data to a centralized syslog server and can not figure
out
> how to do get it into a syslog facility instead of a local file.
> 

nope.  most modern syslogds can forward messages to a central server
without
needing to change the applications that are logging.