[tac_plus] Re: pipe accounting info to syslog?

[john heasley]

Tue, May 15, 2007 at 09:07:01AM -0400, Jimmy Oliver:
> Hi John,
> 
> Thanks for your fast response to my message.  I am able to get the log
> messages to go to a centralized syslog server.  My issue is with the
> accounting  information.  This is a snippet from the tac_plus config
> file:
> 
> accounting file = /var/log/tac_plus.acct
> logging = local6
> 
> from syslog.conf:
> 
> # Send tac_plus messages to central server
> local6.*
> @syslog.somehost.com
> 
> 
> With this setup, all tac_plus log messages are sent via the local6
> facility to syslog.somehost.com.  The problem is the accounting data.  I
> *could use a hack like this to get them into syslog, but it is ugly at
> best.
> 
> tail -f /var/log/tac_plus.acct | logger -t "tac_plus accounting" -p
> local6.info  &	
> 
> This works, but I end up with a double timestamp on all of my messages
> like so:
> 
> May 14 14:16:14 centos tac_plus accounting: Mon May 14 14:16:13 2007
> 192.168.1.1     joliver tty2     192.168.1.2     stop    task_id=217
> timezone=UTC    service=shell   priv-lvl=1      cmd=show ip interface
> brief <cr>
> 
> 
> I checked the man pages you provided (which are by the way very good)
> and could not find a way to send accounting data to syslog.  I guess I'm
> looking for something like this:
> 
> accounting file = syslog local6
> 
> Is this even possible, or would it require a code change?  

I misunderstood or did not read closely.  This is not possible ATM, but I
do agree it is silly not to have go to syslog if you disired.  I'll have
to look into adding that feature.

> Also, thank you for your maintenance of this tac_plus version.  I have
> been looking for a clean version for a while, and settled on your fork.
> You guys are doing a great job.  I created a Redhat Enterprise Linux
> SRPM/RPM of your fork that I would gladly offer anyone who was
> interested. It includes an init script that works great with Redhat's
> init/chkconfig system.  

I can place it on my ftp server.

> Thanks again,
> -Jimmy 
> 
> -----Original Message-----
> From: john heasley [mailto:heas at shrubbery.net] 
> Sent: Monday, May 14, 2007 5:43 PM
> To: Jimmy Oliver
> Cc: tac_plus at shrubbery.net
> Subject: Re: [tac_plus] pipe accounting info to syslog?
> 
> Mon, May 14, 2007 at 01:46:17PM -0400, Jimmy Oliver:
> >  
> > 
> > Is there any way to pipe accouning information to syslog?  I would
> like
> > to ping this data to a centralized syslog server and can not figure
> out
> > how to do get it into a syslog facility instead of a local file.
> > 
> 
> nope.  most modern syslogds can forward messages to a central server
> without
> needing to change the applications that are logging.