[tac_plus] accounting & syslog

[Aaron Wasserott]

Yes, you would need a syslog daemon on your tacacs server that can send syslog messages over the network. Your local tac_plus daemon would use the local syslog instance, and in your syslog config you would configure the local and export parameters - so you can keep local accounting records as well as send to your syslog server. Then other log-monitored daemons would work the same way, they route locally to syslog, syslog sends to local file and across the network to a remote log host.

Not sure what flavor of Linux you are running, but the common rsyslog daemon supports remote logging.

http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch05_:_Troubleshooting_Linux_with_syslog#.UwLW3LSSpww

Cheers,

-----Original Message-----
From: tac_plus-bounces at shrubbery.net [mailto:tac_plus-bounces at shrubbery.net] On Behalf Of Josten, Michael
Sent: Monday, February 17, 2014 1:41 AM
To: 'tac_plus at shrubbery.net'
Subject: [tac_plus] accounting & syslog

Hello everyone,

i went through some posts I found in the mailing list and took a look at the tac_plus.conf manpage.
Both accounting method and syslog facility are described so far, but what I miss or maybe just haven't found :
How can I send notifications to a remote syslog-ng host ? My guess is, I have to install syslog-ng on both, my tacacs+ host & the syslog-ng / logstash stack host. This is not a big deal, I just want to keep my T+ machine as clean as possible.

Thanks in advance
Michael
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20140217/a6f2c2a2/attachment.html>
_______________________________________________
tac_plus mailing list
tac_plus at shrubbery.net
http://www.shrubbery.net/mailman/listinfo/tac_plus