[tac_plus] accounting & syslog

[Josten, Michael]

I installed several syslog-ng instances and everything works fine. Accounting messages are properly forwarded and processed
in the EKL stack. Had to enable the "keep hostnames" option to keep my perl scripts working on the correct host.
I didn't thought it was that easy, sorry for the panic :P

Thanks and best regards
Michael

-----Ursprüngliche Nachricht-----
Von: Aaron Wasserott [mailto:aaron.wasserott at viawest.com] 
Gesendet: Dienstag, 18. Februar 2014 04:45
An: Josten, Michael; 'tac_plus at shrubbery.net'
Betreff: RE: accounting & syslog

Yes, you would need a syslog daemon on your tacacs server that can send syslog messages over the network. Your local tac_plus daemon would use the local syslog instance, and in your syslog config you would configure the local and export parameters - so you can keep local accounting records as well as send to your syslog server. Then other log-monitored daemons would work the same way, they route locally to syslog, syslog sends to local file and across the network to a remote log host.

Not sure what flavor of Linux you are running, but the common rsyslog daemon supports remote logging.

http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch05_:_Troubleshooting_Linux_with_syslog#.UwLW3LSSpww

Cheers,

-----Original Message-----
From: tac_plus-bounces at shrubbery.net [mailto:tac_plus-bounces at shrubbery.net] On Behalf Of Josten, Michael
Sent: Monday, February 17, 2014 1:41 AM
To: 'tac_plus at shrubbery.net'
Subject: [tac_plus] accounting & syslog

Hello everyone,

i went through some posts I found in the mailing list and took a look at the tac_plus.conf manpage.
Both accounting method and syslog facility are described so far, but what I miss or maybe just haven't found :
How can I send notifications to a remote syslog-ng host ? My guess is, I have to install syslog-ng on both, my tacacs+ host & the syslog-ng / logstash stack host. This is not a big deal, I just want to keep my T+ machine as clean as possible.

Thanks in advance
Michael
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20140217/a6f2c2a2/attachment.html>
_______________________________________________
tac_plus mailing list
tac_plus at shrubbery.net
http://www.shrubbery.net/mailman/listinfo/tac_plus