Open-Systems Group

I have never really liked the syslogd shipped by Sun for Solaris. Syslog-ng offeres a lot more features and performs much better IMHO.. So I ended up replacing my syslogd to syslog-ng. Read on more on how to do so:

Steps

1. Download the Solaris 10 syslog-ng Package.

2. Remove your current syslog defs from svc database

# svcadm disable system-log
# svccfg
svc:> delete system-log*

3. Install the package:

# pkgadd -d NCsysng-1.6.7-1.pkg

The following packages are available:
1 NCsysng next gen syslog server
(sparc) 1.6.7-1

Select package(s) you wish to process (or ‘all’ to process
all packages). (default: all) [?,??,q]:

[…]

Ensure that syslog-ng is now in your svc manifest

# svcs | grep system-log-ng
online 17:28:52 svc:/site/system-log-ng:default

You can use a a better configuration than the one shipped with this package:

====================================================
####################################################
# See syslog-ng(8) and syslog-ng.conf(5) for more
# information
####################################################

# Options
options {
sync(0);
use_fqdn(yes);
};

# Sources of syslog messages (only local on clients)
source s_local {
sun-streams(”/dev/log” door(”/etc/.syslog_door”));
internal();
};

# Destinations: local files, the console, and the remote syslog server
destination l_authlog { file (”/var/log/authlog”); };
destination l_messages { file (”/var/log/messages”); };
destination l_maillog { file (”/var/log/maillog”); };
destination l_ipflog { file (”/var/log/ipflog”); };
destination l_imaplog { file (”/var/log/imaplog”); };
destination l_console { file (”/dev/console”); };
destination l_syslog { file (”/var/log/syslog”); };

# Level Filters
filter f_emerg { level (emerg); };
filter f_alert { level (alert .. emerg); };
filter f_crit { level (crit .. emerg); };
filter f_err { level (err .. emerg); };
filter f_warning { level (warning .. emerg); };
filter f_notice { level (notice .. emerg); };
filter f_info { level (info .. emerg); };
filter f_debug { level (debug .. emerg); };

# Facility Filters
filter f_kern { facility (kern); };
filter f_user { facility (user); };
filter f_mail { facility (mail); };
filter f_daemon { facility (daemon); };
filter f_auth { facility (auth); };
filter f_syslog { facility (syslog); };
filter f_lpr { facility (lpr); };
filter f_news { facility (news); };
filter f_uucp { facility (uucp); };
filter f_cron { facility (cron); };
filter f_local0 { facility (local0); };
filter f_local1 { facility (local1); };
filter f_local2 { facility (local2); };
filter f_local3 { facility (local3); };
filter f_local4 { facility (local4); };
filter f_local5 { facility (local5); };
filter f_local6 { facility (local6); };
filter f_local7 { facility (local7); };
# Custom Filters
filter f_user_none { not facility (user); };
filter f_kern_debug { filter (f_kern) and filter (f_debug); };
filter f_daemon_notice { filter (f_daemon) and filter (f_notice); };
filter f_mail_crit { filter (f_mail) and filter (f_crit); };
filter f_mesg { filter (f_kern_debug) or
filter (f_daemon_notice) or
filter (f_mail_crit); };
filter f_authinfo { filter (f_auth) or program (sudo); };

# Log statements
# Log things locally
log { source (s_local); filter (f_authinfo); destination (l_authlog); };
log { source (s_local); filter (f_mail); destination (l_maillog); };
log { source (s_local); filter (f_local0); destination (l_ipflog); };
log { source (s_local); filter (f_local1); destination (l_imaplog); };
log { source (s_local); filter (f_syslog); destination (l_syslog); };
log { source (s_local); filter (f_emerg); filter (f_user_none);
destination (l_console); };
log { source (s_local); filter (f_mesg); filter (f_user_none);
destination (l_messages); };
====================================================

Save this file as /usr/local/etc/syslog-ng/syslog-ng.conf and restart syslog-ng (svcadm restart system-log-ng)

Voila! You should have syslog-ng working on your system…

Painless?