Syslog

[Franco Lombardo]

Does anyone know how to configure syslog on AS400? I've already installed
PASE, I created the following /etc/syslog.conf file:

mail.debug /var/log/mail rotate size 100k files 4
user.debug /var/log/user rotate size 100k files 4
kern.debug /var/log/kern rotate size 100k files 4
syslog.debug /var/log/syslog rotate size 100k files 4
daemon.debug /var/log/daemon rotate size 100k files 4
auth.debug /var/log/secure rotate size 100k files 4
local2.debug /var/log/sudo rotate size 100k files 4
syslog.debug /var/log/syslog rotate size 100k files 4

I created the /var/log dir, then I started syslogd in a QP2TERM session, but
nothing is registered.

Any hints?

Thanks in advance.

Bye

Franco

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.francolombardo.net
Scala, Java, As400.....
http://twitter.com/f_lombardo
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Ad]

Post by Franco Lombardo
Does anyone know how to configure syslog on AS400? I've already
mail.debug /var/log/mail rotate size 100k files 4
user.debug /var/log/user rotate size 100k files 4
kern.debug /var/log/kern rotate size 100k files 4
syslog.debug /var/log/syslog rotate size 100k files 4
daemon.debug /var/log/daemon rotate size 100k files 4
auth.debug /var/log/secure rotate size 100k files 4
local2.debug /var/log/sudo rotate size 100k files 4
syslog.debug /var/log/syslog rotate size 100k files 4
I created the /var/log dir, then I started syslogd in a QP2TERM session,
but nothing is registered.
Any hints?
Thanks in advance.
Bye
Franco
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.francolombardo.net
Scala, Java, As400.....
http://twitter.com/f_lombardo
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I've created /QOpenSys/etc/syslog.conf file,
*.debug /tmp/syslog.out rotate size 100k files 4
created the output file: edtf '/tmp/syslog.out'
started the deamon with:
SBMJOB CMD(CALL PGM(QP2SHELL) PARM('/usr/sbin/syslogd')) JOB(SYSLOGD)
JOBQ(QUSRNOMAX) USER(QPGMR)
with result:
Browse : /tmp/syslog.out
Record : 1 of 5 by 18 Column : 1
116 by 131
Control :

....+....1....+....2....+....3....+....4....+....5....+....6....+....7....
+....8....+....9.
************Beginning of data**************
Dec 1 21:32:54 bugs syslog:info syslogd: restart

[Franco Lombardo]

Post by Ad
I've created /QOpenSys/etc/syslog.conf file,

Oh, the syslog.conf was under /QOpenSys!!!! Now it seems to work, but I
didn't understand what is it logging :-(

Any hints?

Thank you very much!

Bye

Franco

[Peter H. Coffin]

Post by Franco Lombardo

Post by Ad
I've created /QOpenSys/etc/syslog.conf file,

Oh, the syslog.conf was under /QOpenSys!!!! Now it seems to work, but I
didn't understand what is it logging :-(
Any hints?

Generally, it's logging things that happen in the PASE environment.

[Franco Lombardo]

Post by Peter H. Coffin
Generally, it's logging things that happen in the PASE environment.

So, nothing interesting at the moment :-(

Thanks.

Bye

Franco

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.francolombardo.net
Scala, Java, As400.....
http://twitter.com/f_lombardo
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Dr.Ugo Gagliardelli]

Post by Franco Lombardo

Post by Ad
I've created /QOpenSys/etc/syslog.conf file,

Oh, the syslog.conf was under /QOpenSys!!!! Now it seems to work, but I
didn't understand what is it logging :-(

Basically it output everything that whatever application will log with
syslog client.

[Franco Lombardo]

Post by Dr.Ugo Gagliardelli
Basically it output everything that whatever application will log with
syslog client.

Is there any "standard" way to log the contents of DSPLOG?

Thanks.

Bye

Franco

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.francolombardo.net
Scala, Java, As400.....
http://twitter.com/f_lombardo
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Dr.Ugo Gagliardelli]

Post by Franco Lombardo

Post by Dr.Ugo Gagliardelli
Basically it output everything that whatever application will log with
syslog client.

Is there any "standard" way to log the contents of DSPLOG?

"standard" is a fuzzy word!
Speaking about syslog, the standard way is using syslog!

Speaking about DSPLOG there's no way to feed syslogd but writing your
own syslog feeder.

Syslogd receives log entries by a "standard" protocol (starting from
rfc3164, but you should check AIX which standard is implementing) via
socket so you have to chance to write a program that receive DSPLOG
entries and send them to syslogd:
- send by socket
- invoke syslog by pase APIs
The program should also map DSPLOG messages to syslog one, e.g message
severity for DSPLOG ranges from 0 to 99, while syslog from 0 to 7 in
reverse priority, syslog message facility has no meanyng in dsplog, it
should be mapped to the application that generated the DSPLOG entry, e.g
sessage coming from os400 ftp server shoul be mapped to facilty 11,
all security related messages should be mapped to facilty 10 and so on:
not a smooth job. Obviously you can put all message into the same
facility (e.g a local one, over 16 on), but if someone is serching
syslog basing his query on facility, he will possibly miss your recordings.
The 1st one should be more performant because pase APIs must manage both
OS400 and PASE address space that are not the same, so they have to
allocate/deallocate memory continuously, and this is a big overhead.
Some years ago I measured a performance ratio of about 1/500, now, with
new releases and new hw, it's maybe better, I dont'know.

[Franco Lombardo]

As usual, your answers are very clear and useful.

Thanks a lot.

Bye

Franco


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.francolombardo.net
Scala, Java, As400.....
http://twitter.com/f_lombardo
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Peter H. Coffin]

Post by Franco Lombardo

Post by Dr.Ugo Gagliardelli
Basically it output everything that whatever application will log with
syslog client.

Is there any "standard" way to log the contents of DSPLOG?

Be aware that DSPLOG works on a different log than the logs managed by
syslogd.

DSPLOG log:

Job 847207/QMQM/MQ_RTVMIIP started on 12/03/09 at 15:57:31 in subsystem QMQM
Job 847224/PRODCNTL/LG_CRTRD0P started on 12/03/09 at 15:57:39 in subsystem L
Job 847224/PRODCNTL/LG_CRTRD0P ended on 12/03/09 at 15:57:40; 1 seconds used;
Job 847233/PRODCNTL/LG_MQPUT2P started on 12/03/09 at 15:57:45 in subsystem L
Job 847207/QMQM/MQ_RTVMIIP ended on 12/03/09 at 15:58:20; 1 seconds used; end
Job 847280/PRODCNTL/LG_CRTRD0P started on 12/03/09 at 15:58:25 in subsystem L
Job 847280/PRODCNTL/LG_CRTRD0P ended on 12/03/09 at 15:58:25; 1 seconds used;

These are in the i5 history log, and follow the usual message conventions.

syslogd logs:

Dec 3 01:00:05 l7lgalinux sendmail[9549]: nB3605DO009548: to=<***@l7lgalinux.atlanta.example.com>, ctladdr=<***@l7lgalinux.atlanta.example.com> (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31259, dsn=2.0.0, stat=Sent
Dec 3 04:02:02 l7lgalinux sendmail[22856]: nB3922XZ022856: from=root, size=1467, class=0, nrcpts=1, msgid=<***@l7lgalinux.atlanta.example.com>, relay=***@localhost
Dec 3 04:02:03 l7lgalinux sendmail[22858]: nB3922hd022858: from=<***@l7lgalinux.atlanta.example.com>, size=1791, class=0, nrcpts=1, msgid=<***@l7lgalinux.atlanta.example.com>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]
Dec 3 04:02:03 l7lgalinux sendmail[22856]: nB3922XZ022856: to=root, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=31467, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (nB3922hd022858 Message accepted for delivery)
Dec 3 04:02:03 l7lgalinux sendmail[22859]: nB3922hd022858: to=<***@l7lgalinux.atlanta.example.com>, ctladdr=<***@l7lgalinux.atlanta.example.com> (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=32042, dsn=2.0.0, stat=Sent

These are generally plain text files, so they can be parsed with pretty much
anything that parses text files. The formats are space-separated as

month day time host process_tag[process_id]: everything_else

where everything_else is a process-dependant format. sendmail's pretty well
suited to machine parsing, other things may not be so much.