Syslog configuration for Isilon

Question

We are configuring Isilon to send syslog information to splunk servers. Could any one suggest how can I perform this or any document refering to this. Thanks

cincystorage · Accepted Answer

You've got two options.. You can modify the syslog.conf file like you would any FreeBSD box. The biggest different is restarting the syslogd process on all nodes of the cluster either manually or by doinga :

isi_for_array -sq 'killall -HUP syslogd'

The other, and easier, option might be hte "isi_log_server" command which will do the same thing as editing the syslong.conf file... The syntax is:

isi_log_server add [filter]

The filter syntax is the same as syslog.. The default is "*.warn;*.notice;kern.*;ifs.info;istat.none""

Just make sure the remote server is setup to allow remote logging.

ude1 · Answer

Thanks mmay. Tried it on two clusters. It works!

ude1 · Answer

I'm not the thread starter :-)

cincystorage · Answer

No Problem. Glad it works! Don't forget to mark your question as answered so other people can find the answer easily.

asafayan1 · Answer

Hi,

I'm trying to configure all syslog level 4 / warning and above with the following syntax but it is failing. What am I doing wrong?

# isi_log_server add 172.19.39.70 *.warn;

zsh: no matches found: *.warn

Does anyone have any recommended syslog level to configure on the Isilon platforms?

TIA,

Amir

Peter_Sero · Answer

# isi_log_server add 172.19.39.70 '*.warn;' i.e. enclose the last parameter in quotes ' ' otherwise the shell looks out for filenames matching  *.warn, which is not want you here. Cheers -- Peter

vyasakshay · Answer

I am getting the audit events for one zone but i am not getting it for other. i have enabled audit protocol for that zone. what might be the problem?

Rao M · Answer

Thanks, This worked.  How can I send Encrypted logs to Syslog server using port 6514? Thanks Rao

Isilon

Was this post helpful?