Syslog not sending Logon Alerts

PKROETSCH — Thu, 05 Jun 2025 05:52:34 GMT

Hello,

I am required for compliance to track all user account activity. Therefore I need to track logon/logoff and login failures.

I have syslog configured on my filer but it only sends login failure messages out through syslog. Here is my syslog config.

Any help would be appreciated.

Thanks,

# $Id: //depot/prod/DOT/R8.0.3x/ontap/files/syslog.conf.sample#1 $

# Sample syslog.conf file. Copy to /etc/syslog.conf to use.

# You must use TABS for separators between fields.

# Log messages of priority info or higher to the console and to /etc/messages

*.info /dev/console

*.info /etc/messages

# Edit and uncomment following line to log all messages of priority

# err or higher and all kernel messages to a remote host, e.g. adminhost

# *.err;kern.* @adminhost

# Edit and uncomment following line to log all messages of priority

# err or higher and all kernel messages to the local7 facility of the

# syslogd on a remote host, e.g. adminhost.

# *.err;kern.* local7.*@adminhost

# Edit and uncomment following line to log all messages of priority

# err or higher and all kernel messages to a remote host, e.g. adminhost,

# at priority debug.

# *.err;kern.* *.debug@adminhost

# Edit and uncomment following line to log all messages of priority

# err or higher and all kernel messages to the local5 facility of the

# syslogd on a remote host, e.g. adminhost, at priority info.

# *.err;kern.* local5.info@adminhost

#Remote logging to LEM

#*.info local7.*@XXX.XXX.XXX.XXX

#AUTH

#*.* @xxx.XXX.XX.XX

*.info @xxx.XXX.XX.XX

auth.debug @xxx.XXX.XX.XX

authpriv.debug @xxx.XXX.XX.XX

kern.info @xxx.XXX.XX.XX

Re: Syslog not sending Logon Alerts

colin_graham — Thu, 15 May 2014 10:18:45 GMT

Hi.

Did you ever resolve this? - i have the same requirement.

Thanks