7-Mode syslog.conf Configuration

[marshit]

Is there a trick to configuring the syslog.conf on 7-mode? I have gone into the GUI System Manager and to Diagnostics --- > Syslog and selected Advanced and copied a sample file and then edited. But when I click "ok" the screen does nothing but just sit there, so then I can only select cancel.

Then using a Windows machine I go to \\filer\C$, I have already given myself access to the C$ & /etc directories but yet I can't copy, paste, rename anything because it tells me I still do not have permissions.

Does anyone have an idea of what is left to be done? I'm running version 8.2.

I'm simply trying to get my syslog.conf pointed to an external Syslog server.

[Mjizzini · Accepted solution]

Regarding\\filer\C$, If your vol0 is unix security style, you may need to usermap your windows user to root for it to  gain access.

Keep in mind that you can use the following 2 commands from your ssh session to edit text files. 

*>rdfile and *>wrfile

How to add lines to a configuration file on the storage system using wrfile. The command wrfile does not have an option to Exit without Saving

[marshit]

Thank you!

[Ontapforrum]

Try putty it's easy.

1. Read and Copy the content from the sample syslog configuration file to 'notepad' (or syslog.conf of a working partner node):

filer>rdfile /etc/syslog.conf.sample

2. In the notepad content of the syslog settings point to your 'remote host' syslogd server,  whatever you change you want to make)

3. Paste the content in syslog.conf and save the file (This will create a file for you)

filer>wrfile /etc/syslog.conf (Press enter, system will appear paused, now copy paste the content from 'notepad' and press ctl +c)

4. Reinitialize syslog and verify if messages logging is normal:

filer>rdfile /etc/syslog.conf

System will automatically restart syslogd within 30 seconds, with this message
*kern.syslogd.restarted:info: syslogd: Restarted*

[marshit]

Now this would only be for the syslog but there doesn't appear to forward audit logs, unless this piece covers that.