Environment
Novell Sentinel 6.1
Novell Sentinel RD
3rd Party Operating Systems and Products
Novell Sentinel RD
3rd Party Operating Systems and Products
Situation
Sentinel Syslog Collector not receiving events from HP-UX syslog
Resolution
UDP 514 is a privileged port on and is recommended to change the port used to by the collector to a free high port.
On the HP-UX Server:
3. Add a line: *.info<tab>@<Sentinel Server IP Address>
4. Save and Close
5. Go to /etc/services
6. Find syslog 514/udp and change it to 51414/udp
7. Save and Close.
8. Go to the /etc/hosts file (in case DNS is not configured or temporarily down)
9. In the Section that your file has for #Linux Servers (Name might differ depending on setup)
10. Now execute the following commands
Log out of the HP-UX Server, and test if you see incoming events if you try to authenticate with a incorrect passwords.
The following steps can be used for to forward syslog messages on the high port for HP-UX
HPUX does not support syslog on TCP, so a UDP syslog server needs to be added to the Sentinel system
1. In the Sentinel Control Centre, open Event Source Management
1. In the Sentinel Control Centre, open Event Source Management
2. Add a new Syslog Server
3. Choose a UDP port, but not port 514, change the port to 51414
On the HP-UX Server:
Steps as follows. (These steps presume you have the Syslog Service running on the HP-UX machine)
1. Log in as root
2. Go to /etc/syslog.conf
3. Add a line: *.info<tab>@<Sentinel Server IP Address>
4. Save and Close
5. Go to /etc/services
6. Find syslog 514/udp and change it to 51414/udp
7. Save and Close.
8. Go to the /etc/hosts file (in case DNS is not configured or temporarily down)
9. In the Section that your file has for #Linux Servers (Name might differ depending on setup)
Enter a line: <Sentinel_Server_IP><tab><Sentinel_Server_FQDN><tab><Sentinel_Server_BIOS_Name<tab>#Sentinel Server
10. Now execute the following commands
/sbin/init.d/syslogd stop
syslogd -v
kill -HUP `cat /etc/syslog.pid`
syslogd -v
kill -HUP `cat /etc/syslog.pid`
/sbin/init.d/syslogd start
Now, open the SCC again, and then go to ESM.
At this stage you should see that a event source connected to the syslog connector
Right click on the server and click on RAW Data Tab.
Log out of the HP-UX Server, and test if you see incoming events if you try to authenticate with a incorrect passwords.
In the RAW Data tab you should see events coming in.