Chapter 14: Auditing and System Messaging

SOLARIS 9 EXAM OBJECTIVES COVERED IN THIS CHAPTER:

• Describe the fundamentals of the syslog function including the /etc/syslog.conf file and the relationship between syslogd and m4 macro processor.

• Explain how to configure system messaging, including configuring the /etc/syslog.conf, modifying the inetd process and using the logger command.

Ideally, when you install Solaris on your computer, everything will run perfectly. And when you configure a large number of computers on a network, everything will be fine as well. Realistically, though, this ideal computing world does not exist. The major problems that can happen, such as getting hacked or having a server crash, will always get your attention. However, the smaller problems, such as failed services, problematic daemons, and minor security breaches, can go unnoticed.

If you set up your computer to perform system logging (also called auditing), a notice for all problems-both major and minor-can be recorded and then viewed at a later time, as well as sent to the console you are logged into. By enabling system logging and messaging, you can have a record of major system events, and you can also note smaller problems and do something about them before they turn into bigger ones.