Virtual TapeServer 6.04.03 Operations and Administration Guide

Troubleshooting | 137
Requires the View log files access right
To view a Logwatch report
1. Click Supervisor Functions on the navigation pane.
2. Click Examine Logwatch Output in the Log Files section of the page. The VTS Server
Logwatch Reports page provides a list of reports, and the newest report is listed first.
3. Click the name of a TXT file to view its contents.
Remote logging of audit log records
If necessary, you can enable remote logging of auditd log records. This is done using the syslog
facility provided with the VTS operating system (Linux).
Note Log files are sent to the remote server in the clear text. Because the log files may
contain audit data, be careful to evaluate the safety of remote logging.
To enable remote logging
1. Log in to the VTS server as vtsa.
2. Use the su command to change to the root user:
su -
3. Edit /etc/syslog.conf and add a line for the remote host. The following line is an example
that logs kernel messages.
kern.* @remote.log.host.domain.com
where kern.* specifies to log all kernel messages and remote.log.host.domain.com
specifies the hostname or IP address of the remote host that will log messages for the
target host. To log other messages, refer to the auditd, syslogd, and syslog.conf man
pages.
4. Run the following commands:
chkconfig auditd off
service auditd stop
service syslog restart
These commands stop local logging through the auditd process and force audit records to
be logged through syslog. The syslog facility will send log messages to the remote system.
Note that audit log messages will also be listed in /var/log/kern_messages.
5. Log out of the VTS server.
6. If necessary, enable the remote system to receive the log messages.
The following steps describes how to configure syslog on a remote Linux server.
a. On the target (remote) system, log in.
b. Become root:
su -