How do I send all information in /var/adm/message file to a remote system?

Question

I'm trying to figure out how to send all information that is normally identified in the /var/adm/message file on a Solaris system to a remote system.

Solution

You can simply edit the /etc/syslog.conf file and, wherever /var/adm/messages appears, duplicate the line and replace /var/adm/messages by @remoteSystem with remoteSystem being the IP address or hostname of the remote server where to send the logs.

eg:

before:

...
*.err;kern.debug;daemon.notice;mail.crit    /var/adm/messages
...

after:

...
*.err;kern.debug;daemon.notice;mail.crit    /var/adm/messages
*.err;kern.debug;daemon.notice;mail.crit    @jaylogserver
...

Restart syslogd for the change to be taken into account:

# svcadm restart system-log

Note that the remote server must be configured to accept remote messages. If on Solaris too, that would be done with this command:

# svccfg -s system-log setprop config/log_from_remote = true
# svcadm restart system-log

Comments

[Greg Hewgill]

Why do something custom? Just use syslog, that's what it's there for.

[nobody]

@Grey Hewgill what would i edit in the syslog config in order to make this all work ? i understand the basic of syslog but not 100 percent sure how to make /var/adm/message to a remote system