Hi, i have set up EventLog Analyzer 6.0.0 32bit on Suse 9.3 (on MYSQL)
I've follow step by step your Installation Instructions as the User Guide.
I've added 3 Unix Hosts. The status of this Hosts is: Logging Started / Scan successfull (Green Icon)
I've added a host, but EventLog Analyzer is not collecting event logs from it.
I have read the User Guide to the chapter Troubleshooting Tips at the paragraph "I've added a host, but EventLog Analyzer is not collecting event logs from it"
and:
- The host machine is not reachable from the EventLog Analyzer server machine
The host machine is reachable. The ping is successfull.
- You do not have administrative rights on the host machine
Under linux version installation, i can't find the "Administrator login credentials" on host's details.
Can't find "Verify Login".
However, from the status icon i understand that access has been made correctly.
Now, i think the problem is another.
From the Help Card read:
Event Log Server is running in Host: Mule (127.0.0.0)
Before adding an Unix host, you need to configure the syslog daemon on the host.
Append the following to / etc / syslog.conf file as follows:
*.* @ mule
Change the port number of the syslog service in / etc / services / to the Syslog Listener Port mentioned above.
After changing the syslog port, restart the syslog daemon on the Unix Host.
Question number 1:
When you write "you need to configure the syslog daemon on the host" which host mean? The server where I installed EventLog Analyzer (mule - 127.0.0.0) or the remote host I want to add the list of hosts to be monitored?
Question number 2:
in my system (both server and host), syslog.con not there.
I have the file syslog-ng.conf in the path / etc / syslog-ng /
If I wanted to edit this file, in which position I should insert the value *.* @ mule?
Question number 3:
Assuming that I should file amended to unix host I want to add, I modified the above file (syslog-ng.conf) uncomment
udp (ip ( "10.50.10.254") port (514));
(this ip is that of the UNIX host. analyzer setting than the server the service starts properly and gives me an error of bind)
Then I restarted the syslog daemon in / etc / init.d /
with the command. / syslog restart
Then I tried to access and correct erroneous Unix host EventLog Analyzer but still does not register any movement.
Can you help? Thank you.