Log files

• HP-UX: /var/adm/syslog/*.log
• AIX:
  Enable logging of all successful logins
  1. Create/check /etc/security/authlog:

     
     #!/usr/bin/ksh
     # /etc/security/authlog: syslog all successfull logins
     /usr/bin/logger -t tsm -p auth.info "$@ logged in from $(/usr/bin/tty) (${DISPLAY})"
     

     and allow root only:

     chmod 700 /etc/security/authlog
     

  2. In /etc/security/login.cfg
     

     AUTHLOG:
             program = /etc/security/authlog
     

  3. In /etc/security/user
     change the auth2 attribute in the default stanza:

     auth2 = AUTHLOG
     

  4. for logins via CDE /etc/dt/config/Xsession.d/dtlog:

     #!/usr/bin/ksh
     # /etc/dt/config/Xsession.d/dtlog: log dtlogins
     /usr/bin/logger -t dtlogin -p auth.info "${LOGNAME} logged in from (${DISPLAY})"
     

• /etc/syslog.conf
  defines the amount of system logging:

  *.debug               /var/adm/syslog.debug
  *.info                /var/adm/syslog
  mail.debug            /usr/spool/mqueue/log
  auth.debug            /var/adm/syslog.auth   # for the logging machine, otherwise @biolog
  #  auth.debug           @biolog
  

  IMPORTANT: do not use @biolog on the logging machine itself, it well generate in infite loop of syslogs ! The actual value of biolog is determined via DNS name resolution.
  Strangely, you have to "generate" the log files manually ???

  touch /usr/spool/mqueue/syslog
  touch /var/adm/syslog.auth
  touch /var/adm/syslog.debug
  touch /var/adm/syslog
  

• /local/bin/newsyslog
  is a GSI-supplied shell script to rename previous versions of the above logfiles by appending a version number running from 0 through 5 This way the last week's syslogs are kept. Use

  crontab -e
  0 3 * * * /local/bin/newsyslog 
  

  to schedule this at 3 AM.