Cygwin - Logging
Last Updated: 06/15/13
This guide is the seventh part of my Cygwin SSH server series and assumes that the first six guides have already been completed. If you have not yet completed those article, click here to go to the first article. This article is broken up into two sections – Logging with Syslog-ng and Logging with Syslogd. The first part will cover how to enable server logging through the use of Syslog-ng and the second part will cover how to enable logging through the use of Syslogd. I have personally had better success with using Syslogd and therefore prefer to use it over the newer Syslog-ng. Feel free to judge for yourself.
If you wish to skip the Syslog-ng logging tutorial and go directly to the Syslogd tutorial, click here; otherwise, keep reading below.
Logging with Syslog-ng
Open a Cygwin terminal. In the terminal type “/bin/syslog-ng-config” to start the configuration script. Then follow the commands below to create and start the service. See the picture below for more details.
/bin/syslog-ng-config yes net start syslog-ng
The first thing to change is the logging facility. The facility is used to specify the subsystem that produces the messages. The default is “AUTH” which has Windows handle the logging with its internal event system. To change it such that the events will be logged locally, i.e. in /var/log/messages, the value should be changed to one of the local systems. The second thing to do is to uncomment the log level. Leave the default value or change it to log less often, as your needs require. To make these changes, edit the lines shown in the below images.
To exit nano and save your changes press CTRL+X, then Y, and then Enter.
To finish things up, the service must be started. Start the service by executing the command shown below.
cygrunsrv -S syslog-ng
You have now successfully enabled logging. To see the events, view the file found in /var/log/messages. This completes the Syslog-ng logging section. If you wish to see how logging is performed through Syslog, proceed to the next section; otherwise, click here to skip it.
Logging with Syslogd
Setting up Syslogd is extremely easy. Simply execute the first line shown below in a Cygwin terminal to run the script and then type “yes” when it asks you if you want to install it as a service. If you have already installed Syslog-ng, (following the first section of this tutorial) then you’ll need to uninstall it first, by simply typing “yes” at that prompt, as shown below. If you came here directly, then the highlighted portion in the image will not be visible.
At this point, you will need to edit the sshd configuration file, exactly as shown here. Once you’ve finished that, you can start the Syslogd service by executing the second command shown below.
/bin/syslogd-config net start syslogd