Solaris/Unix equivalent of Event Log

Question

What is the unix equivalent of the Windows Event Log - the tool that logs all processes that start and stop.

Need not be exact - with the whole GUI and everything. Anything close would do.

Answer 1

the /var/log directory is where almost all logs end up. There are graphical tools around to read them, though almost all are admin-friendly text.

Answer 2

This is different for Solaris/Linux:

• Solaris 10: /var/svc/log/svc.startd.log
• Linux: /var/log/syslog or /var/log/messages*

*Although most daemons have their own logfiles in /var/log/daemonname/ for example.

Answer 3

There is auditd which included many informations like ... who execute what. Also there is syslogd / syslog-ng / rsyslog whcih is being used to monitor syslog event and parse / make actions based on some rules (These rules usually are located on /etc/rsyslog.d or /etc/rsyslog.conf {similar /etc/auditd.conf}).

For GUI you could use logzilla or splunk as free frameworks. (Of course there are many many others)

Answer 4

auditd would do your audits (but you will need to configure this). Additionally your "equivilent" of Event Log would ultimately be syslog-ng, which replaces most syslog on most Linux/Unix systems. Furthermore, there is a utility called logrotate on Linux systems that allows you to rotate out your log files on a time/size basis, highly configurable.