syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

0
votes
1answer
9 views

“Error: Could not complete SSL handshake. 5” in syslog of otherwise fine Nagios monitored host

I have a nagios server on ubuntu that monitors many other ubuntu servers. They have configured with chef, and they are correctly monitoring things over NRPE (i.e. the NRPE checks work. When something ...
1
vote
1answer
27 views

Rsyslog not logging events

I'm trying to stand up a syslog server to receive events from a piece of network equipment, but I can't seem to get it to actually log the events to disk. I can confirm that the connection is being ...
0
votes
0answers
15 views

Syslog filter to own file by tag or text contain

I need to log from my Python application to syslog. In syslog I want filter messages from my app to own file. I'm using Debian 8.3. My rsyslog rules: # cat /etc/rsyslog.d/99-MyLog.conf :syslogtag, ...
0
votes
1answer
54 views

Rsyslog output in GELF

rsyslog is powerful, but its docs aren't that explicit. I can't figure out how to parse a log file and route it directly to Graylog in GELF format. I have found bits of documentation about outputing ...
0
votes
0answers
26 views

Rsyslog filter by facility name and multiple string conditions

We have the following line in an rsyslog.d/conf.d file: if $syslogfacility-text == 'local6' and ($msg contains 'TID' and $msg contains 'JID' and $msg contains 'INFO') then ~ The issue is that the ...
0
votes
1answer
16 views

Syslog-ng can close connection

I have a server that collect secure/auth logs in my datacenter from all other server, it runs syslog-ng 3.2.5. It's configured to receive tcp connection, here is the conf: tcp(ip(0.0.0.0) port(514) ...
0
votes
0answers
7 views

Storing rsyslog remote events into ip based file

I was looking in the documentation and over google if it's possible to create single rule in rsyslog that would place the syslog events into files based on source ip/host/any other variable. What I ...
0
votes
0answers
69 views

Missing /var/log/messages file in CentOS 6.8

I'm not sure what I'm doing wrong, but my Linux box doesn't seem to be logging any info to the messages file. Will someone please help? Here's the content of the /etc/rsyslog.conf file (rsyslog-5.8....
0
votes
2answers
36 views

Multiple readers on a Unix Domain Socket?

I was hoping to have multiple clients reading from /dev/log (rsyslog and a custom tool) which I understand is a unix domain socket. How can this be achieved?
0
votes
1answer
105 views

Pass host from nginx to rsyslog

I have a cluster of nginx web servers and a separate syslog server running rsyslog. The nginx vhost looks like this: access_log syslog:server=10.0.0.51,facility=local1,severity=info combined; ...
0
votes
0answers
24 views

Reset to device, \Device\RaidPort2, was issued

I get this warning log when the windows server 2012 starts backup service that include OS drives. Log Name: System Source: iaStorA Date: .... Event Id: 129 Task Category: none Level: Warning Keywords:...
1
vote
1answer
35 views

How do I handle messages from my custom application in rsyslog?

I have a Ruby application on my server, let's call it "alpha". The application emits syslog messages with the program name "alpha". I want to separate my log messages into separate files based on what ...
0
votes
2answers
47 views

Rsyslog pull tools or strategy

I would collect the log(in particolar auditd but also other syslog log) produced by several linux server in a centralized syslog server installed in a linux server. I would configure the centralized ...
0
votes
0answers
47 views

Forward to remote syslog in CoreOS

I want to aggregate CoreOS logs to Papertrail service, which basically provides a syslog endpoint for aggregate logging. Common advice for this setup seems to be starting a service that does ...
1
vote
0answers
19 views

Ubuntu 14.04 syslog showing @@@@ for long time period

My Ubuntu Server wasn't accessible for a long time, only after restarting the server I could access it again. I have checked the syslog file which shows something like @@@@@@@@@@@@@ from last night ...
2
votes
0answers
166 views

Nginx log to syslog on TCP port

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do: error_log syslog:server=192.168.1.1; However I need to ...
-1
votes
1answer
48 views

Which Nginx log file is for fail2ban?

I have files in /var/log/nginx/ the log file /var/log/nginx/access.log is empty. But the /var/log/nginx/access.log.1 is being appended as always. In file /etc/fail2ban/fail2ban.conf, logtarget = /...
1
vote
0answers
43 views

syslog spammed with authdaemond: pam_ecryptfs: pam_sm_authenticate: /home/user is already mounted

I setup my new server with harddisk-encryption and now I noticed that /var/log/syslog is full of the following lines: server authdaemond: pam_ecryptfs: pam_sm_authenticate: /home/user is already ...
3
votes
0answers
52 views

When configuring rsyslog to log to mysql DB, what is purpose of SystemEventsProperties table?

I've configured rsyslog on my servers to log to a remote mysql DB. I did this essentially by following the rsyslog wiki and it essentially creates two tables: mysql> show tables; +----------------...
1
vote
0answers
62 views

Postfix logs to remote log host

On my Ubuntu 14.04 server, I'm using Postfix as a front-end mailserver, and I would like to send all mail related info, including email addresses, to a remote host. In the file /etc/rsyslog.d/50-...
0
votes
1answer
29 views

Reading syslog-ng logs being sent to a remote server

I have a Docker container which is sending syslog logs to logentries.com. This is working fine, but for times when logentries is down or delayed, I want a way to read logs generated in realtime inside ...
1
vote
0answers
19 views

rsyslog parsing logs with liblognorm

I'm trying to use such .rb file to parse logs: version=2 rule=:%Server:char-to:\t%\t%stamp:char-to:\t%\t%ip:ipv4%\t%Site:char-to:\t%\t%BID:char-to:\t%\t%SID:char-to:\t%\t%LD:char-to:\t%\t%UserID:...
0
votes
0answers
15 views

rsyslog 8.17 char changing

My rsyslog configuration do not want to work properly Here is my example log: Mar 10 10:57:35 servername log_tag servername.at.google.com#01120160310105735#01144.44.44.443#011app#011162040-...
1
vote
1answer
60 views

HaProxy suddenly crashing on new Ubuntu Images (same config works elsewhere)

I have been using HAProxy for about two years with the same working configuration. I've installed HaProxy multiple times over the last week on Ubuntu 14.04, 15.10 and I am getting out of Memory ...
0
votes
1answer
228 views

/var/log/syslog is empty. Service rsyslog is running, but not installed

Problem Periodically I encounter the problem that /var/log/syslog is empty. $ ls /var/log/syslog -rw-r----- 1 root adm 0 Dez 31 06:29 /var/log/syslog Environment and Installed packages I am using ...
0
votes
0answers
40 views

Log file bloat due to nouveau

Both my kern.log and syslog files have grown to >50Gb and contain a few hundred million lines of: Feb 23 23:32:43 Yawning-Angel kernel: [396111.179453] nouveau E[ PFIFO][0000:05:00.0] PBDMA0: ch 2 [...
0
votes
1answer
119 views

Referencing journald fields when forwarding messages to syslog-ng

How can I change my syslog-ng template so that when the log originates from a systemd service / unit, the log message will include the unit's name? Using ${PROGRAM} just shows the name of the ...
0
votes
1answer
24 views

Open relay or some other issue?

I am running a dovecot/postfix server with virtual users/aliases. According to tools such as http://www.mailradar.com/openrelay/ I do not have any open relays. However, I am getting a lot of records ...
1
vote
1answer
85 views

How to read sar file from different ubuntu system

I am using two different version on ubuntu one is 14.04 and other is 15.10. I want to read 14.04 systems sar files from ubuntu 15.10 system. I have transferred the sar files but can't read it.
5
votes
1answer
149 views

How can I reduce the verbosity of certain Ansible tasks to not leak passwords into syslog?

Sometimes I would like to use Ansible's lineinfile or blockinfile modules to write a password into some configuration file. If I do so, the whole line or block, password included, ends up in my syslog....
0
votes
0answers
31 views

How to get rid of unexpected nslcd related messages caused by resolvconf?

I'm on a Ubuntu 12.04 based system. Our system is setup to use nslcd to allow LDAP authentication. In syslog we see lines like this: /var/log/syslog.1:Dec 20 06:25:11 T53-1014-014 nslcd[1496]: [...
0
votes
1answer
86 views

How to make svlogd send logs via UDP

I am currently using runit + svlogd for supervising some applications, but when deploying to multiple machines, I have the need to centralize/unify the logs in a single place in order to simplify ...
0
votes
1answer
249 views

Nginx reverse proxy to server with login not working as expected

I have two servers behind an nginx reverse proxy. I am being forwarded correctly to the sites, but one of the sites has a login before it allows you into the site (similar to sharepoint), and the ...
1
vote
1answer
46 views

logrotate frequency - when and from when

if have lograte in my daily cron /etc/cron.daily/logrotate -- assume cron.daily is run at 1.05am daily and if my logrotate config has a weekly settings Does it means that my logrotate will ...
0
votes
1answer
33 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
1
vote
1answer
61 views

Cisco ASA logging buffered spams terminal and console lines

I have several routers, switches and firewalls that send logs to a syslog server without interfering with the console line. I'm testing an ASA 5506 (running IOS 9.5.2) at a remote location that ...
2
votes
1answer
171 views

What process is causing unexpected nslcd syslog entries?

We're using LDAP for authenticating users our devices using nslcd and we're seeing messages in syslog like this: /var/log/syslog.1:Dec 20 06:25:11 T53-1014-014 nslcd[1496]: [398c89] <passwd="*">...
0
votes
0answers
28 views

How to forward logs and offenses from solarwinds to another server

There are several solarwinds servers in my Network. I want to aggregate some important logs and status from all of these different servers in a third party log server. I'v just searched but I didn't ...
0
votes
0answers
25 views

rsyslog not filtering message field

Trying to remove ALL cron log stuff from auth/syslog but I cannot get it. Here is a snippet of my rsyslog. Not sure how to get this to format right, it keeps wanting to mess with my paste. But here ...
0
votes
1answer
171 views

systemd: Failed to make us a subreaper: Invalid argument. SSH

Since upgrading to Debian 8 (Jessie) which brought in systemd I'm getting the title of this post in my syslog errors. Remote ssh login begins 10:33:51 pap1 systemd[1]: Starting user-0.slice. 10:33:...
0
votes
1answer
85 views

Change message content in a syslog server

I am looking to log some troubleshooting info from a DataPower Appliance into a syslog. Although it is already logging, I have a third party solution that requires some modification to the messages, ...
2
votes
0answers
171 views

How does one separate log data sent to a remote rsyslog server?

I have messages from multiple apache2 web servers logging to a rsyslog server. I've used a template to separate each /var/log/syslog file into its own folder based off of the ip address of the server ...
1
vote
1answer
74 views

logrotate - run the postrotate after all processing

I have a logrotate script that is structured to rotate logs collected by syslog. Part of that script is to reload the syslog process. The problem is that the syslog reload runs for each matching log ...
0
votes
0answers
19 views

How can I select an output device for video from headless server?

I have a syslog server, and I call it headless, but it actually does have two monitors attached to it via an internal video card. I never actually use the monitors since I'm just ssh'd in, and the ...
0
votes
1answer
197 views

How can I make rsyslog send the logfiles to a location outside of /var/log?

I have a central syslog server (ubuntu 14.04 server), that I've set up to take in logs from many servers. This server has a storage hard drive that is very large, mounted at /home/username/logs I'd ...
1
vote
0answers
38 views

Strange messages in my syslog on Debian

I am getting strange messages on my /var/log/syslog that aren't usual. I am running a Debian Jessie LXC Container inside of a Debian Wheezy machine. But I believe this is not the problem. An example ...
0
votes
0answers
54 views

Systemd - do not log output from particular service, but forward to syslog

Is it possible for systemd to not log data from particular service, but to still forward it to the syslog? StandardOutput=syslog StandardError=syslog
0
votes
0answers
30 views

Journald: give users access to specific unit's logs

I'm taking care of a server (Debian Jessie) that several developers use for deploying and managing their work. Now there is a script on this server (managed by one of the developers) that does some ...
0
votes
1answer
55 views

Send all logs of a system to one specific syslog local facility (local1-7) [closed]

I want to assign the syslog local facilities to specific OS, so I can sort the incoming logs on the logserver (e.g. local1 for Windows logs, local2 for RedHat logs, etc). It worked perfectly on ...
2
votes
1answer
39 views

Is there a way to write application logs like Tomcat and PostgreSQL to Tenable Log Correlation Engine?

My IT group uses Tenable's Log Correlation Engine and we have our Linux servers writing syslog to LCE. Is there a way to write our Tomcat and PostgreSQL application logs to LCE?