Questions tagged [syslog]
syslog is a standard for logging messages about the operation of a system.
667
questions
0
votes
0
answers
16
views
Rsyslog storing only certain type of events in a file
I am collecting TM Deepsecurity events on my syslog server. The TM manager sends logs to my syslog server on port 514. There are two types of events TM sends. Deep Security Agent & Deep ...
2
votes
2
answers
229
views
How to tell syslog-ng to ignore source files if they are absent
I'm trying to deploy a standard configuration file for syslog-ng on multiple linux servers. My infrastructure includes many services (apache, confluence, ...) with log file located at various places.
...
0
votes
0
answers
27
views
How to get syslogd and/or Apache2 to STOP logging DEBUG messages to console
When I SSH into one of my Linux boxes (Ubuntu 20.04.2), I periodically see messages appear on the console screen:
Message from syslogd@my-hostname at Jan 30 21:35:17 ...
apache2: [MY-APP] DEBUG - 2024-...
0
votes
1
answer
44
views
Microsoft Defender: extract Automatic log upload data
Is there a way to extract this automatic log upload table from defender:
my goal is to use this information to aid in responding to the System alert: Cloud Discovery automatic log upload error alert ...
7
votes
2
answers
9k
views
Where is some os logs in Debian 12
It seems that some of the system log files (/var/log/syslog, /var/log/auth.log, /var/log/kern.log, ...) have been removed in the latest version of Debian, Debian Bookworm. What should be done to ...
0
votes
1
answer
36
views
Sending ESXI audit logs to http endpoint?
Is it possible to send audit logs from ESXI's (or better yet, vCenter) to an http endpoint via API/webhook rather than a syslog server?
Couldnt find a direct answer or a tutorial online.
Thanks!
0
votes
0
answers
61
views
Enable $RepeatedMsgReduction only for specific log file
If this were the script for routing messages to log files in rsyslog.conf, is it possible to activate RepeatedMsgReduction only for app_log?
if ($syslogfacility-text == "auth") then {
...
0
votes
1
answer
186
views
Rsyslog not writing any logs from Cisco network devices - all other remote syslog works fine
tcpdump confirms valid syslog is coming in from multiple remote systems - servers and Cisco network equipment.
OS is Linux RHEL 8.8
The servers all come in fine and write to disk, and are shown as ...
0
votes
0
answers
26
views
syslog diff or comparison that reorders identical lines to ignore race conditions?
Sometimes when debugging intermittent boot problems, it would be advantageous compare two exerpts from syslog: One leading to a working system, and one leading to the symptom. However, diff is not ...
1
vote
1
answer
77
views
Is syslog over udp safe on a local network?
I have a device that doesn't support sending tls syslog traffic, and can only send udp syslog. I'm only sending logs over my local network, but I'm worried the non-tls data can be read by anyone on ...
0
votes
0
answers
1k
views
Issue Getting Rsyslog TLS Configuration Working
Overview
I have a server that receives Syslog data from external clients, and I do not have administrative access to these clients. The goal is to move the existing configuration to data in transit ...
0
votes
0
answers
78
views
Split logging on rsyslogd
My goal is to send all logs to one source remote and still log local but then send all the AuditD logs to its own source on port 20002. But for some reason, my auditd logs are still ending up with my ...
1
vote
1
answer
119
views
Postfix logging incomplete after changing myhostname
My postfix installation does not log most of the messages after changing myhostname. The myhostname is now different from the FQDN (and hostname) of the machine where it used to be the same. After ...
0
votes
1
answer
47
views
Ssh messages do not output to a pipe configured in syslog.conf
I have configured a pipe in syslog.conf for auth.* to capture the ssh syslog error and status messages. I have then a python script that processes this pipe's input and I check that we receive ...
0
votes
0
answers
151
views
Add mac address in rsyslog template
I am trying to add system/device mac address in syslog. No solution is working for me. Following command gives me mac address, just wanted to use in rsyslog template.
mac_addr=$(ifconfig en0 | awk '/...
1
vote
0
answers
253
views
LogStash and parsing OPNSenser logs
My logs are coming in as follows:
<134>May 24 14:39:32 edge.internal filterlog[2535]: 78,,,ffe6d10d1f27a42fc0edc3abb3a6d333,ovpnc1,match,pass,out,4,0x0,,63,61951,0,DF,6,tcp,60,10.8.0.2,20.44.17....
0
votes
0
answers
87
views
Disable Cisco Router syslog messages
I am trying to disable syslog messages from showing in my cisco 1kv tty. The conundrum is terminal monitor has a single command to set the logging level #logging terminal <severity>, and if I ...
0
votes
1
answer
103
views
rSyslog stopped sending only SOME data
I have configured a remote logging from one of my servers to the central log server via rsyslog TCP/SSL
Everything worked fine until yesterday where most of the files just stop being transmitted while ...
0
votes
1
answer
1k
views
Understanding Samba VFS Operations for Full Audit
We have a TrueNAS System running TrueNAS-12.0-U8 for which we are required to log all successful and all failed file access attempts for a specific SMB share. The Samba version is 4.13.
Per guidance ...
1
vote
2
answers
220
views
syslog-ng filter log by frequency to destination file
I have a syslog-ng that receives too many logs and I am trying a way to 'sample' them using some filter.
I assume editing the /etc/syslog-ng/syslog-ng.conf with something like
log { source(s_udp514); ...
0
votes
1
answer
1k
views
Postfix logging to syslog even though it's excluded
Ubuntu 22.04 and postfix 3.6.4
Postfix config is set to use syslog_facility=mail, and I have modified /etc/rsyslog.d/50-default.conf to the following
*.*;mail,auth,authpriv.none -/var/log/syslog
...
0
votes
1
answer
226
views
Syslog-ng enable TCP framing
I'm trying to send file entries as messages via TCP, where syslog-ng is in a container and it is sending to another container. I've had two different attempts both with problematic behavior. The first ...
-1
votes
1
answer
1k
views
splunk syslogs Forwarder set up not working and paused data flow
I have set up the Universal Forwarder locally in my machine using this guide
https://splunk.paloaltonetworks.com/universal-forwarder.html
/opt/splunkforwarder/etc/system/local/inputs.conf
[monitor:///...
0
votes
0
answers
55
views
Unexpected ubuntu server down
I am using an Ubuntu Server 16.04LTS running ISP config that is hosted an VMware ESXi
I experienced an unexpected shutdown issue, and I'm trying to identify the source.
Upon checking the logs, I was ...
0
votes
0
answers
45
views
Crontab I have tried cronitor airplane nothing helps
my crontabs do not run, sys log gives me this, Jan 6 08:30:02 joe-sbc-flt1 CRON[102851]: (joe) CMD (/home/joe/scripts/watchit.sh) I have no idea what it means or what is wrong, can anyone help?
1
vote
0
answers
252
views
How to add to excludes alerts on smartmontool
I faced with problem and hope for your help.
Started getting notifications from smart on Debian 10 server:
Device: /dev/nvme1, Critical Warning (0x04): Reliability
Found that this alert causing ...
0
votes
1
answer
562
views
How do I get Docker to include the host hostname in syslog?
I have configured docker to use the syslog log driver. My daemon.json looks like this:
{
"log-driver": "syslog",
"log-opts": {
"syslog-address": "...
0
votes
1
answer
259
views
define custom fields for systemd-journald
The doc states, it may be possible to define new fields by applications.
What does it mean? Can one define arbitrary fields or are only those possible listed in the doc USER JOURNAL FIELDS?
If ...
0
votes
0
answers
1k
views
php-fpm access log to rsyslog
I am trying to find a solution for getting logs from php72 php-fpm yii2 application behind nginx on several numbers of servers:
at now application writes its logs to files on server disk, yii performs ...
1
vote
1
answer
4k
views
Where does Ubuntu log TCP connections?
When doing some network security checks (on which I am an amateur) for my office PC, I discovered a few unknown tcp6 connections (with netstat -nt):
Active Internet connections (w/o servers)
Proto ...
0
votes
0
answers
913
views
Promtail - syslog configuration only logs localhost for hostname and IP
I have a number of boxes that run docker containers. To keep a record of all the logs, we have 1 instance of logspout on every box that grabs all container logs on that box, and routes it to a syslog-...
0
votes
1
answer
19
views
syslog access beginning of log line
I would like to filter the content of my logs generated by Syslog, I'm applying a filter based on $msg but it is not containing the beggining of the line:
2022-09-29T16:39:39Z SYS_SERVER_2 - - - - - A ...
0
votes
1
answer
1k
views
Combining multiple Property-Based Filters for Rsyslog
I was trying to set up a specific Rsyslog configuration file to catch all incoming kernel messages of a few types. For example, I want to dump all logs containing "example message 1" and &...
1
vote
0
answers
123
views
Postfix - some mails not sent to particular domain and syslog tagging issue
I have a problem with e-mails sent to a particular domain (alice.it).
Usually the mail is corrected sent and in my postfix log I have this:
06104180AF: to=<**********@alice.it>, relay=mx.tim.it[...
0
votes
1
answer
802
views
rsyslog ruleset for encrypted logging
I've setup managed to setup rsyslog to accept TLS traffic from a clients server. When I configured the certificate and the port originally, it all worked fine. The problem is it is dumping the logs ...
1
vote
2
answers
666
views
Why would you want to change the log_msg_size from syslog-ng's default of 64k?
Per the syslog-ng admin guide, the log_msg_size defaults to 64k (65536 bytes)
However, I have seen some sample syslog-ng config files (like this one) that drop this to <18k (18192 bytes)
Why would ...
1
vote
1
answer
135
views
Configuring rsyslog to route messages to different log files based on content
Can rsyslog be configured to route log messages to different log files/locations based on the content of the log message? If so, how and could I see a simple example?
0
votes
1
answer
326
views
Sending rsyslog messages to remote file system
I have an Ubuntu server that will be running rsyslog and many "client" devices and applications sending logs to it (via various syslog clients).
I know that rsyslog logs everything to /var/...
2
votes
1
answer
4k
views
Different postfix logfile format when logging to separate file (maillog_file)
In order to separate the mail logs from the general system logs, I added this line to /etc/postfix/main.cf
maillog_file = /var/log/postfix.log
As expected, a file /var/log/postfix.log is created, and ...
1
vote
1
answer
1k
views
Why some companies like cisco follow different syslog messaging format rather than rfc 3164 (BSD syslog) and rfc 5424 (IETF syslog)?
According to my understanding the popular syslog formats are:
RFC 3124 (BSD syslog):
Format: < priority >timestamp hostname application: message
Example: <133>Feb 25 14:09:07 webserver ...
1
vote
1
answer
3k
views
why is faillog, tallylog and lastlog so big?
I got a notice from a backup system (rsnapshot) today that it's storage volume was full. A closer look reveals some older snapshots where faillog, tallylog and lastlog are bigger than the actual ...
0
votes
1
answer
294
views
does remote logging stops local logging
I'm using a Graylog server to centralize logs from network equipment and servers and I'm wondering if the Syslog service on the switches, windows machines, and other equipment, that service still ...
1
vote
0
answers
93
views
Rsyslog not sending to server when filesystem fails
I have on my servers an rsyslog client, that supposed to send logs to rsyslog server.
Recently there was an issue on one of the servers where the filesystem went into read-only. This caused local logs ...
0
votes
0
answers
1k
views
syslog-ng duplicate log message
Not duplicate of this question because that one uses rsyslog on client whereas I use syslog-ng on both sides.
I have a syslog-ng instance on both the client and the server and for whatever reason the ...
1
vote
0
answers
36
views
What does a series of ^@ in the syslog mean?
Our server did not react to pings anymore since around 23:49 yesterday until we restarted it at 7:09 am today. These are the last things we saw in the syslog:
The machine runs on Ubuntu 20.04 with ...
0
votes
1
answer
4k
views
syslog-ng: how to configure sending RFC5424 messages with octet-counting framing
Please don't bother reading this question. syslog-ng is already set up to send RFC5424 messages with octet-counting framing by default. I was confused by the behaviour of another component. This ...
0
votes
2
answers
533
views
systemd, journal receiving raw log
one common paradigm on all other syslog implementations (rsyslog, syslog-ng, readlog, etc) is to exchange log entries via UDP514 in plain text format.
How do I enable systemd-journal-remote to receive ...
2
votes
1
answer
565
views
Can i prevent a non-root user using logger to make fake entries (e.g. sshd) in the syslog?
i just played with logger an non-root user, but it looks like everyone is able to create fake entries in the syslog using the "-t" parameter.
Is this expected to work this way?
I could flood ...
1
vote
0
answers
53
views
Relate session and NAT logs in near real-time [closed]
I have a user activity logger and querying system for an ISP with very high log events rate (5k-10K /second). It needs to relate both Radius/Session and NAT Syslogs based on a common InternalIP field. ...
0
votes
1
answer
547
views
Graylog fails to parse nginx access_log: JsonParseException: Unexpected character ('<' (code 60))
I've followed https://github.com/ronlut/graylog-content-pack-nginx-docker and Send NGINX logs to Graylog to try to get nginx logs into a graylog 4.1.5 server. Graylog is not displaying messages ...