syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

0
votes
0answers
8 views

Forward to remote syslog in CoreOS

I want to aggregate CoreOS logs to Papertrail service, which basically provides a syslog endpoint for aggregate logging. Common advice for this setup seems to be starting a service that does ...
1
vote
0answers
14 views

Ubuntu 14.04 syslog showing @@@@ for long time period

My Ubuntu Server wasn't accessible for a long time, only after restarting the server I could access it again. I have checked the syslog file which shows something like @@@@@@@@@@@@@ from last night ...
1
vote
0answers
19 views

Nginx log to syslog on TCP port

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do: error_log syslog:server=192.168.1.1; However I need to ...
-1
votes
1answer
29 views

Which Nginx log file is for fail2ban?

I have files in /var/log/nginx/ the log file /var/log/nginx/access.log is empty. But the /var/log/nginx/access.log.1 is being appended as always. In file /etc/fail2ban/fail2ban.conf, logtarget = ...
1
vote
0answers
18 views

syslog spammed with authdaemond: pam_ecryptfs: pam_sm_authenticate: /home/user is already mounted

I setup my new server with harddisk-encryption and now I noticed that /var/log/syslog is full of the following lines: server authdaemond: pam_ecryptfs: pam_sm_authenticate: /home/user is already ...
3
votes
0answers
30 views

When configuring rsyslog to log to mysql DB, what is purpose of SystemEventsProperties table?

I've configured rsyslog on my servers to log to a remote mysql DB. I did this essentially by following the rsyslog wiki and it essentially creates two tables: mysql> show tables; ...
1
vote
0answers
37 views

Postfix logs to remote log host

On my Ubuntu 14.04 server, I'm using Postfix as a front-end mailserver, and I would like to send all mail related info, including email addresses, to a remote host. In the file ...
0
votes
1answer
21 views

Reading syslog-ng logs being sent to a remote server

I have a Docker container which is sending syslog logs to logentries.com. This is working fine, but for times when logentries is down or delayed, I want a way to read logs generated in realtime inside ...
1
vote
0answers
14 views

rsyslog parsing logs with liblognorm

I'm trying to use such .rb file to parse logs: version=2 ...
0
votes
0answers
11 views

rsyslog 8.17 char changing

My rsyslog configuration do not want to work properly Here is my example log: Mar 10 10:57:35 servername log_tag ...
1
vote
1answer
44 views

HaProxy suddenly crashing on new Ubuntu Images (same config works elsewhere)

I have been using HAProxy for about two years with the same working configuration. I've installed HaProxy multiple times over the last week on Ubuntu 14.04, 15.10 and I am getting out of Memory ...
0
votes
1answer
64 views

/var/log/syslog is empty. Service rsyslog is running, but not installed

Problem Periodically I encounter the problem that /var/log/syslog is empty. $ ls /var/log/syslog -rw-r----- 1 root adm 0 Dez 31 06:29 /var/log/syslog Environment and Installed packages I am using ...
0
votes
0answers
23 views

Log file bloat due to nouveau

Both my kern.log and syslog files have grown to >50Gb and contain a few hundred million lines of: Feb 23 23:32:43 Yawning-Angel kernel: [396111.179453] nouveau E[ PFIFO][0000:05:00.0] PBDMA0: ch 2 ...
0
votes
1answer
51 views

Referencing journald fields when forwarding messages to syslog-ng

How can I change my syslog-ng template so that when the log originates from a systemd service / unit, the log message will include the unit's name? Using ${PROGRAM} just shows the name of the ...
0
votes
1answer
23 views

Open relay or some other issue?

I am running a dovecot/postfix server with virtual users/aliases. According to tools such as http://www.mailradar.com/openrelay/ I do not have any open relays. However, I am getting a lot of records ...
1
vote
1answer
57 views

How to read sar file from different ubuntu system

I am using two different version on ubuntu one is 14.04 and other is 15.10. I want to read 14.04 systems sar files from ubuntu 15.10 system. I have transferred the sar files but can't read it.
4
votes
1answer
79 views

How can I reduce the verbosity of certain Ansible tasks to not leak passwords into syslog?

Sometimes I would like to use Ansible's lineinfile or blockinfile modules to write a password into some configuration file. If I do so, the whole line or block, password included, ends up in my ...
0
votes
0answers
18 views

How to get rid of unexpected nslcd related messages caused by resolvconf?

I'm on a Ubuntu 12.04 based system. Our system is setup to use nslcd to allow LDAP authentication. In syslog we see lines like this: /var/log/syslog.1:Dec 20 06:25:11 T53-1014-014 nslcd[1496]: ...
0
votes
1answer
54 views

How to make svlogd send logs via UDP

I am currently using runit + svlogd for supervising some applications, but when deploying to multiple machines, I have the need to centralize/unify the logs in a single place in order to simplify ...
0
votes
1answer
171 views

Nginx reverse proxy to server with login not working as expected

I have two servers behind an nginx reverse proxy. I am being forwarded correctly to the sites, but one of the sites has a login before it allows you into the site (similar to sharepoint), and the ...
0
votes
1answer
36 views

logrotate frequency - when and from when

if have lograte in my daily cron /etc/cron.daily/logrotate -- assume cron.daily is run at 1.05am daily and if my logrotate config has a weekly settings Does it means that my logrotate will ...
0
votes
1answer
27 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
1
vote
1answer
40 views

Cisco ASA logging buffered spams terminal and console lines

I have several routers, switches and firewalls that send logs to a syslog server without interfering with the console line. I'm testing an ASA 5506 (running IOS 9.5.2) at a remote location that ...
2
votes
1answer
67 views

What process is causing unexpected nslcd syslog entries?

We're using LDAP for authenticating users our devices using nslcd and we're seeing messages in syslog like this: /var/log/syslog.1:Dec 20 06:25:11 T53-1014-014 nslcd[1496]: [398c89] ...
0
votes
0answers
26 views

How to forward logs and offenses from solarwinds to another server

There are several solarwinds servers in my Network. I want to aggregate some important logs and status from all of these different servers in a third party log server. I'v just searched but I didn't ...
0
votes
0answers
20 views

rsyslog not filtering message field

Trying to remove ALL cron log stuff from auth/syslog but I cannot get it. Here is a snippet of my rsyslog. Not sure how to get this to format right, it keeps wanting to mess with my paste. But here ...
0
votes
1answer
121 views

systemd: Failed to make us a subreaper: Invalid argument. SSH

Since upgrading to Debian 8 (Jessie) which brought in systemd I'm getting the title of this post in my syslog errors. Remote ssh login begins 10:33:51 pap1 systemd[1]: Starting user-0.slice. ...
0
votes
1answer
53 views

Change message content in a syslog server

I am looking to log some troubleshooting info from a DataPower Appliance into a syslog. Although it is already logging, I have a third party solution that requires some modification to the messages, ...
2
votes
0answers
121 views

How does one separate log data sent to a remote rsyslog server?

I have messages from multiple apache2 web servers logging to a rsyslog server. I've used a template to separate each /var/log/syslog file into its own folder based off of the ip address of the server ...
1
vote
1answer
43 views

logrotate - run the postrotate after all processing

I have a logrotate script that is structured to rotate logs collected by syslog. Part of that script is to reload the syslog process. The problem is that the syslog reload runs for each matching log ...
0
votes
0answers
16 views

How can I select an output device for video from headless server?

I have a syslog server, and I call it headless, but it actually does have two monitors attached to it via an internal video card. I never actually use the monitors since I'm just ssh'd in, and the ...
0
votes
1answer
103 views

How can I make rsyslog send the logfiles to a location outside of /var/log?

I have a central syslog server (ubuntu 14.04 server), that I've set up to take in logs from many servers. This server has a storage hard drive that is very large, mounted at /home/username/logs I'd ...
1
vote
0answers
35 views

Strange messages in my syslog on Debian

I am getting strange messages on my /var/log/syslog that aren't usual. I am running a Debian Jessie LXC Container inside of a Debian Wheezy machine. But I believe this is not the problem. An example ...
0
votes
0answers
37 views

Systemd - do not log output from particular service, but forward to syslog

Is it possible for systemd to not log data from particular service, but to still forward it to the syslog? StandardOutput=syslog StandardError=syslog
0
votes
0answers
27 views

Journald: give users access to specific unit's logs

I'm taking care of a server (Debian Jessie) that several developers use for deploying and managing their work. Now there is a script on this server (managed by one of the developers) that does some ...
0
votes
1answer
47 views

Send all logs of a system to one specific syslog local facility (local1-7) [closed]

I want to assign the syslog local facilities to specific OS, so I can sort the incoming logs on the logserver (e.g. local1 for Windows logs, local2 for RedHat logs, etc). It worked perfectly on ...
2
votes
1answer
33 views

Is there a way to write application logs like Tomcat and PostgreSQL to Tenable Log Correlation Engine?

My IT group uses Tenable's Log Correlation Engine and we have our Linux servers writing syslog to LCE. Is there a way to write our Tomcat and PostgreSQL application logs to LCE?
0
votes
0answers
41 views

Elasticsearch shuts down with no reason

We're running Elasticsearch 1.7.2 on ubuntu 14.04, the system has enough memory and other services on the server work just fine. But sometimes elastic shutsdown without any thing logged to it's log, ...
-1
votes
1answer
59 views

IPtables log only some drop connections

I have these rules: -A INPUT -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7 -A INPUT -j DROP But this logs every DROP that occurs like IPTables Packet Dropped: ...
0
votes
0answers
11 views

Syslog not capturing from one vendor

We've had a syslogd server running on a FBSD box for years (now at 10.2). It captures remote logs sent across the LAN from a SonicWALL and some HP ProCurve switches. We just switched to a Meraki ...
8
votes
1answer
471 views

ELK Stack (Logstash, Elasticsearch and Kibana) with concurrent remote syslog server?

I'm building a log analyser service to start monitoring mainly our pfSense Firewalls, XenServer Hypervisors, FreeBSD/Linux servers and Windows servers. There's a lot of documentation on the internet ...
0
votes
2answers
97 views

syslog-ng “log_msg_size” maximum possible value

I read from syslog-ng doc and forums that log_msg_size to defaults to 8192. What is the possible maximum limit of this parameter? My application supports either syslog-ng or rsyslog depending upon ...
0
votes
1answer
254 views

Why can't the logstash syslog_pri filter see the priority in syslog messages

I'm running LS 2.0.0, and I've noticed an issue where the syslog_pri filter doesn't detect the priority at the start of my syslogs. My filter config is as follows: filter { if [type] == "relp" { ...
1
vote
0answers
50 views

How to modify the message string being logged by syslog?

I have a few linux systems with the keyboard and console shared via a KVM switch. When I switch between them, I get a lot of unwanted syslog messages regarding the keyboard connecting and ...
1
vote
0answers
29 views

Let Lemp and Lamp stack send Access/Error log to Graylog2

I have two servers running, one with Apache and one with Nginx (Both Ubuntu based) they are allreading sending syslogs to my graylog2 node but i want Nginx to provide me with the Access log and and ...
1
vote
0answers
152 views

rsyslog filter on authpriv facility in rsyslog.conf

This has been addressed in other post(s), but I still can't get this to work properly. I am trying to OMIT (discard) certain entries from being written to my " /var/log/secure ". Namely, any line ...
0
votes
1answer
27 views

syslog clipping for particular applications

I have a few particular applications that are causing a LOT of logs in my syslog server. I would like to keep all of their logging in /var/log/messages or somewhere on the server, but I am trying to ...
1
vote
1answer
97 views

How to format log data before forwarding them as JSON to elasticsearch?

I log all events on a system to a JSON file via syslog-ng: destination d_json { file("/var/log/all_syslog_in_json.log" perm(0666) template("{\"@timestamp\": \"$ISODATE\", \"facility\": \"$FACILITY\", ...
1
vote
0answers
57 views

audisp-remote signal USR1 works as root, not with sudo

So I have a weird problem that I'm running out of ideas to troubleshoot. My RedHat machines are using audisp-remote to send syslog messages to a central server. audisp-remote will respond to the ...
0
votes
0answers
208 views

Getting journald logs to a plain text file

I want to log journald logs to a file so I can later on fetch it and send it to Logstash. I thought about running syslog-ng and make it a client of journald, so I'd get syslog files. I'm using Docker ...