syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

0
votes
0answers
16 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
1
vote
2answers
30 views

Rsyslog filter by client

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side. I added this line ...
0
votes
0answers
19 views

EventLog/Syslog to Common Event Format

I am looking for a way to get EventLog/Syslog to Common Event Format (CEF)? And also looking for a way to forward the CEF events through a Syslog-ng type of forwarder within the environment. I have ...
1
vote
1answer
28 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
2
votes
2answers
43 views

How to log remotely without syslog

I have a bunch of logs which are not created using syslog. I would like to export them to another host. If possible using syslog or rsyslog. A pipe? how can I do that?
0
votes
2answers
36 views

Not getting anything written to my log files in ubuntu

I am not getting any logs in auth.log, kern.log, syslog or any other log files on my 12.04 ubuntu server. There is also no rsyslog.conf if it should be there by default. rsyslogd is not running as ...
0
votes
1answer
38 views

Converting to rsyslog v7 new config format

I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy ...
0
votes
1answer
29 views

Syslog and LogAnalyzer - how to retrive source IPs and count them

I have set centralized Syslog (centOS + rsys) server which runs LogAnalyzer for better log presentation. Recently I have got asked to provide logs from the firewall of all IPs for particular firewall ...
1
vote
1answer
66 views

Logcheck alternative for central syslog server [closed]

I have to setup some open source log monitoring on a centralized syslog server. A lot of machines (windows, linux) and some routers and switches sending their logs there. Many years ago when I had to ...
1
vote
1answer
47 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
3
votes
1answer
62 views

Wheezy processes die periodically

I have a very weird problem. Certain processes on my mail server, but not all, die periodically (every second month or so). A few of the process that die are: ssh dovecot postfix Processes that ...
0
votes
2answers
78 views

max open files - why is there no error?

I suspect that one of our server applications has hit its max open file limit. The application is running in user-space with its own account. The init-script starts a large number of processes which ...
1
vote
1answer
78 views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
2
votes
0answers
55 views

Cannot find upstart logs in syslog despite a log-priority of debug (ubuntu 13.04 & mint 16)

I've set upstart log level to "debug" sudo initctl log-priority debug But I still cannot see anything in /var/log/syslog. sudo initctl emit hello # no log sudo initctl start my-broken-service # ...
1
vote
1answer
46 views

Logging in iptables

I have created rules in iptables to log and edited the rsyslog.conf file to output any message which contains "iptables" to a different log file. It seems that it is logging to both places, the ...
0
votes
1answer
33 views

Apache2 forward logs to rsyslog AND locally

Right now I'm storing apache2 logs locally: ErrorLog /var/log/apache2/one.error.log CustomLog /var/log/apache2/one.access.log common How can I keep storing the logs locally but also forward ...
0
votes
0answers
14 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
0
votes
2answers
58 views

Find syslog priortiy/ severity of a message

Is there a way to find the syslog priority or severity of log entries using a standard unix tool? For example I could grep for the word error in a log. But not all logs will state the word "error" ...
0
votes
1answer
31 views

same filter works in rsyslog but not syslog

I have the following filters in new cpanel server with rsyslog to forward log to a central log server(use rsyslog), but these filters didn't work in older cpanel server with syslog. I don't see any ...
0
votes
0answers
11 views

How to change the default template in syslog-ng

Is it possible to change the default template for all destinations in syslog-ng? I know that I can declare a template: template t_tmpl { template("$ISODATE $MSGHDR$MSG\n"); }; and then reference ...
0
votes
0answers
14 views

snort is not alerting to a web console

I am configuring snort in OSSIM, modified the snort.debian.conf and when I check the status it gives OK. But it is not logging as I have checked the file. How can I get the alerts logged and on the ...
1
vote
0answers
65 views

How do you use patterndb variables in syslog-ng?

I'd like to parse some custom (network appliance) syslog files to create my own formatted output. As I am new to syslog-ng & patterndb I have been trying to build an example using the ...
1
vote
0answers
67 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
0
votes
2answers
199 views

Cisco ASA syslog format description [closed]

Where can I find Cisco ASA syslog format description? Log example: Dec 11 08:01:24 <IP> %ASA-6-302015: Built outbound UDP connection 447235 for outside:NTP_Server_2/<port> ...
0
votes
2answers
98 views

Logging ssh info using syslog-ng daemon in Cygwin

I have setup the syslog-ng daemon using Cygwin in Windows 7. What I want to do is to log all of the ssh failed passwords, etc to /var/log/sshd.log. I tried to do this by adding the following line: ...
2
votes
0answers
51 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages ...
1
vote
2answers
111 views

Log ssh sessions to rsyslog

How can I setup rsyslog to log commands typed in a ssh session? Just in case someone unauthorized ever accesses the system, I'd like to know what he did.
1
vote
1answer
64 views

Pipe program output to rsyslog

I have a process running that writes it's output to a file, like this. processx > /var/log/processx.log 2>&1 How would I write/pipe/forward this to rsyslog instead (including the ...
2
votes
1answer
52 views

cisco ios - syslog version

I am writing small article on Syslog and I was wondering, if there is any resource that tells me what version of Syslog is supported in what ios version? By Syslog version I mean rfc 3164/rfc ...
0
votes
0answers
37 views

Not seeing kernel messages in syslog

I'm trying to track down a process that kills my mysql server on my CentOS box. I have the following setting in /etc/syslog.conf: *.*;mail.none;authpriv.none;cron.none /var/log/messages I ...
0
votes
1answer
23 views

syslog, kernel.warning and iptables innerworking

Im tinkering with my iptables logging at the moment. So I got my syslog to use another log file with tips from the web. basically you end up changing some chains and rules plus aan extra line in the ...
0
votes
1answer
139 views

Syslog info from vmware hosts to graylog are not collecting correctly

I have a graylog syslog server running on debian, running fine. I wanted to send syslogs from our Vmware ESX hosts to Graylog. I point a ESX host to the syslog by doing the following: I open vSphere ...
0
votes
1answer
118 views

Wireshark - Capture syslog traffic form local workstation

I am using wireshark version 1.10.3 on windows 7 x64 enterprise. I am trying to capture all outbound UDP traffic, in particular syslog traffic. I have tried a capture filter UDP, but all I can see ...
0
votes
1answer
79 views

Syslog-ng how to get domain names instead of IP address

How can syslog-ng get the domain names instead of IP address that I received? I'm able to get those information but in IP address, I would like to get the DST/HOST to domain names instead of getting ...
3
votes
2answers
207 views

How does an administrator generalize alerting when an event doesn't happen?

Often my users require me to be just as responsible for knowing if an event hasn't happened. I've always had to build custom and brittle solutions with cron'ed shell scripts and lots of date edge ...
0
votes
0answers
28 views

Launchd script's output not being logged to system.log

Sample script: #!/bin/bash echo "Hello?" ... (other things) When run via launchd, it definitely runs (the other things are being done) but nothing shows up in /var/log/system.log. I'm running OS ...
0
votes
1answer
291 views

Send Apache Access Logs to syslog

We have IBM HTTP Servers (Based on Apache 2.0) and want to send the access logs to syslog. (in addition to error logs which does work) The config we are using is as follows: ErrorLog ...
3
votes
2answers
266 views

Properly Configured Rsyslog on CentOS

I'm trying to configure Rsyslog 5.8.10 on CentOS 6.4 to send Apache's error and access logs to a remote server. It's working, but I have a couple questions. A) I would like to use as few queues (and ...
2
votes
5answers
623 views

Linux: how to send new lines in log files to remote syslog?

We have several applications which are generating their own plain-text log files, which I would like to forward to a remote syslog server for centralized logging. I do not have access to root on ...
0
votes
0answers
37 views

software to view logs on remote server [closed]

I have configured syslog server on my linux machine like this Linux Machine (syslog client) -- > Linux Machine (syslog server) I have configured it and its working properly. Now, the problem is I ...
1
vote
1answer
152 views

Getting logs from remote clients via rsyslog

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp ...
3
votes
1answer
342 views

No more logging after upgrade to Debian Wheezy

Syslog, auth.log, kern.log and messages log files are not updated anymore after upgrading to Debian Wheezy (Debian Squeeze was previously running). How could I fix it?
2
votes
2answers
121 views

Load Balancing UDP traffic transparently

Are there any products (preferably open source) that can load balance UDP packets transparently? We need to scale our syslog servers and require the original source IP be kept intact. Alternatively ...
1
vote
1answer
241 views

Configuring JBoss AS 7.2 to log to syslog

In my standalone.xml, I have the syslog-handler configured like so: <syslog-handler name="SYSLOG" enabled="true"> <level name="INFO"/> <hostname value="i-XXXXXXX"/> ...
2
votes
2answers
86 views

Send logs to mulitple syslog servers

we have a cisco 6500 chasis and I would like to send to the logs to two separate syslog servers. At present, it is already sent to one syslog server. That goes to our security team. But we would like ...
0
votes
1answer
101 views

NTP synchronisation not visible in syslog

I am trying to set up a local NTP server for our LAN. I am able run ntpdate server_ip to manually update the time. However, ntp daemon does not seem to be logging anything into syslog, and so I can't ...
2
votes
1answer
241 views

Failing forwarding rsyslog

I have a centralised rsyslog server A that receives a bunch of logs through TCP from servers X, Y, Z. It then stores the files on disk but also forwards them to logstash server B (on a different ...
1
vote
1answer
201 views

cPanel and forwarding logs to the remote syslog server

I have fully working remote syslog server which receiving logs from servers and devices. I have try to setup cPanel/WHM syslog to forward logs to that remote server but so far I'm not seeing anything ...
2
votes
1answer
68 views

Disable syslog remote connections

I'm securing a server and closing all the ports that are not used, but i can't close the syslogd port, even worse I cannot find where the syslogd is called. This is what sockstat shows me: USER ...
1
vote
1answer
169 views

Strange syslog for my server

Today i go on my log with nano /var/log/syslog I have this, and i think it's not very good : Aug 27 06:25:02 ks3309528 rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="2235" ...