syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

0
votes
0answers
8 views

How to get rid of unexpected nslcd related messages caused by resolvconf?

I'm on a Ubuntu 12.04 based system. Our system is setup to use nslcd to allow LDAP authentication. In syslog we see lines like this: /var/log/syslog.1:Dec 20 06:25:11 T53-1014-014 nslcd[1496]: ...
0
votes
0answers
37 views

What caused the reboot of this linux VM?

So here is the code of a normal reboot of my vm: Feb 5 00:17:46 desktopallianceada systemd[1]: Stopping Disk Manager... Feb 5 00:17:46 desktopallianceada systemd[1]: Stopping Session c10 of user ...
0
votes
0answers
16 views

How to make svlogd send logs via UDP

I am currently using runit + svlogd for supervising some applications, but when deploying to multiple machines, I have the need to centralize/unify the logs in a single place in order to simplify ...
0
votes
1answer
49 views

Nginx reverse proxy to server with login not working as expected

I have two servers behind an nginx reverse proxy. I am being forwarded correctly to the sites, but one of the sites has a login before it allows you into the site (similar to sharepoint), and the ...
0
votes
1answer
24 views

logrotate frequency - when and from when

if have lograte in my daily cron /etc/cron.daily/logrotate -- assume cron.daily is run at 1.05am daily and if my logrotate config has a weekly settings Does it means that my logrotate will ...
0
votes
1answer
18 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
0
votes
1answer
17 views

Cisco ASA logging buffered spams terminal and console lines

I have several routers, switches and firewalls that send logs to a syslog server without interfering with the console line. I'm testing an ASA 5506 (running IOS 9.5.2) at a remote location that ...
2
votes
1answer
30 views

What process is causing unexpected nslcd syslog entries?

We're using LDAP for authenticating users our devices using nslcd and we're seeing messages in syslog like this: /var/log/syslog.1:Dec 20 06:25:11 T53-1014-014 nslcd[1496]: [398c89] ...
0
votes
0answers
22 views

How to forward logs and offenses from solarwinds to another server

There are several solarwinds servers in my Network. I want to aggregate some important logs and status from all of these different servers in a third party log server. I'v just searched but I didn't ...
0
votes
0answers
16 views

rsyslog not filtering message field

Trying to remove ALL cron log stuff from auth/syslog but I cannot get it. Here is a snippet of my rsyslog. Not sure how to get this to format right, it keeps wanting to mess with my paste. But here ...
0
votes
1answer
44 views

systemd: Failed to make us a subreaper: Invalid argument. SSH

Since upgrading to Debian 8 (Jessie) which brought in systemd I'm getting the title of this post in my syslog errors. Remote ssh login begins 10:33:51 pap1 systemd[1]: Starting user-0.slice. ...
0
votes
1answer
29 views

Change message content in a syslog server

I am looking to log some troubleshooting info from a DataPower Appliance into a syslog. Although it is already logging, I have a third party solution that requires some modification to the messages, ...
2
votes
0answers
42 views

How does one separate log data sent to a remote rsyslog server?

I have messages from multiple apache2 web servers logging to a rsyslog server. I've used a template to separate each /var/log/syslog file into its own folder based off of the ip address of the server ...
1
vote
1answer
26 views

logrotate - run the postrotate after all processing

I have a logrotate script that is structured to rotate logs collected by syslog. Part of that script is to reload the syslog process. The problem is that the syslog reload runs for each matching log ...
0
votes
0answers
10 views

How can I select an output device for video from headless server?

I have a syslog server, and I call it headless, but it actually does have two monitors attached to it via an internal video card. I never actually use the monitors since I'm just ssh'd in, and the ...
0
votes
1answer
44 views

How can I make rsyslog send the logfiles to a location outside of /var/log?

I have a central syslog server (ubuntu 14.04 server), that I've set up to take in logs from many servers. This server has a storage hard drive that is very large, mounted at /home/username/logs I'd ...
1
vote
0answers
30 views

Strange messages in my syslog on Debian

I am getting strange messages on my /var/log/syslog that aren't usual. I am running a Debian Jessie LXC Container inside of a Debian Wheezy machine. But I believe this is not the problem. An example ...
0
votes
0answers
16 views

Systemd - do not log output from particular service, but forward to syslog

Is it possible for systemd to not log data from particular service, but to still forward it to the syslog? StandardOutput=syslog StandardError=syslog
0
votes
0answers
18 views

Journald: give users access to specific unit's logs

I'm taking care of a server (Debian Jessie) that several developers use for deploying and managing their work. Now there is a script on this server (managed by one of the developers) that does some ...
0
votes
1answer
34 views

Send all logs of a system to one specific syslog local facility (local1-7) [closed]

I want to assign the syslog local facilities to specific OS, so I can sort the incoming logs on the logserver (e.g. local1 for Windows logs, local2 for RedHat logs, etc). It worked perfectly on ...
2
votes
1answer
27 views

Is there a way to write application logs like Tomcat and PostgreSQL to Tenable Log Correlation Engine?

My IT group uses Tenable's Log Correlation Engine and we have our Linux servers writing syslog to LCE. Is there a way to write our Tomcat and PostgreSQL application logs to LCE?
0
votes
0answers
28 views

Elasticsearch shuts down with no reason

We're running Elasticsearch 1.7.2 on ubuntu 14.04, the system has enough memory and other services on the server work just fine. But sometimes elastic shutsdown without any thing logged to it's log, ...
-1
votes
1answer
28 views

IPtables log only some drop connections

I have these rules: -A INPUT -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7 -A INPUT -j DROP But this logs every DROP that occurs like IPTables Packet Dropped: ...
0
votes
0answers
11 views

Syslog not capturing from one vendor

We've had a syslogd server running on a FBSD box for years (now at 10.2). It captures remote logs sent across the LAN from a SonicWALL and some HP ProCurve switches. We just switched to a Meraki ...
8
votes
1answer
296 views

ELK Stack (Logstash, Elasticsearch and Kibana) with concurrent remote syslog server?

I'm building a log analyser service to start monitoring mainly our pfSense Firewalls, XenServer Hypervisors, FreeBSD/Linux servers and Windows servers. There's a lot of documentation on the internet ...
0
votes
2answers
45 views

syslog-ng “log_msg_size” maximum possible value

I read from syslog-ng doc and forums that log_msg_size to defaults to 8192. What is the possible maximum limit of this parameter? My application supports either syslog-ng or rsyslog depending upon ...
0
votes
1answer
99 views

Why can't the logstash syslog_pri filter see the priority in syslog messages

I'm running LS 2.0.0, and I've noticed an issue where the syslog_pri filter doesn't detect the priority at the start of my syslogs. My filter config is as follows: filter { if [type] == "relp" { ...
1
vote
0answers
45 views

How to modify the message string being logged by syslog?

I have a few linux systems with the keyboard and console shared via a KVM switch. When I switch between them, I get a lot of unwanted syslog messages regarding the keyboard connecting and ...
1
vote
0answers
22 views

Let Lemp and Lamp stack send Access/Error log to Graylog2

I have two servers running, one with Apache and one with Nginx (Both Ubuntu based) they are allreading sending syslogs to my graylog2 node but i want Nginx to provide me with the Access log and and ...
1
vote
0answers
80 views

rsyslog filter on authpriv facility in rsyslog.conf

This has been addressed in other post(s), but I still can't get this to work properly. I am trying to OMIT (discard) certain entries from being written to my " /var/log/secure ". Namely, any line ...
0
votes
1answer
20 views

syslog clipping for particular applications

I have a few particular applications that are causing a LOT of logs in my syslog server. I would like to keep all of their logging in /var/log/messages or somewhere on the server, but I am trying to ...
1
vote
1answer
62 views

How to format log data before forwarding them as JSON to elasticsearch?

I log all events on a system to a JSON file via syslog-ng: destination d_json { file("/var/log/all_syslog_in_json.log" perm(0666) template("{\"@timestamp\": \"$ISODATE\", \"facility\": \"$FACILITY\", ...
1
vote
0answers
46 views

audisp-remote signal USR1 works as root, not with sudo

So I have a weird problem that I'm running out of ideas to troubleshoot. My RedHat machines are using audisp-remote to send syslog messages to a central server. audisp-remote will respond to the ...
0
votes
0answers
85 views

Getting journald logs to a plain text file

I want to log journald logs to a file so I can later on fetch it and send it to Logstash. I thought about running syslog-ng and make it a client of journald, so I'd get syslog files. I'm using Docker ...
0
votes
1answer
88 views

Postfix logs nowhere to be found in Ubuntu 14.04.3 LTS

I have not changed any configuration in any of the tools, specially not in: syslog rsyslog postfix systemd (If any apply) In my /var/log there is no /var/log/mail.log, /var/log/postfix.log or ...
0
votes
2answers
24 views

How can I forward old access logs to a new syslog destination (redhat)?

I just setup a syslog forwarder but how do I forward older historical logs (like access_log)? Is it possible to replay log files so they'll send historical entries?
1
vote
0answers
110 views

How can I separate logs with rsyslog from a remote location for devices using the same IP?

I have a number of Yealink SIP phones at different locations that I am trying to centralize log collection for. I have set up a CentOS server at my main location with rsyslog. I am forwarding all ...
1
vote
0answers
28 views

Easily create a logcheck rule from a log message?

I’d like to more easily create logcheck rules from log messages. Ideally I’d like to have something set up such that I just take a logcheck message I receive, and pipe it to some tool, and it spits ...
1
vote
1answer
96 views

Squid cannot send UDP messages to syslog server

I'm migrating my old Squid (2.7 in Debian 7.8 to 3.1 in CentOS 6.6) I need to send logs to a syslog server located into another machine I added the following config to the new server logformat ...
0
votes
0answers
141 views

Cisco ASA 302014 syslog explaination

Can someone please explain the format of cisco asa syslog 302014 and more specifically the difference between idfw_user and AAA user? The message format is shown below: Error Message %ASA-6-302014: ...
0
votes
0answers
37 views

Rsyslog 8.12 doesn't like my TLS config

Rsyslog 8.11 -> 8.12 update stopped logging, but only when using TLS. I send to one destination without TLS (destination A) and to another with TLS (destination B). Destination A kept on working ...
0
votes
1answer
81 views

Use syslog service to capture data logged to a file not managed by syslog?

Some services (nginx, buildbot, et cetera) only support logging to a file. Is there a way to reliably capture these log messages using syslog and friends, so that the log message can be reflected in ...
-1
votes
0answers
16 views

Stop crontab from filling syslog Ubuntu 15.04 [duplicate]

How can I prevent (certain cronjobs) from filling my syslog in Ubuntu 15.04? I have some jobs that run 4 times a minute and quickly fill up my syslog files. I've tried adding: cron.* ...
1
vote
2answers
193 views

Stop crontab from filling syslog Ubuntu 15.04

How can I prevent (certain cronjobs) from filling my syslog in Ubuntu 15.04? I have some jobs that run 4 times a minute and quickly fill up my syslog files. I've tried adding: cron.* ...
0
votes
1answer
54 views

log every command on linux server

I have a snoopy logger on my linux server. It works perfect, but when I use midnight commander I dont see commands that I made there. In logs only 'mc' and no functional keys. So is there any way to ...
0
votes
2answers
112 views

How can I redirect logfile output to a network socket?

I am using a commercial Java app which writes it's logfiles using log4j. I'd like to get those logfile entries into Syslog where we have specific filters setup to trigger on system events. Log4j ...
0
votes
1answer
166 views

Use nxlog to parse a sophos text file and send to a syslog server

I have a windows server 2012 r2 machine with sophos. Each day there is a scan from sophos and the information is appended to the log "sav.txt". Output example (Some info changed): 20150710 ...
0
votes
1answer
111 views

Syslog logging to syslog.1 not syslog

My syslog file is getting a bit unmanageable. I believed I had configured this previously to rotate daily but obviously something has gone amiss. At the moment, my /var/log looks like this: ...
0
votes
1answer
87 views

Send user level messages to syslog

I currently have syslog.conf like so to send INFO logs to /var/log/messages *.info;mail.none;authpriv.none; /var/log/messages; I have an application that uses python libraries LOG_USER facility to ...
0
votes
1answer
97 views

Logging when cisco switch restarts, shuts down, or starts up

Is it possible to log events like restart,shutdown and start in cisco catalyst 3750. Also need to log when a new user is created. I'm forwarding the logs from the cisco switch to the syslog server and ...