syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

0
votes
0answers
14 views

How to send rsyslog to graylog?

Hi I have just configured GrayLog Now I want to transport my Linux-Client log to GrayLog. How can I do that? I tried with allowing TCP:514 in /etc/rsyslog.conf and on the client I have added this ...
-1
votes
1answer
32 views

How to forward a specific log file in a syslog config?

I just want to ask how can I log for example /var/log/test/test.log to a remote syslog-ng? Im using syslog not rsyslog. I can do it in rsyslog but not in syslog.
0
votes
1answer
31 views

Redirecting syslog facility to other facility

I have a syslog server, which separates logging informations according to hostnames. It can separate messages if it's in the 'local1' facility. I have a mail server, which sends messages to the ...
1
vote
2answers
23 views

How can I send ALL cron output to syslog rather than email

I am running cron with -m off to stop it sending email and then the -s option is supposed to send all output to syslog. Cron cmdline is crond -s -m off My cron job for testing this is * * * * ...
0
votes
0answers
12 views

Where does “vmunix” label in syslog come from on Debian/Linux systems?

After upgrading one Debian server from Squeeze I noticed that the kernel log messages (those using kern.* in /etc/syslogd.conf) now appear with "vmunix" prefix while earlier they had "kernel" prefix. ...
0
votes
0answers
21 views

Network syslog with port number

I am collecting syslog from VoIP phones over the network and it is usual having several phones behind same NAT device. I need to collect syslog files to different files or be able to differ lines ...
0
votes
1answer
29 views

Client rsyslog and server in the same machine Ubuntu 14.04

I am wondering if I can make Rsyslog to receive logs from my own IP, I just want to test that the configurations work, right now I dont have access to another PC or Server, just my PC, in few words I ...
1
vote
1answer
53 views

What rsync options to use for the below mentioned scenario?

Greetings !!! This is regarding a specific requirement about rsync that we are trying to achieve. We have tried to achieve this by using various rsync options. However, we are encountering different ...
0
votes
0answers
26 views

PowerConnect 2808 and syslog

I have a pair of Dell PowerConnect 2808 managed switches. I am attempting to enable syslog on them, but not having any luck. I have searched the web interface, used telnet to log into the CLI ...
0
votes
3answers
450 views

What is the difference between syslog, rsyslog and syslog-ng?

I am a bit confused in syslog, rsyslog and syslog-ng. From where can I get the source code for syslog()? Is there any difference between rsyslog and rsyslogd?
0
votes
1answer
46 views

Why does syslog-ng drop debug messages when logging remote?

In the local log output, I can see debug messages but these won't show up on the remote logging server. It seems to ignore these but it does print warning and error level messages just fine. These ...
0
votes
0answers
20 views

Unable to get structured data in logged messages even after adding mmpstrucdata and mmrfc5424addhmac?(RFC5424)

I am trying to log messages with structured data . But it is showing null value for structured data. I am working with rsyslog 8.9.0.Can someone tell me either i need to load some module or modify ...
0
votes
0answers
46 views

Apache ErrorLog syslog logging to wrong facility

I've googled myself silly trying to find an answer to this question, but I've had no luck, so here I am. We have an Apache server (v2.2.15) running on CentOS. Apache itself is configured to use the ...
2
votes
1answer
93 views

rsyslog not writing log file after restart

First off, thanks for spending the time to have a look at this issue, its much appreciated. I've had the attached rsyslog.conf configuration running for sometime now until today when I had to restart ...
0
votes
1answer
42 views

Add a field to the Linux Login

Thanks all in advance. The question is simple. I want to ask the user the reason for login in Linux Production Servers. Login prompt will ask as common for user, password and the "Reason for Login" ...
-1
votes
2answers
66 views

Source of syslog bind query denied message [closed]

What is the cause, and how can I stop this request on example.com from my ip (xxx.xxx.xxx.xxx) being continually repeated in /var/log/syslog? Apr 14 20:37:10 example.com named[1663]: client ...
0
votes
1answer
31 views

Understanding syslog conf - targeting specific types / tags of logs

I'm combining log files from several docker containers on my host and sending them a remote logging service. I'm just redirecting the output to logger and tagging it: docker-compose logs 2>&1 ...
0
votes
0answers
32 views

Sftp Log for every Jailed User

I've a sshd_config file like the following: Match user foo ChrootDirectory /mnt/foo-jail/ ForceCommand internal-sftp AllowTCPForwarding no AuthorizedKeysFile ...
0
votes
1answer
80 views

Sending syslog from jail to host fails

I'm trying to send logs from a jail to the host system on FreeBSD 10. I think everything is setup correctly but I can't get it working. Sending logs directly from Nginx 1.7 works but not sending ...
2
votes
0answers
49 views

Nginx: Tags in Syslog output on wrong position

I'm trying to output the logs of several Nginx servers in FreeBSD jails to the jails' host. I'm using FreeBSD 10 syslog and Nginx 1.7.10. In Nginx (in this case the hostname is web) I have set: ...
1
vote
2answers
176 views

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
0
votes
0answers
38 views

Getting journald to send email on certain events

I found these solutions for syslogd that send emails on certain events like local0.crit or local1.err How can I make syslogd email certain log messages to me? ...
0
votes
1answer
149 views

“NTP socket is in use” messages from ntpdate in syslog

In cron.log I can see that ntpdate is being triggered from a cron job which is running daily at 23:15 Mar 10 23:15:01 seitan /USR/SBIN/CRON[22407]: (root) CMD (/etc/network/if-up.d/ntpdate) But ...
0
votes
0answers
92 views

How do I get auditd to push messages to a remote syslog server on Centos 6.6?

I'm a Windows guy trying to help a friend out. We need to get file auditing data off the Centos 6.6 server to a central syslog server. I found the auditd service and the audisp plugin. I edited the ...
0
votes
1answer
269 views

ESX performance stats in Logstash

Dose anyone know if it is possible to collect ESX Performance Stats in LogStash/ELK stack? looking to see if I can collect ESXTOP data for use in the ELK stack.
1
vote
2answers
130 views

Unable to get Rsyslog structured data in syslog message

I am new to syslog module. I am trying to log messages with structured data by using this parameter in template. But it is showing null value for structured data. I am working with rsyslogd 5.8.11 ...
3
votes
1answer
69 views

How to configure Monit to alert me when anything appears in syslog

I want Monit to alert me if ANYTHING shows up in syslog - as anything in there would be abnormal. I've tried the following and I'm not receiving any alert emails when I manually add something to ...
0
votes
1answer
48 views

rsyslogd and FQDN - cannot get FQDN from clients

I setup a syslogserver with rsyslogd and 3 clients. Logs from 3 test clients are sent to the server, so far so good. My Problem is: I can't get the FQDN hostnames to work. According to rsyslog.com ...
0
votes
1answer
153 views

How to replace control characters in rsyslog

we have several (usually java) application and they log to centralized rsyslog server (version 7.6). We had problems with java exceptions as rsyslog was handling each line of stack trace as separate ...
0
votes
1answer
183 views

How do I filter on tags in syslog-ng when they don't seem to be available by the time it processes it?

I am having a hard time debugging an issue and I think it may be two-fold - problems in two separate programs. The main issue is that I'm logging nginx to syslog on Ubuntu 14.04 like so: access_log ...
0
votes
0answers
246 views

Send apache ssl access log to syslog

I'm having an issue piping apache ssl access logs to my syslog server. I've added the following line to my apache config: CustomLog "|/usr/bin/nc -u <syslogserver> 514" "<134>%{%b %d ...
0
votes
1answer
1k views

nginx logs to syslog - connection refused

I'm trying to setup nginx 1.7.3 to send logs to syslog, but when I this configuration: server { access_log syslog:server=localhost; } this shows up in nginx's error log: 2015/01/15 21:42:47 ...
0
votes
0answers
71 views

Syslog randomly logs bad time [duplicate]

Try as I might, I can't figure out why this server randomly timestamps syslog entries with bad time. Here's a 5-minute stretch of syslog from a few minutes ago. You'll notice there are two places ...
-1
votes
1answer
57 views

File monitoring using syslog [closed]

Can rsyslog, syslog-ng programs monitor change of file? I want to monitor files and receive the changes made to the file by syslog on server. Thank you.
2
votes
2answers
322 views

How does one manually rotate log without logrotate on open/live file?

My Google-Fu is getting me so close but just not quite there, and I guess I'm too green in Linux to put the pieces together. I have a very large >200GB log file, still being written to. Logrotate ...
-1
votes
1answer
114 views

Determine timezone in Rsyslog file

I would like to determine what time zone a specific log is in. I found this line in the log: Aug 29 07:07:40 gw kernel: rtc_cmos rtc_cmos: setting system clock to 2013-08-29 11:07:08 UTC(1377774428) ...
0
votes
0answers
59 views

Suspicious web activitin in nginx logs

I'm seeing some strange entries in my NGINX logs: 2.71.139.98 - - [26/Dec/2014:12:36:24 +0000] ...
0
votes
2answers
128 views

syslog-ng prepending date to received logs, breaking patterns in patterndb

I'm setting up central logging for our servers using syslog-ng + patterndb, however the logs the logging server is receiving from the client are prepended with the date, host and other data. This of ...
2
votes
1answer
523 views

UDP Traffic from outside to docker container is dropped after container restart

following situation: i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4 I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to ...
0
votes
1answer
153 views

Syslog-ng loghost - filter not-match

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong. It seems like filters are not working for ...
2
votes
2answers
51 views

How to collect logs for statistics in site?

I want to collect logs from nginx ( several servers, 1 000 000 lines in logs for minute for all servers ) to central stat server for statistics processing. I see 2 variants: write logs to local ...
0
votes
1answer
702 views

DNS format error in syslog, how to debug?

I'm getting an error in my syslog when resolving a domain I also the DNS for. Nov 24 21:51:55 moo named[4075]: DNS format error from 192.227.143.105#53 resolving bostonyoungentrepreneurs.com/NS for ...
13
votes
1answer
169 views

How do I make sec ignore a timestamp properly

I have a rule that is set up like so; In /etc/sec/rules.d I have; type=SingleWithSuppress ptype=regexp pattern=(\S+) sshd\[\d+\]: PAM \d+ more authentication failures\; logname=.* uid=.* euid=.* ...
1
vote
2answers
3k views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
0
votes
1answer
192 views

Server crash with ascii NUL characters in syslog ( ^@^@^@… )

I have some dedicated server hosted by a OVH (French service provider). OS : Ubuntu 12.04 x64 A few months ago, one of my server crashed. The only weird thing was some "ASCII NUL" caracters in the ...
1
vote
2answers
748 views

How can I suppress Postfix anvil statistics from system logs?

After every email sent through my mail server, postfix/anvil appends something like the following: Nov 9 15:09:11 keutenberg postfix/anvil[30006]: statistics: max connection rate 1/60s for ...
0
votes
1answer
1k views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
0
votes
1answer
52 views

Logging only written on old [filename].1 log files

My log is not written on the correct log file for example syslog, mail.log, mysql.log, auth.log but for some reason the latest event are written on these old log files syslog.1, auth.log.1, mail.log.1 ...
4
votes
1answer
309 views

Random SSH entries in Auth.log out of date order [duplicate]

Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue. Some ...
0
votes
1answer
442 views

SSH Failed password login - log password

today I checked the log of my sshd and I have discovered tons of lines like :Oct 12 Oct 12 12:31:34 my_user sshd[15324]: Failed password for invalid user admin from 104.194.25.135 port 2683 ssh2 ...