syslog is a standard that defines the format of messages about a system's operation. They are further categorized by facility (user,mail,kern), etc and a severity (critical, emergency, informational, etc). These messages are usually then processed by a network monitoring system to take appropriate ...
1
vote
0answers
22 views
HAProxy running in chroot jail is only logging started messages
I've configured my HAProxy server to run in a chroot jail logging messages to syslog socket. My problem is that the only messsages currently being logged are for when haproxy is starting up.
May 26 ...
0
votes
1answer
35 views
syslog written on console
I have odd problem with syslog local7, my syslog configure the syslog to be written to
local7.info /var/log/syslog_info
it's working just fine for years but recent days one device syslog message ...
3
votes
1answer
50 views
Best Practices for rotating syslog logs on RHEL with different schedules?
OS:
Running RHEL 5.6.
Situation:
I need to rotate /var/log/messagees on a different schedule than the rest of the syslog logs.
By default syslog logs are rotated weekly based on the ...
-1
votes
2answers
76 views
Can it be because of any Kernel Bugs?specifically spin lock
We are running ubuntu 11.04 with 2.6.38-13-generic kernel on
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz with 48 GB RAM dedicated server with Hardware RAID.
top command output is showing many kernel ...
3
votes
1answer
44 views
Can a hostname be added to syslog-ng?
How can syslog-ng be configured to send both the hostname and the IP address. Currently, logs are sent with the IP address of the device/machine, but we want to add the hostname so I could keep my ip ...
2
votes
2answers
62 views
VMware: Is my SYSLOG Collector running?
I am trying to determine if my Syslog Collector I just set up in vCenter 5 is working correctly.
According to this VMware KB article and this VMware blog article, everything seems to be up and ...
1
vote
1answer
77 views
Apache httpd: Send error logs to syslog and local disk? Without touching /etc/syslog.conf?
I have an Apache httpd 2.2 server. I want to log all messages using syslog, so that the requests are sent to our central syslog server. I also want to ensure that all log messages are sent to local ...
0
votes
0answers
71 views
syslog and other logs are not updated in my ubuntu server
I installed ubuntu 11.10 and it was running for 1 month and suddenly it stopped updating syslog and other log files. I went into dmesg and I saw following messages.
[ 14.355780] init: Failed to ...
0
votes
2answers
86 views
rsyslog: How do I direct messages from all remote machines to one file?
We have a syslog server and we have all our servers logging to it.
We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.
Anyone know how to ...
2
votes
3answers
157 views
rsyslogd: Any way to get around the number of local facilities?
We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
0
votes
2answers
20 views
What is the “facility” of SnapGear SG560 System Log Syslog
My SnapGear (now McAfee) SG560 (firmware Version 4.0.10) has a "remote system log" feature, which can send syslog-type data to a host in my network. It's working, but writing to /var/log/messages. I'd ...
5
votes
1answer
155 views
How to maintain the log source host using logstash
I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter.
In the ...
2
votes
1answer
54 views
syslog writing to general instead of specific file
I'm running Ubuntu and Postgresql 9.
I've enabled postgresql to log to syslog, and added the following directive to the config file:
syslog_facility = 'local0'".
I've tried to configure syslog ...
1
vote
1answer
58 views
Additional Security Measures for Syslog over SSH
I'm currently working on setting up some secure syslog connections between a few Fedora servers. This is my currently setup
192.168.56.110 (syslog-server) <----> 192.168.57.110 (syslog-agent)
...
0
votes
1answer
44 views
On Solaris, how to log IP when using winbind auth and invalid user?
This is on Solaris 10 sparc platform.
I'm trying to make our denyhosts script block the dictionary ssh attacks.
Unfortunately, the logging does not show an IP when the user name is invalid.
We are ...
2
votes
3answers
174 views
How to stop syslog from listening to 514 on CentOS 5.8
I have a CentOS 5.8 machine (with regular syslog) that for some reason is listening to port 514, even though it is not started with "-r" (to receive remote syslog messages).
# netstat -tulpn | grep ...
1
vote
2answers
74 views
Increase rsyslog/syslog precision to include fractional seconds?
I use syslog and rsyslog to handle logging on my Linux & FreeBSD systems.
The timestamp is currently in seconds but I would like to increase the precision of these timestamps to include ...
0
votes
0answers
79 views
Push and Pull logging design - experience with processing sucked logs
I like the idea of combination of send (sending to syslog aggregator) and fetch (fetching logs from clients) design.
(More in wonderful doc ...
1
vote
2answers
98 views
Syslog-ng: how to change a message before sending to a remote host
I'm using syslog-ng 1.6.8 on SLES 10. From this machine, I need to forward all events to the remote host 10.30.38.115. But preliminary I have to change messages a little bit, adding "MyMark" prefix to ...
0
votes
0answers
16 views
syslog full of bdi-device-added, bdi-device-removed events. what is it?
i have lots and lots of messages like
Mar 6 15:56:23 unknown init: Handling bdi-device-added event
Mar 6 15:56:35 unknown init: Handling bdi-device-removed event
in my syslog.
any idea what ...
0
votes
1answer
86 views
Opensource log correlation application - an alternative to SEC?
is there a opensource log correlation application? I know only SEC[1]. The best would be if the application could work in clustered setup and would understand even structured logs, not only free-text ...
0
votes
1answer
32 views
syslog - log line classifications [closed]
A very generic question; in the context of a programmer, with operational aspect of the process (program) in mind.
Is there any sort of best-practice / guide to classify messages, particularly in the ...
1
vote
1answer
115 views
Syslog severity levels when to use Alert vs Critical
Short overview: Is Alert more severe than Critical.
RFC 5424 briefly defines syslog severity levels and gives a short description. Each syslog level is given a code 0 - 7. It was my understanding ...
0
votes
2answers
128 views
RSyslog does not work with a log file located outside of /var/log
I am unable to get rsyslog to write to a log file located in a directory other than /var/log.
The server is RHELS 5.6 and for the most part with a default configuration. Other than the rsyslog ...
1
vote
2answers
99 views
Remote Logging with syslog
I have two machines running FreeBSD, bsdclient and bsdserver. I am trying to setup remote logging such that bsdclient sends all the logs to bsdserver. My syslog.conf on bsdclient goes like this
*.* ...
1
vote
1answer
181 views
Why does iptables output to /dev/console?
For some reason I see the output from this iptables rule
$IPT -A FORWARD --jump LOG
$IPT -A FORWARD --jump ACCEPT
on the console eventhough I have disabled kern in /etc/syslog.conf
#kern.* ...
0
votes
1answer
134 views
Lots of nfs4_reclaim_open_state: Lock reclaim failed entries in syslog
I have an Ubuntu 11.10 VM set up in VMSphere. I'm storing some data on a nfs mount. The VM has been going down frequently. I haven't been able to pin the reason why down, but I think it has to do with ...
0
votes
1answer
291 views
0
votes
2answers
167 views
log forwarding performance and OS bottleneck
How many logs/second can usually be handled by syslog servers? By syslog servers, I am referring to rsyslog, syslog-ng, splunk etc. The intent of the question is to find out at what logs/second rate ...
0
votes
0answers
117 views
Solaris Auditing (BSM) - How to log argv to syslog
By default, it seems that the argv from execs is not passed to the audit_syslog.so plugin. The binary audit log has the arguments included, but the plugin won't write them into the syslog. Everything ...
4
votes
1answer
128 views
Unusual server crash on EC2, syslog has line of ^@^@^@^@^@
Trying to get at the root of why a server went down for 20 minutes, I looked at the syslog for that time period and saw this:
Jan 3 07:50:01 tools CRON[17085]: (munin) CMD (if [ -x ...
0
votes
3answers
211 views
Splunk How do I get syslog to send data into splunk from remote machines
If I install the splunk forwarder, I can get the remote data into my splunk install, and index my logs, and searching is great. But I have a number of router devices and other devices that run syslog, ...
0
votes
1answer
86 views
Redirecting rabbitmq-server log messages to syslog
I have a CentOS machine running rabbitmq-server v2.2.0-1.el5, and rabbitmq is outputting it's log messages to various files under /var/log/rabbitmq.
If there anyway to configure rabbitmq to tell it ...
2
votes
0answers
198 views
vSphere ESXi 5.0 hosts syslog to Graylog2 - Mangled log entries
I'm just setting up graylog2 (which is awesome) to be a syslog server for my virtualised environment. All my hosts and switches are happily logging away to graylog2, which is drawing some pretty ...
0
votes
0answers
56 views
Zensyslog Clear Events
I've hooked up Zenoss' Zensyslog so that messages from a distributed list of client machines are all conglomerated into events on the Zenoss server. This is all fantastic, and I can bump messages by ...
2
votes
2answers
219 views
Nagios plugins/commands output to syslog
Do you know if is there any easy way to send output of every check run by nagios to syslog?
0
votes
1answer
608 views
Linux [Hardware Error] message from kernel
Since yesterday I get the following message every few minutes:
Message from syslogd@hostname at Nov 23 12:31:17 ... kernel:[8024326.816370] [Hardware Error]: MC4_STATUS: Corrected error, other ...
1
vote
1answer
484 views
How do I disable nginx sending messages to syslog?
My nginx sends lots of messages to syslog, but I don't need them.
In my nginx.conf:
error_log /var/log/nginx-error.log notice;
......
server {
access_log off;
...
1
vote
2answers
150 views
How to set up mysql storage for certain rsyslog input matches?
I'm draining various logs from Heroku to an rsyslog linux (ubuntu) server and am starting to have a little more to bite off than I can chew in terms of working with my log histories.
I am needing to ...
2
votes
1answer
167 views
snort not logging full output to syslog
I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
0
votes
1answer
487 views
Redirecting Syslog events from RHEL 6 to RHEL 5: is it possible to provide with the same event format?
For some reasons, we redirect syslog events from RHEL 6 (with rsyslog) to RHEL 5 (with syslogd).
On RHEL 6 in rsyslog.conf:
*.* @10.30.46.211
On RHEL 5 in /etc/sysconfig/syslog:
...
0
votes
3answers
77 views
Adding a new facility to syslog
The docs give a fixed list of facilties for syslog, but it's clearly possible to have more (http isn't on the list). Do I just describe it in the conf file and start using it or is is more involved? ...
0
votes
1answer
191 views
Sending multiple loglines (mysql-slow.log, php5-fpm.log.slow) to syslog
I'm trying to aggregate several sources of error messages into one place, to easier put things into context. I'm currently looking at rsyslog, but I can change this - if it's preventing me from doing ...
0
votes
0answers
72 views
Ubuntu power management logfiles? Forensics (maybe?)?
I'm in the unfortunate position where I need to determine what happened to a remote server of ours. I only have SSH access to it and it's a netbook running ubuntu 10.04 32 bit. It dropped offline for ...
2
votes
2answers
78 views
Managing and configuring syslog-ng for very large logs
I have the logs traditionally kept in /var/log/ piped through syslog-ng. The logs can reach to the terabyte size on a daily basis. In order to make them more manageable. I would like break them out ...
-2
votes
1answer
125 views
Forward Windows logs to Linux server [closed]
Possible Duplicate:
Software to send windows notification eventlogs to linux syslog server and encode to utf8
Is it possible to forward logs from a Windows server to a Linux syslog server ?
...
3
votes
4answers
141 views
Log Shutdown Command Usage/Message
I want to monitor whenever any of our machines run the shutdown command so that it can send an email or notification of an imminent reboot/shutdown. I figured that when shutdown was run it probably ...
5
votes
2answers
300 views
Syslog forwarding loses original hostname
I have DMZ hosts forwarding to a DMZ syslog which in turn forwards all the syslog messages to an internal syslog server. It's working fine for the most part but the internal syslog host messages ...
1
vote
1answer
128 views
Redirecting syslog output for certain processes to a particular file
I must admit to being a complete syslog newbie. I haven't touched it until now, but I use its output on a daily basis, like most of us :)
I currently have a problem with the gmetad daemon spamming my ...
1
vote
1answer
88 views
Does STDERR go to syslog in an LSB init script?
I am running a Debian system and have an init script in /etc/init.d/ that starts a daemon using start-stop-daemon:
start-stop-daemon --start --quiet --pidfile /tmp/myproject.pid --exec ...
