Questions tagged [syslog]

syslog is a standard for logging messages about the operation of a system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

Rsyslog storing only certain type of events in a file

I am collecting TM Deepsecurity events on my syslog server. The TM manager sends logs to my syslog server on port 514. There are two types of events TM sends. Deep Security Agent & Deep ...
Nav's user avatar
  • 1
2 votes
2 answers
229 views

How to tell syslog-ng to ignore source files if they are absent

I'm trying to deploy a standard configuration file for syslog-ng on multiple linux servers. My infrastructure includes many services (apache, confluence, ...) with log file located at various places. ...
Suffren's user avatar
  • 29
0 votes
0 answers
27 views

How to get syslogd and/or Apache2 to STOP logging DEBUG messages to console

When I SSH into one of my Linux boxes (Ubuntu 20.04.2), I periodically see messages appear on the console screen: Message from syslogd@my-hostname at Jan 30 21:35:17 ... apache2: [MY-APP] DEBUG - 2024-...
GregSD's user avatar
  • 1
0 votes
1 answer
44 views

Microsoft Defender: extract Automatic log upload data

Is there a way to extract this automatic log upload table from defender: my goal is to use this information to aid in responding to the System alert: Cloud Discovery automatic log upload error alert ...
HarriS's user avatar
  • 101
7 votes
2 answers
9k views

Where is some os logs in Debian 12

It seems that some of the system log files (/var/log/syslog, /var/log/auth.log, /var/log/kern.log, ...) have been removed in the latest version of Debian, Debian Bookworm. What should be done to ...
Omidreza Bagheri's user avatar
0 votes
1 answer
36 views

Sending ESXI audit logs to http endpoint?

Is it possible to send audit logs from ESXI's (or better yet, vCenter) to an http endpoint via API/webhook rather than a syslog server? Couldnt find a direct answer or a tutorial online. Thanks!
milner236's user avatar
0 votes
0 answers
61 views

Enable $RepeatedMsgReduction only for specific log file

If this were the script for routing messages to log files in rsyslog.conf, is it possible to activate RepeatedMsgReduction only for app_log? if ($syslogfacility-text == "auth") then { ...
zeroKool's user avatar
0 votes
1 answer
186 views

Rsyslog not writing any logs from Cisco network devices - all other remote syslog works fine

tcpdump confirms valid syslog is coming in from multiple remote systems - servers and Cisco network equipment. OS is Linux RHEL 8.8 The servers all come in fine and write to disk, and are shown as ...
mkramer317's user avatar
0 votes
0 answers
26 views

syslog diff or comparison that reorders identical lines to ignore race conditions?

Sometimes when debugging intermittent boot problems, it would be advantageous compare two exerpts from syslog: One leading to a working system, and one leading to the symptom. However, diff is not ...
James Bowery's user avatar
1 vote
1 answer
77 views

Is syslog over udp safe on a local network?

I have a device that doesn't support sending tls syslog traffic, and can only send udp syslog. I'm only sending logs over my local network, but I'm worried the non-tls data can be read by anyone on ...
user9503's user avatar
0 votes
0 answers
1k views

Issue Getting Rsyslog TLS Configuration Working

Overview I have a server that receives Syslog data from external clients, and I do not have administrative access to these clients. The goal is to move the existing configuration to data in transit ...
g9s0x1's user avatar
  • 1
0 votes
0 answers
78 views

Split logging on rsyslogd

My goal is to send all logs to one source remote and still log local but then send all the AuditD logs to its own source on port 20002. But for some reason, my auditd logs are still ending up with my ...
Jason's user avatar
  • 3,941
1 vote
1 answer
119 views

Postfix logging incomplete after changing myhostname

My postfix installation does not log most of the messages after changing myhostname. The myhostname is now different from the FQDN (and hostname) of the machine where it used to be the same. After ...
hetOrakel's user avatar
  • 121
0 votes
1 answer
47 views

Ssh messages do not output to a pipe configured in syslog.conf

I have configured a pipe in syslog.conf for auth.* to capture the ssh syslog error and status messages. I have then a python script that processes this pipe's input and I check that we receive ...
A Mere's user avatar
  • 3
0 votes
0 answers
151 views

Add mac address in rsyslog template

I am trying to add system/device mac address in syslog. No solution is working for me. Following command gives me mac address, just wanted to use in rsyslog template. mac_addr=$(ifconfig en0 | awk '/...
sandip karanjekar's user avatar
1 vote
0 answers
253 views

LogStash and parsing OPNSenser logs

My logs are coming in as follows: <134>May 24 14:39:32 edge.internal filterlog[2535]: 78,,,ffe6d10d1f27a42fc0edc3abb3a6d333,ovpnc1,match,pass,out,4,0x0,,63,61951,0,DF,6,tcp,60,10.8.0.2,20.44.17....
Jason's user avatar
  • 3,941
0 votes
0 answers
87 views

Disable Cisco Router syslog messages

I am trying to disable syslog messages from showing in my cisco 1kv tty. The conundrum is terminal monitor has a single command to set the logging level #logging terminal <severity>, and if I ...
Omera's user avatar
  • 15
0 votes
1 answer
103 views

rSyslog stopped sending only SOME data

I have configured a remote logging from one of my servers to the central log server via rsyslog TCP/SSL Everything worked fine until yesterday where most of the files just stop being transmitted while ...
Mr.P's user avatar
  • 109
0 votes
1 answer
1k views

Understanding Samba VFS Operations for Full Audit

We have a TrueNAS System running TrueNAS-12.0-U8 for which we are required to log all successful and all failed file access attempts for a specific SMB share. The Samba version is 4.13. Per guidance ...
sardean's user avatar
  • 843
1 vote
2 answers
220 views

syslog-ng filter log by frequency to destination file

I have a syslog-ng that receives too many logs and I am trying a way to 'sample' them using some filter. I assume editing the /etc/syslog-ng/syslog-ng.conf with something like log { source(s_udp514); ...
asasa178's user avatar
  • 109
0 votes
1 answer
1k views

Postfix logging to syslog even though it's excluded

Ubuntu 22.04 and postfix 3.6.4 Postfix config is set to use syslog_facility=mail, and I have modified /etc/rsyslog.d/50-default.conf to the following *.*;mail,auth,authpriv.none -/var/log/syslog ...
Brett A.'s user avatar
  • 156
0 votes
1 answer
226 views

Syslog-ng enable TCP framing

I'm trying to send file entries as messages via TCP, where syslog-ng is in a container and it is sending to another container. I've had two different attempts both with problematic behavior. The first ...
Omri. B's user avatar
  • 109
-1 votes
1 answer
1k views

splunk syslogs Forwarder set up not working and paused data flow

I have set up the Universal Forwarder locally in my machine using this guide https://splunk.paloaltonetworks.com/universal-forwarder.html /opt/splunkforwarder/etc/system/local/inputs.conf [monitor:///...
asasa178's user avatar
  • 109
0 votes
0 answers
55 views

Unexpected ubuntu server down

I am using an Ubuntu Server 16.04LTS running ISP config that is hosted an VMware ESXi I experienced an unexpected shutdown issue, and I'm trying to identify the source. Upon checking the logs, I was ...
divya's user avatar
  • 1
0 votes
0 answers
45 views

Crontab I have tried cronitor airplane nothing helps

my crontabs do not run, sys log gives me this, Jan 6 08:30:02 joe-sbc-flt1 CRON[102851]: (joe) CMD (/home/joe/scripts/watchit.sh) I have no idea what it means or what is wrong, can anyone help?
extra views's user avatar
1 vote
0 answers
252 views

How to add to excludes alerts on smartmontool

I faced with problem and hope for your help. Started getting notifications from smart on Debian 10 server: Device: /dev/nvme1, Critical Warning (0x04): Reliability Found that this alert causing ...
remuz150's user avatar
0 votes
1 answer
562 views

How do I get Docker to include the host hostname in syslog?

I have configured docker to use the syslog log driver. My daemon.json looks like this: { "log-driver": "syslog", "log-opts": { "syslog-address": "...
Tim's user avatar
  • 9
0 votes
1 answer
259 views

define custom fields for systemd-journald

The doc states, it may be possible to define new fields by applications. What does it mean? Can one define arbitrary fields or are only those possible listed in the doc USER JOURNAL FIELDS? If ...
woodz's user avatar
  • 146
0 votes
0 answers
1k views

php-fpm access log to rsyslog

I am trying to find a solution for getting logs from php72 php-fpm yii2 application behind nginx on several numbers of servers: at now application writes its logs to files on server disk, yii performs ...
Илья Бугримов's user avatar
1 vote
1 answer
4k views

Where does Ubuntu log TCP connections?

When doing some network security checks (on which I am an amateur) for my office PC, I discovered a few unknown tcp6 connections (with netstat -nt): Active Internet connections (w/o servers) Proto ...
trisct's user avatar
  • 113
0 votes
0 answers
913 views

Promtail - syslog configuration only logs localhost for hostname and IP

I have a number of boxes that run docker containers. To keep a record of all the logs, we have 1 instance of logspout on every box that grabs all container logs on that box, and routes it to a syslog-...
WorkAppropriateUsername's user avatar
0 votes
1 answer
19 views

syslog access beginning of log line

I would like to filter the content of my logs generated by Syslog, I'm applying a filter based on $msg but it is not containing the beggining of the line: 2022-09-29T16:39:39Z SYS_SERVER_2 - - - - - A ...
tiamat's user avatar
  • 103
0 votes
1 answer
1k views

Combining multiple Property-Based Filters for Rsyslog

I was trying to set up a specific Rsyslog configuration file to catch all incoming kernel messages of a few types. For example, I want to dump all logs containing "example message 1" and &...
jeff's user avatar
  • 1
1 vote
0 answers
123 views

Postfix - some mails not sent to particular domain and syslog tagging issue

I have a problem with e-mails sent to a particular domain (alice.it). Usually the mail is corrected sent and in my postfix log I have this: 06104180AF: to=<**********@alice.it>, relay=mx.tim.it[...
Stefano's user avatar
  • 11
0 votes
1 answer
802 views

rsyslog ruleset for encrypted logging

I've setup managed to setup rsyslog to accept TLS traffic from a clients server. When I configured the certificate and the port originally, it all worked fine. The problem is it is dumping the logs ...
itinneed2022_1's user avatar
1 vote
2 answers
666 views

Why would you want to change the log_msg_size from syslog-ng's default of 64k?

Per the syslog-ng admin guide, the log_msg_size defaults to 64k (65536 bytes) However, I have seen some sample syslog-ng config files (like this one) that drop this to <18k (18192 bytes) Why would ...
warren's user avatar
  • 18.7k
1 vote
1 answer
135 views

Configuring rsyslog to route messages to different log files based on content

Can rsyslog be configured to route log messages to different log files/locations based on the content of the log message? If so, how and could I see a simple example?
hotmeatballsoup's user avatar
0 votes
1 answer
326 views

Sending rsyslog messages to remote file system

I have an Ubuntu server that will be running rsyslog and many "client" devices and applications sending logs to it (via various syslog clients). I know that rsyslog logs everything to /var/...
hotmeatballsoup's user avatar
2 votes
1 answer
4k views

Different postfix logfile format when logging to separate file (maillog_file)

In order to separate the mail logs from the general system logs, I added this line to /etc/postfix/main.cf maillog_file = /var/log/postfix.log As expected, a file /var/log/postfix.log is created, and ...
BurninLeo's user avatar
  • 910
1 vote
1 answer
1k views

Why some companies like cisco follow different syslog messaging format rather than rfc 3164 (BSD syslog) and rfc 5424 (IETF syslog)?

According to my understanding the popular syslog formats are: RFC 3124 (BSD syslog): Format: < priority >timestamp hostname application: message Example: <133>Feb 25 14:09:07 webserver ...
Allan's user avatar
  • 15
1 vote
1 answer
3k views

why is faillog, tallylog and lastlog so big?

I got a notice from a backup system (rsnapshot) today that it's storage volume was full. A closer look reveals some older snapshots where faillog, tallylog and lastlog are bigger than the actual ...
Nstevens's user avatar
  • 321
0 votes
1 answer
294 views

does remote logging stops local logging

I'm using a Graylog server to centralize logs from network equipment and servers and I'm wondering if the Syslog service on the switches, windows machines, and other equipment, that service still ...
Retro_0's user avatar
1 vote
0 answers
93 views

Rsyslog not sending to server when filesystem fails

I have on my servers an rsyslog client, that supposed to send logs to rsyslog server. Recently there was an issue on one of the servers where the filesystem went into read-only. This caused local logs ...
user6329530's user avatar
0 votes
0 answers
1k views

syslog-ng duplicate log message

Not duplicate of this question because that one uses rsyslog on client whereas I use syslog-ng on both sides. I have a syslog-ng instance on both the client and the server and for whatever reason the ...
ElpersonPL's user avatar
1 vote
0 answers
36 views

What does a series of ^@ in the syslog mean?

Our server did not react to pings anymore since around 23:49 yesterday until we restarted it at 7:09 am today. These are the last things we saw in the syslog: The machine runs on Ubuntu 20.04 with ...
Alex's user avatar
  • 726
0 votes
1 answer
4k views

syslog-ng: how to configure sending RFC5424 messages with octet-counting framing

Please don't bother reading this question. syslog-ng is already set up to send RFC5424 messages with octet-counting framing by default. I was confused by the behaviour of another component. This ...
davidA's user avatar
  • 393
0 votes
2 answers
533 views

systemd, journal receiving raw log

one common paradigm on all other syslog implementations (rsyslog, syslog-ng, readlog, etc) is to exchange log entries via UDP514 in plain text format. How do I enable systemd-journal-remote to receive ...
gcb's user avatar
  • 72
2 votes
1 answer
565 views

Can i prevent a non-root user using logger to make fake entries (e.g. sshd) in the syslog?

i just played with logger an non-root user, but it looks like everyone is able to create fake entries in the syslog using the "-t" parameter. Is this expected to work this way? I could flood ...
Bernd Singer's user avatar
1 vote
0 answers
53 views

Relate session and NAT logs in near real-time [closed]

I have a user activity logger and querying system for an ISP with very high log events rate (5k-10K /second). It needs to relate both Radius/Session and NAT Syslogs based on a common InternalIP field. ...
iamadnan's user avatar
0 votes
1 answer
547 views

Graylog fails to parse nginx access_log: JsonParseException: Unexpected character ('<' (code 60))

I've followed https://github.com/ronlut/graylog-content-pack-nginx-docker and Send NGINX logs to Graylog to try to get nginx logs into a graylog 4.1.5 server. Graylog is not displaying messages ...
Felipe's user avatar
  • 1

1
2 3 4 5
14