syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

-1
votes
1answer
23 views

Determine timezone in Rsyslog file

I would like to determine what time zone a specific log is in. I found this line in the log: Aug 29 07:07:40 gw kernel: rtc_cmos rtc_cmos: setting system clock to 2013-08-29 11:07:08 UTC(1377774428) ...
0
votes
1answer
38 views

Suspicious web activitin in nginx logs

I'm seeing some strange entries in my NGINX logs: 2.71.139.98 - - [26/Dec/2014:12:36:24 +0000] ...
-1
votes
0answers
13 views

Syslog “rt_bind_peer(0) @ffffffffa0283f57” [migrated]

My /var/log/syslog on a Debian server is flooded with lines similar to Dec 23 16:05:40 server1 kernel: [ 686.957585] rt_bind_peer(0) @ffffffffa0283f57 These messages occur up to twice a second ...
0
votes
0answers
6 views

syslog-ng prepending date to received logs, breaking patterns in patterndb

I'm setting up central logging for our servers using syslog-ng + patterndb, however the logs the logging server is receiving from the client are prepended with the date, host and other data. This of ...
2
votes
0answers
29 views

UDP Traffic from outside to docker container is dropped after container restart

following situation: i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4 I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to ...
0
votes
1answer
23 views

Syslog-ng loghost - filter not-match

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong. It seems like filters are not working for ...
2
votes
2answers
24 views

How to collect logs for statistics in site?

I want to collect logs from nginx ( several servers, 1 000 000 lines in logs for minute for all servers ) to central stat server for statistics processing. I see 2 variants: write logs to local ...
0
votes
1answer
27 views

DNS format error in syslog, how to debug?

I'm getting an error in my syslog when resolving a domain I also the DNS for. Nov 24 21:51:55 moo named[4075]: DNS format error from 192.227.143.105#53 resolving bostonyoungentrepreneurs.com/NS for ...
12
votes
1answer
130 views

How do I make sec ignore a timestamp properly

I have a rule that is set up like so; In /etc/sec/rules.d I have; type=SingleWithSuppress ptype=regexp pattern=(\S+) sshd\[\d+\]: PAM \d+ more authentication failures\; logname=.* uid=.* euid=.* ...
0
votes
0answers
88 views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
0
votes
1answer
50 views

Server crash with ascii NUL characters in syslog ( ^@^@^@… )

I have some dedicated server hosted by a OVH (French service provider). OS : Ubuntu 12.04 x64 A few months ago, one of my server crashed. The only weird thing was some "ASCII NUL" caracters in the ...
0
votes
1answer
48 views

How can I suppress Postfix anvil statistics from system logs?

After every email sent through my mail server, postfix/anvil appends something like the following: Nov 9 15:09:11 keutenberg postfix/anvil[30006]: statistics: max connection rate 1/60s for ...
0
votes
1answer
99 views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
0
votes
1answer
24 views

Logging only written on old [filename].1 log files

My log is not written on the correct log file for example syslog, mail.log, mysql.log, auth.log but for some reason the latest event are written on these old log files syslog.1, auth.log.1, mail.log.1 ...
3
votes
1answer
100 views

Random SSH entries in Auth.log out of date order [duplicate]

Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue. Some ...
0
votes
1answer
155 views

SSH Failed password login - log password

today I checked the log of my sshd and I have discovered tons of lines like :Oct 12 Oct 12 12:31:34 my_user sshd[15324]: Failed password for invalid user admin from 104.194.25.135 port 2683 ssh2 ...
1
vote
2answers
99 views

Syslog does not record logs received over TCP to a file

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over ...
-5
votes
2answers
125 views

server hacked - cron continue to run [duplicate]

Someone accessed my EC2 Ubuntu 14.04 and installed some malicious cron to do port scanning with user eric. I removed user eric and the file executed, but in syslog I see Sep 19 15:27:01 ip-xxx ...
0
votes
0answers
38 views

No syslog using Kiwi 9.4 (free) directly connected on the inside of a Cisco ASA 5505 running a VPN

I have a number of remote branches (each with an IPSec site to site configuration. The main station has a Cisco 5510, the branches are each a Cisco ASA 5505. Works fine. I recently installed the paid ...
0
votes
1answer
46 views

Cisco CGS2520 switch to reveal MAC address when port goes active?

Is there a way to have a Cisco switch reveal the MAC address of a device via Syslog when it is plugged in? I get messages that a device is connected, but there isn't a lot of detail: Sep 9 12:50:51 ...
0
votes
0answers
29 views

Input filtering in rsyslog 5?

I have some messages hitting my rsyslogd server which a network trace shows as: <5>1 2014-09-04T14:58:31Z HOSTNAME This=a message=that contains=some specially=formatted data= This is ...
0
votes
1answer
25 views

Understanding ntpd entry in syslog

Does anyone know what this entry in syslog means: static1 ntpd[2397]: 2a00:xxxx:xxxx:239::2 interface 2a01:xxxx::xxxx:xxxx:fe70:a40c -> (null) (I've replaced some of the values with xxxx) Thank ...
0
votes
0answers
221 views

Separating java stdout and stderr with systemd and without filling journal

I am running java apps via systemd: [Unit] Description=test service [Service] Type=simple EnvironmentFile=/etc/sysconfig/testserver WorkingDirectory=/opt/testserver ExecStart=/usr/bin/java -jar ...
1
vote
1answer
24 views

TCP rsyslogd events showing up as 2000 character continuations

I'm taking syslog events from a proprietary app. This could be the app's fault or it could be rsyslogd. Events are written like: Aug 15 16:00:00 10.11.12.13 Event1 from this wonderful product using ...
2
votes
2answers
56 views

Using (r)syslog's dynamic file generation

I am in the middle of configuring a (r)syslog server as a remote server that receives logs from various clients. I wonder whether there is a nicer way to dynamically generate multiple file names as ...
1
vote
2answers
32 views

Segmenting syslog logs and access to those logs

I'm trying to figure out if what I'm trying to accomplish is possible or not. What I want is to have all my devices send logs to a syslog server, then have Splunk pull logs for everything EXCEPT my ...
3
votes
1answer
296 views

Difference between /dev/udp and netcat

I have a syslog server listening on localhost:514 as UDP and would like to write messages to it on that port. (Using Ubuntu 14.04) If I run either of these commands this from bash it prints the date ...
1
vote
1answer
369 views

How to prevent syslog message popping in a ssh session without affect other sessions?

i have a machine(RHEL 5.2) which receives syslog message from remote machines. And now it keeps popping message from remote machine in a ssh shell, which is annoying when i want to do something on it. ...
0
votes
0answers
53 views

(rsyslog) Forwarding a specific log only

I've been trying to configure rsyslog to forward /var/log/syslog to a remote server. I was able to do this using the below configuration. $InputFileName /var/log/secure $InputFileTag hostname-secure ...
-2
votes
1answer
44 views

How to convert syslog to json in syslog server on freeBSD8.3 OS

I am using FreeBSD 8.3 and syslog server is running on it. now i have configured my syslog server to send logs to remote server by simply adding these lines in /etc/syslog.conf file ...
0
votes
1answer
82 views

Different log file per postfix instance

How can I set a custom log file for each postfix instance? Specifically, I need to identify entries generated for different instances of postfix, and would be better for the tooling if each instance ...
3
votes
2answers
239 views

Weird syslog order

Have you ever seen wrong order in /var/log/syslog ? I think that it causes only crontab. Jun 28 22:20:01 alex CRON[2327]: (root) CMD (something > /dev/null) Jun 28 22:21:01 alex CRON[2700]: (root) ...
1
vote
3answers
122 views

How to log multiline message with logger command?

I want to log a multiline message into the system logger via the commabnd echo -e "foo\nbar" | logger But it appear as 2 logs. Is it possible to log as a single log?
0
votes
0answers
139 views

RFC 5424 Syslog Viewer

I've been looking for a log viewer that understands syslog messages, specifically in RFC 5424 format (including structured data elements), and ideally allows live monitoring (tail like) and ...
-1
votes
1answer
187 views

Nginx Reverse Proxy Segfault on High Traffic

Recently my load balancer with Nginx rev proxy showing the following error messages on /var/log/dmesg: [6278902.558300] nginx[15683]: segfault at ffffffffffffffff ip 0000000000457b99 sp ...
0
votes
1answer
696 views

Nxlog Multiline Input to 1 Syslog Message

I am using nxlog to tail a custom log file on one of my Windows servers. Each entry in the text file looks similar to this. ...
3
votes
2answers
446 views

Postfix - searching emails (logstash, greylog or other solution)

We are currently having ~100 servers and all of them are using remote syslog, so we have aggregated all logs on one server. The most questioned problem from our support team is: Has an email from ...
1
vote
0answers
111 views

Receiving Apache access and error logs via rsyslog and possible catchall filter

I'm new to rsyslog and have been trying to figure out why I am not receiving any of my Apache and mysql logs which are configured on the client-side to sent via rsyslog. I am currently receiving all ...
1
vote
1answer
3k views

How do I configure rsyslog on Ubuntu 14.04 to use ISO8601 timestamps?

In a file in /etc/rsyslog.d/ I have the following: local3.* /var/log/mylog.log When I log to this facility, records have timestamps which look like this: Apr 27 21:12:20 hostname msg How ...
0
votes
0answers
66 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
1
vote
2answers
244 views

Rsyslog filter by client

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side. I added this line ...
0
votes
0answers
209 views

EventLog/Syslog to Common Event Format

I am looking for a way to get EventLog/Syslog to Common Event Format (CEF)? And also looking for a way to forward the CEF events through a Syslog-ng type of forwarder within the environment. I have ...
1
vote
1answer
102 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
2
votes
2answers
133 views

How to log remotely without syslog

I have a bunch of logs which are not created using syslog. I would like to export them to another host. If possible using syslog or rsyslog. A pipe? how can I do that?
0
votes
2answers
171 views

Not getting anything written to my log files in ubuntu

I am not getting any logs in auth.log, kern.log, syslog or any other log files on my 12.04 ubuntu server. There is also no rsyslog.conf if it should be there by default. rsyslogd is not running as ...
0
votes
1answer
244 views

Converting to rsyslog v7 new config format

I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy ...
0
votes
1answer
90 views

Syslog and LogAnalyzer - how to retrive source IPs and count them

I have set centralized Syslog (centOS + rsys) server which runs LogAnalyzer for better log presentation. Recently I have got asked to provide logs from the firewall of all IPs for particular firewall ...
1
vote
1answer
206 views

Logcheck alternative for central syslog server [closed]

I have to setup some open source log monitoring on a centralized syslog server. A lot of machines (windows, linux) and some routers and switches sending their logs there. Many years ago when I had to ...
1
vote
1answer
510 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
3
votes
1answer
226 views

Wheezy processes die periodically

I have a very weird problem. Certain processes on my mail server, but not all, die periodically (every second month or so). A few of the process that die are: ssh dovecot postfix Processes that ...