syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

0
votes
1answer
59 views
+100

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
0
votes
0answers
16 views

Getting journald to send email on certain events

I found these solutions for syslogd that send emails on certain events like local0.crit or local1.err How can I make syslogd email certain log messages to me? ...
0
votes
1answer
39 views

“NTP socket is in use” messages from ntpdate in syslog

In cron.log I can see that ntpdate is being triggered from a cron job which is running daily at 23:15 Mar 10 23:15:01 seitan /USR/SBIN/CRON[22407]: (root) CMD (/etc/network/if-up.d/ntpdate) But ...
0
votes
0answers
23 views

Segfault in libcurl.so.4.2.0 in syslog?

My syslog is being filled with entries declaring a segfault in libcurl.so.4.2.0: Mar 6 09:48:58 myserver kernel: crond[19450]: segfault at 7f46cfefbc3d ip 00007f46cff17f7d sp 00007fff79c939d8 ...
0
votes
0answers
24 views

How do I get auditd to push messages to a remote syslog server on Centos 6.6?

I'm a Windows guy trying to help a friend out. We need to get file auditing data off the Centos 6.6 server to a central syslog server. I found the auditd service and the audisp plugin. I edited the ...
0
votes
1answer
75 views

ESX performance stats in Logstash

Dose anyone know if it is possible to collect ESX Performance Stats in LogStash/ELK stack? looking to see if I can collect ESXTOP data for use in the ELK stack.
3
votes
1answer
37 views

How to configure Monit to alert me when anything appears in syslog

I want Monit to alert me if ANYTHING shows up in syslog - as anything in there would be abnormal. I've tried the following and I'm not receiving any alert emails when I manually add something to ...
0
votes
0answers
18 views

rsyslogd and FQDN - cannot get FQDN from clients

I setup a syslogserver with rsyslogd and 3 clients. Logs from 3 test clients are sent to the server, so far so good. My Problem is: I can't get the FQDN hostnames to work. According to rsyslog.com ...
0
votes
1answer
47 views

How to replace control characters in rsyslog

we have several (usually java) application and they log to centralized rsyslog server (version 7.6). We had problems with java exceptions as rsyslog was handling each line of stack trace as separate ...
0
votes
1answer
43 views

How do I filter on tags in syslog-ng when they don't seem to be available by the time it processes it?

I am having a hard time debugging an issue and I think it may be two-fold - problems in two separate programs. The main issue is that I'm logging nginx to syslog on Ubuntu 14.04 like so: access_log ...
0
votes
0answers
64 views

Send apache ssl access log to syslog

I'm having an issue piping apache ssl access logs to my syslog server. I've added the following line to my apache config: CustomLog "|/usr/bin/nc -u <syslogserver> 514" "<134>%{%b %d ...
0
votes
1answer
245 views

nginx logs to syslog - connection refused

I'm trying to setup nginx 1.7.3 to send logs to syslog, but when I this configuration: server { access_log syslog:server=localhost; } this shows up in nginx's error log: 2015/01/15 21:42:47 ...
0
votes
0answers
29 views

Syslog randomly logs bad time [duplicate]

Try as I might, I can't figure out why this server randomly timestamps syslog entries with bad time. Here's a 5-minute stretch of syslog from a few minutes ago. You'll notice there are two places ...
-1
votes
1answer
40 views

File monitoring using syslog [closed]

Can rsyslog, syslog-ng programs monitor change of file? I want to monitor files and receive the changes made to the file by syslog on server. Thank you.
2
votes
2answers
106 views

How does one manually rotate log without logrotate on open/live file?

My Google-Fu is getting me so close but just not quite there, and I guess I'm too green in Linux to put the pieces together. I have a very large >200GB log file, still being written to. Logrotate ...
-1
votes
1answer
66 views

Determine timezone in Rsyslog file

I would like to determine what time zone a specific log is in. I found this line in the log: Aug 29 07:07:40 gw kernel: rtc_cmos rtc_cmos: setting system clock to 2013-08-29 11:07:08 UTC(1377774428) ...
0
votes
0answers
54 views

Suspicious web activitin in nginx logs

I'm seeing some strange entries in my NGINX logs: 2.71.139.98 - - [26/Dec/2014:12:36:24 +0000] ...
0
votes
2answers
62 views

syslog-ng prepending date to received logs, breaking patterns in patterndb

I'm setting up central logging for our servers using syslog-ng + patterndb, however the logs the logging server is receiving from the client are prepended with the date, host and other data. This of ...
2
votes
1answer
242 views

UDP Traffic from outside to docker container is dropped after container restart

following situation: i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4 I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to ...
0
votes
1answer
77 views

Syslog-ng loghost - filter not-match

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong. It seems like filters are not working for ...
2
votes
2answers
36 views

How to collect logs for statistics in site?

I want to collect logs from nginx ( several servers, 1 000 000 lines in logs for minute for all servers ) to central stat server for statistics processing. I see 2 variants: write logs to local ...
0
votes
1answer
230 views

DNS format error in syslog, how to debug?

I'm getting an error in my syslog when resolving a domain I also the DNS for. Nov 24 21:51:55 moo named[4075]: DNS format error from 192.227.143.105#53 resolving bostonyoungentrepreneurs.com/NS for ...
12
votes
1answer
144 views

How do I make sec ignore a timestamp properly

I have a rule that is set up like so; In /etc/sec/rules.d I have; type=SingleWithSuppress ptype=regexp pattern=(\S+) sshd\[\d+\]: PAM \d+ more authentication failures\; logname=.* uid=.* euid=.* ...
0
votes
2answers
654 views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
0
votes
1answer
112 views

Server crash with ascii NUL characters in syslog ( ^@^@^@… )

I have some dedicated server hosted by a OVH (French service provider). OS : Ubuntu 12.04 x64 A few months ago, one of my server crashed. The only weird thing was some "ASCII NUL" caracters in the ...
0
votes
1answer
339 views

How can I suppress Postfix anvil statistics from system logs?

After every email sent through my mail server, postfix/anvil appends something like the following: Nov 9 15:09:11 keutenberg postfix/anvil[30006]: statistics: max connection rate 1/60s for ...
0
votes
1answer
601 views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
0
votes
1answer
37 views

Logging only written on old [filename].1 log files

My log is not written on the correct log file for example syslog, mail.log, mysql.log, auth.log but for some reason the latest event are written on these old log files syslog.1, auth.log.1, mail.log.1 ...
3
votes
1answer
171 views

Random SSH entries in Auth.log out of date order [duplicate]

Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue. Some ...
0
votes
1answer
301 views

SSH Failed password login - log password

today I checked the log of my sshd and I have discovered tons of lines like :Oct 12 Oct 12 12:31:34 my_user sshd[15324]: Failed password for invalid user admin from 104.194.25.135 port 2683 ssh2 ...
1
vote
2answers
165 views

Syslog does not record logs received over TCP to a file

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over ...
-5
votes
2answers
160 views

server hacked - cron continue to run [duplicate]

Someone accessed my EC2 Ubuntu 14.04 and installed some malicious cron to do port scanning with user eric. I removed user eric and the file executed, but in syslog I see Sep 19 15:27:01 ip-xxx ...
0
votes
0answers
78 views

No syslog using Kiwi 9.4 (free) directly connected on the inside of a Cisco ASA 5505 running a VPN

I have a number of remote branches (each with an IPSec site to site configuration. The main station has a Cisco 5510, the branches are each a Cisco ASA 5505. Works fine. I recently installed the paid ...
0
votes
1answer
61 views

Cisco CGS2520 switch to reveal MAC address when port goes active?

Is there a way to have a Cisco switch reveal the MAC address of a device via Syslog when it is plugged in? I get messages that a device is connected, but there isn't a lot of detail: Sep 9 12:50:51 ...
0
votes
0answers
38 views

Input filtering in rsyslog 5?

I have some messages hitting my rsyslogd server which a network trace shows as: <5>1 2014-09-04T14:58:31Z HOSTNAME This=a message=that contains=some specially=formatted data= This is ...
0
votes
1answer
32 views

Understanding ntpd entry in syslog

Does anyone know what this entry in syslog means: static1 ntpd[2397]: 2a00:xxxx:xxxx:239::2 interface 2a01:xxxx::xxxx:xxxx:fe70:a40c -> (null) (I've replaced some of the values with xxxx) Thank ...
2
votes
0answers
355 views

Separating java stdout and stderr with systemd and without filling journal

I am running java apps via systemd: [Unit] Description=test service [Service] Type=simple EnvironmentFile=/etc/sysconfig/testserver WorkingDirectory=/opt/testserver ExecStart=/usr/bin/java -jar ...
1
vote
1answer
27 views

TCP rsyslogd events showing up as 2000 character continuations

I'm taking syslog events from a proprietary app. This could be the app's fault or it could be rsyslogd. Events are written like: Aug 15 16:00:00 10.11.12.13 Event1 from this wonderful product using ...
2
votes
2answers
65 views

Using (r)syslog's dynamic file generation

I am in the middle of configuring a (r)syslog server as a remote server that receives logs from various clients. I wonder whether there is a nicer way to dynamically generate multiple file names as ...
1
vote
2answers
41 views

Segmenting syslog logs and access to those logs

I'm trying to figure out if what I'm trying to accomplish is possible or not. What I want is to have all my devices send logs to a syslog server, then have Splunk pull logs for everything EXCEPT my ...
3
votes
1answer
370 views

Difference between /dev/udp and netcat

I have a syslog server listening on localhost:514 as UDP and would like to write messages to it on that port. (Using Ubuntu 14.04) If I run either of these commands this from bash it prints the date ...
1
vote
1answer
891 views

How to prevent syslog message popping in a ssh session without affect other sessions?

i have a machine(RHEL 5.2) which receives syslog message from remote machines. And now it keeps popping message from remote machine in a ssh shell, which is annoying when i want to do something on it. ...
0
votes
1answer
78 views

(rsyslog) Forwarding a specific log only

I've been trying to configure rsyslog to forward /var/log/syslog to a remote server. I was able to do this using the below configuration. $InputFileName /var/log/secure $InputFileTag hostname-secure ...
-2
votes
1answer
65 views

How to convert syslog to json in syslog server on freeBSD8.3 OS

I am using FreeBSD 8.3 and syslog server is running on it. now i have configured my syslog server to send logs to remote server by simply adding these lines in /etc/syslog.conf file ...
0
votes
1answer
115 views

Different log file per postfix instance

How can I set a custom log file for each postfix instance? Specifically, I need to identify entries generated for different instances of postfix, and would be better for the tooling if each instance ...
4
votes
2answers
425 views

Weird syslog order

Have you ever seen wrong order in /var/log/syslog ? I think that it causes only crontab. Jun 28 22:20:01 alex CRON[2327]: (root) CMD (something > /dev/null) Jun 28 22:21:01 alex CRON[2700]: (root) ...
1
vote
3answers
206 views

How to log multiline message with logger command?

I want to log a multiline message into the system logger via the commabnd echo -e "foo\nbar" | logger But it appear as 2 logs. Is it possible to log as a single log?
0
votes
0answers
164 views

RFC 5424 Syslog Viewer

I've been looking for a log viewer that understands syslog messages, specifically in RFC 5424 format (including structured data elements), and ideally allows live monitoring (tail like) and ...
-1
votes
1answer
247 views

Nginx Reverse Proxy Segfault on High Traffic

Recently my load balancer with Nginx rev proxy showing the following error messages on /var/log/dmesg: [6278902.558300] nginx[15683]: segfault at ffffffffffffffff ip 0000000000457b99 sp ...
0
votes
1answer
1k views

Nxlog Multiline Input to 1 Syslog Message

I am using nxlog to tail a custom log file on one of my Windows servers. Each entry in the text file looks similar to this. ...