The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

learn more… | top users | synonyms

0
votes
0answers
21 views

syslog-ng 3.5 flush_lines not working with smtp

What I want: automatic emails every time someone successfully logs into my Ubuntu 14.04 LTS server. /var/log/auth.log gets 2 lines written to it every time I login. Example: Jul 22 13:55:49 server ...
1
vote
2answers
67 views

syslog-ng fails to log on lxc host

we are running CentOS 6 servers with multiple lxc-containers. For system logging we are using syslog-ng. After a while the syslog-ng daemon stops logging messages, but the daemon keeps running. This ...
0
votes
0answers
21 views

Corrupted syslog files shows as binary

We currently use syslog-ng to agregate log messages from multiple application spread accross our infrastructure. This works fine most of the time. However, from time to time a given log file will be ...
0
votes
1answer
187 views

Filter python messages with regex in syslog-ng

I have syslog-ng (v3.4.7) configured to catch almost all messages in their respective logs, but recently I've included some python scripts in crontab and their output just goes to messages or debug ...
0
votes
0answers
124 views

EventLog/Syslog to Common Event Format

I am looking for a way to get EventLog/Syslog to Common Event Format (CEF)? And also looking for a way to forward the CEF events through a Syslog-ng type of forwarder within the environment. I have ...
1
vote
1answer
62 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
1
vote
0answers
80 views

capture Parse.com application logs with syslog-ng

I need to setup a log drain for an application running on Parse. My source looks like this: source s_parse { #internal(); program("/home/ubuntu/parse/tailparse.sh" ...
0
votes
1answer
62 views

nginx and apache2 conflict - 403 Forbidden

I am running nginx on my server, and by mistake I stared apache2 on the server. After doing that I have a 403 Forbidden error on my home page. I killed apache2 process, but I still facing the same ...
1
vote
2answers
296 views

Trying to convert syslog-ng to rsyslog

I'me trying to get nginx to log direct to piwik. I am having problems getting rsyslog to accecpt some syslog-ng syntax. The rsyslog doc says syslog-ng conf is compatible with it. source s_nginx_20 { ...
1
vote
0answers
79 views

Sending certain logs to a remote syslog-ng server

I am unable to send /var/log/audit/audit.log to remote server. I have tried below methods but no luck. After done below configuration am not able to restart the syslog-ng service. syslog-ng version ...
0
votes
1answer
195 views

Forwarding from rsyslog to syslog-ng over TCP not working (although packets are reaching server)

We use syslog-ng on our central syslog server (syslog-ng-2.1.4-9.el5 on CentOS 5.9). We were happily sending logs using syslogd and rsyslog from a mixture of Linux and Solaris hosts over UDP until ...
0
votes
0answers
19 views

How to change the default template in syslog-ng

Is it possible to change the default template for all destinations in syslog-ng? I know that I can declare a template: template t_tmpl { template("$ISODATE $MSGHDR$MSG\n"); }; and then reference ...
2
votes
0answers
97 views

How do you use patterndb variables in syslog-ng?

I'd like to parse some custom (network appliance) syslog files to create my own formatted output. As I am new to syslog-ng & patterndb I have been trying to build an example using the ...
4
votes
1answer
89 views

How is “kernel.*” syslog spoofing prevented?

I'm finding instances of syslog-ng writing out garbage followed by a blank kernel.emerg line in one of our production environments. Example of one: Dec 21 00:14:56 someserver [syslog-ng.err] Error ...
2
votes
0answers
67 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages ...
0
votes
1answer
132 views

Syslog-ng how to get domain names instead of IP address

How can syslog-ng get the domain names instead of IP address that I received? I'm able to get those information but in IP address, I would like to get the DST/HOST to domain names instead of getting ...
1
vote
1answer
409 views

sending json based messages using syslog-ng and amqp

How do you properly format json messages and send them over amqp with syslog-ng? The json format should look something like this. {"log":"This is the error message...", "date":"xxx", "source":"xxx"} ...
0
votes
0answers
159 views

Multiple syslog-ng destination loghosts

I am currently forwarding logs to one remote destination loghost. filter f_windows { program("Security-Audit*"); }; log { source(r_sys); filter(f_windows); destination(d_windows); }; log { ...
2
votes
1answer
623 views

Forwarding rsyslog to syslog-ng, with FQDN and facility separation

I'm attempting to configure my rsyslog clients to forward messages to my syslog-ng log repository systems. Forwarding messages works "out of the box", but my clients are logging short names, not ...
1
vote
1answer
531 views

Excluding some messages from syslog-ng

I'm trying to exclude some messages from being logged by syslog-ng, such as this LDAP log entry: Sep 18 15:18:34 myserver slapd[9682]: conn=1043 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text= ...
0
votes
1answer
134 views

Syslog-ng Events Per Second Graphing

I have a distributed syslog-ng setup and am trying to determine how many events per second (EPS) we are receiving on each one. I know that syslog-ng does some general performance statistic to ...
0
votes
1answer
53 views

Log Review Process

Currently I have a fairly large syslog-ng cluster setup that is my main log aggregation point. I have the need to be able to acknowledge certain logs and mark them as review for auditing purposes. ...
1
vote
1answer
260 views

Amazon EC2 Servers with syslog-ng communication

I have 3 Amazon EC instances with ubuntu 12.04 Production Server (LAMP Server w/o MYSQL, syslog-ng client) Development Server (LAMP w/ MYSQL, syslog-ng client) Logging Server (syslog-ng Server) I ...
1
vote
1answer
298 views

Error setting capabilities, capability management disabled;

root@monitor:/opt/observium# service syslog-ng restart Stopping system logging: syslog-ng. Starting system logging: syslog-ngsyslog-ng: Error setting capabilities, capability management disabled; ...
0
votes
2answers
343 views

Syslog-ng Load Balancing

I am working on setting up a syslog-ng server to accept logs from various sources. The general setup is going to be: Device1 Device2 Syslog1 Device3 --> Load ...
0
votes
0answers
91 views

Syslog-ng Hostnames

I am currently filtering logs to a CentOS 6.3 syslog-ng server. Below is my basic syslog-ng config. options { use_fqdn(yes); use_dns(yes); dns_cache_hosts(/etc/hosts); ...
1
vote
2answers
1k views

rsyslog Text File Input Module error

I'm using: root@u1210: /etc () # lsb_release -d Description: Ubuntu 12.10 root@u1210: /etc () # dpkg -l | grep rsyslog ii rsyslog 5.8.6-1ubuntu9 ...
0
votes
2answers
318 views

syslog-ng unable to capture syslog from ASA

My syslog-ng.conf: @version: 3.0 # Default configuration file for syslog-ng. # # For a description of syslog-ng configuration file directives, please read # the syslog-ng Administrator's guide at: # ...
1
vote
0answers
100 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
1answer
61 views

Syslog-ng log template \\011 character

I have a problem with syslog-ng. I want to make syslog-ng to format the logs like below: template("$YEAR-$MONTH-$DAY\\011$HOUR:$MIN:$SEC\\011$HOST\\011$MSGHDR$MSGONLY\n") But it logs without the ...
1
vote
0answers
771 views

syslog-ng and nginx logs to mysql

So couple of days ago I asked how to log php and nginx logs to centralized MySQL database, and m0ntassar gave a perfect answer :) cheer ! The problem I am facing now is that I can not seem to get it ...
0
votes
1answer
624 views

Invalid Parameter on node puppet

I am getting an error of err: Could not retrieve catalog from remote server: Error 400 on SERVER: Invalid parameter port at /etc/puppet/manifests/nodes/node.pp:652 on node test-puppet My puppet ...
2
votes
2answers
143 views

Puppet language configuration file editing

I am trying to create a puppet recipe for a log server and client using syslog-ng. I know I can have custom configuration files using template erb files and replace certain variables in the erb files. ...
3
votes
2answers
663 views

How to redirect third party logs to log server in Centos

I want to setup a simple log server to accept logs from all clients. I am not talking about standard system logs such as /var/log/mail , message, boot etc. I want to redirect or send application logs ...
2
votes
1answer
309 views

Linux logger doesn't write tags to log files?

I have a problem with logger command. After upgrading syslog-ng to 3.3th version (maybe it is not directly depend on it), logger (using command below) doesn't log tag names: logger -t "BLABLA" ...
3
votes
8answers
535 views

How best to monitor and alert on the absence of an event in the logs?

With logs getting captured in syslog-ng, I'd like to be able to automatically monitor the logs and receive an alert if NO log events appear that match a certain criteria. For instance, for a ...
0
votes
0answers
376 views

Reverse tunnelling with “stunnel” in linux

Scenario: Central Log-Server(say logserv)- only private IP interfaces Multiple client servers (logclient)- has public IPs. Requirement: Need to tcp logs of syslog application from logclient to ...
3
votes
2answers
1k views

Avoiding log noise from cron jobs - with syslog-ng rather than syslog

On my small Debian squeeze web server, I have syslog-ng installed (not syslogd, like in this question). Generally, my logs are nice and quiet, with -- MARK -- lines. My /var/log/syslog, however, ...
0
votes
1answer
400 views

installing syslog-ng

i have a monitoring server with nagios,cacti and nedi on Debian Squeeze. when i try to install syslog-ng via apt-get i get the errors see below. i think that there is a problem with the sym-links in ...
2
votes
2answers
282 views

Syslog-ng 3.0 %95CPU usage?

I am using syslog-ng 3.0 in my machines. There is one machine, which gets logs from other three machines. But lately, when I use top to monitor cpu usage (in the main one), I see syslog-ng uses ...
0
votes
1answer
81 views

Syslog-ng prepends <[0-9]+> to my messages

I'm writing some parsing logic for syslog-ng messages and am noticing that for many of the commands syslog-ng prepends a <[0-9]+> string to most of my messages. Here is an example from me ...
0
votes
1answer
1k views

/var/log/messages spammed with POLLERR messages

I've started seeing /var/log/messages growing in size indefinitely with these lines: Aug 1 12:47:27 linux-jblp syslog-ng[1947]: POLLERR occurred while idle; fd='16' Process 1947 is this: root ...
0
votes
2answers
59 views

Almost-live copy of log from one server to another

We have an authentication daemon on a Debian 6.0 box generating logs at a rate of about 4-6 lines\entries every second. For legal reasons this log file has to be written to disk locally first, before ...
0
votes
1answer
231 views

syslog-ng show errors every time start

everyone! After i install syslog-ng in my freebsd9.1 and use it for my log systerm. Every time i start it there display an error: Error opening plugin module; module='afuser', ...
1
vote
2answers
842 views

Squid logging to syslog-ng - program name has brackets

Using Ubuntu 10.04.4 LTS and Squid3 I want to log to syslog-ng Edited /etc/squid3/squid.conf and added the following line: access_log syslog squid Logs are being written but the program name ...
0
votes
1answer
566 views

Syslog-ng duplicate log lines

I have a very annoying situation concerning apache access/error logs on a remote log server. Webserver: Stock apache logging with: ErrorLog "|/usr/bin/logger -p local7.err -t www.sitename.com" ...
0
votes
1answer
606 views

Configuring 'audit' facility in syslog-ng on solaris server?

This is a follow-up to this question. mghocke was kind enough to help me out with that question, but this is really a separate question, therefor a new post. I really don't know a lot about syslog, ...
2
votes
1answer
568 views

Moving from syslog.conf to syslogng.conf

I'm moving a Solaris box from syslogd to syslog-ng, because the Solaris version of syslogd obliterates the original source hostname on the logs. I'm looking through the syslogng.conf documentation, ...
2
votes
1answer
144 views

Capture only certain logs with syslong-NG

I'm new to Syslog-ng. sofar I deployed it and it is running fine pushing some logs to MongoDB. Now, what I really want to do is push some logs (e.g. /var/log/secure) to MongoDb while pushing some ...
1
vote
1answer
165 views

Can I create a new syslog-ng file() source and tell syslog-ng to ignore existing data and process only new data

I have a large amount of existing data stored in files on a NAS (stored in hierarchical date-based directories, not that I think that matters). These directories are still being written to. I have ...