The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

learn more… | top users | synonyms

0
votes
1answer
43 views

Syslog-ng service hanging on restart

I've been a long time lurker of the site but this is my first question. So please let me know if there are any issues with my post. Two of the servers in our Ubuntu server farm (25+ machines) take a ...
0
votes
1answer
26 views

syslog-ng: Disable suppressing repeated messages

How can I disable last message repeated X times compression in syslog-ng? I use certain log messages as triggers and this effectively hides them. Defining suppress(0) doesn't do what I want.
8
votes
2answers
63 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
0
votes
1answer
56 views

Use syslog service to capture data logged to a file not managed by syslog?

Some services (nginx, buildbot, et cetera) only support logging to a file. Is there a way to reliably capture these log messages using syslog and friends, so that the log message can be reflected in ...
0
votes
0answers
54 views

How to forward Bro logs to Security Onion ELSA?

In my environment, I have one Bro IDS and one SecurityOnion running, I want to forward Bro logs to ELSA on SecurityOnion. I tried to configure syslog-ng on my Bro, and the configuration is like this: ...
0
votes
0answers
7 views

Filtering on syslog-ng from rsyslogd syslogtag

I have CentOS servers that are configured to send certain log files to a central log host, with each log being tagged vi the inputfiletag parameter. The client/sender configuration looks like this... ...
1
vote
1answer
18 views

Is it possible to use syslog-ng to forward logs to SecurityOnion ELSA?

I have installed Snort IDS and syslog-ng on my VM, and I want to use syslog-ng to forward my logs to another vm which is SecurityOnion. So I want to know can syslog-ng forward logs to ELSA which is in ...
1
vote
0answers
28 views

Syslog-ng and Stunnel between two hosts (Connection refused)

I'd like to setup syslog-ng over stunnel between a host on my LAN and a host in my DMZ but can't quite figure out the configuration. The stunnel config seems to be correct. If I shutdown syslog on ...
0
votes
0answers
19 views

syslog-ng module with restriction

I have a syslog-ng and I also have another log collector wherein all the auth logs with filter is forwarded. On those servers I have this configuration on /etc/rsyslog.d/my.conf :msg, contains, ...
1
vote
1answer
52 views

syslog-ng EC2 TLS

I am attempting to add TLS support to my syslog-ng service running on an AWS EC2 instance (logs are being sent to loggly). The basic configuration without TLS works, but when I replace the destination ...
0
votes
2answers
34 views

How to resolve ssh/sftp log data not getting picked up by syslog-ng in cywgin64?

I've installed ssh and syslog-ng through cygwin (V3.2) on a Windows Server 2012 and attempting to get log output out of sshd. I'm using the default /etc/syslog-ng/syslog-ng.conf file... @version: 3.2 ...
0
votes
1answer
37 views

Syslog-ng reverse dns lookup for data fields

I would like to try a reverse-dns before storing the firewall logs. I know this is possibile in logstash but i don't know if syslog-ng can be configured to do the same. Actually my logs coming from ...
1
vote
1answer
143 views

Example syslog-ng configuration to replicate rsyslog filename & locations?

ng 3.6.3 from source compilation on CentOS 6.6 64bit to play with and was wondering if anyone has pointers or example syslog-ng.conf that would as close as possible replicate the default rsyslog ...
0
votes
1answer
46 views

How to filter cron messages in syslog-ng

I have a litte problem. I dont know ho to filter cron jobs in syslog-ng. It's spamming my log. Jun 05 16:09:01 CRON: pam_unix(cron:session): session opened for user root by (uid=0) Jun 05 ...
2
votes
1answer
71 views

Is someone trying to hack into my VPS? [duplicate]

I was browsing my logs on papertail and I saw this. Jun 03 03:26:01 /USR/SBIN/CRON: (root) CMD (test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )) Jun 03 ...
0
votes
0answers
32 views

A string to be added at the begining of the IIS access log using nxlog

Nxlog forwards the IIS log files to the remote syslog server. Need to add a string mentioning "IIS" so that it can differentiate from other logs. There is replace option through which we can replace a ...
0
votes
0answers
69 views

How to log changes made in a particular file to syslog

How to log changes made in a particular file using syslog-ng. The log must contain the timestamp, hostname, user who modified the file and action performed. Is there any option other than audit in ...
1
vote
1answer
94 views

Why does syslog-ng drop debug messages when logging remote?

In the local log output, I can see debug messages but these won't show up on the remote logging server. It seems to ignore these but it does print warning and error level messages just fine. These ...
1
vote
1answer
258 views

How could I send the windows eventlog to the network logging of a linux server?

In Windows, I am using the "Eventlog to Syslog" utility to send event logs to the Linux syslog server (syslog-ng). But I am can't do the same with some log files, especially in the case of the IIS ...
2
votes
1answer
80 views

How are filters combined in syslog-ng

If I've got an entry in syslog-ng log { source (src); filter (filter1); filter (filter2); filter (filter3); filter (filter4); destination (all_log) } And, say filter4 is a very ...
0
votes
1answer
92 views

Syslog-ng and Logrotate creating sparse files

We've been using syslog-ng to log our postgres logs. On top of it we run logrotate every 5 minutes which also gzips the files. Recently, we've noted that these postgres logs contain a lot of null ...
0
votes
1answer
64 views

SFTP and syslog-ng custom logging format

I have modified sshd_config and syslog-ng configs to log sftp connections into separate files. Now I would like to create custom logging like: [date] [source_ip] has downloaded the [filename] [size] ...
0
votes
1answer
351 views

syslog-ng error on CentOS, works fine on other distributions

I want to add to a CentOS box (EL6) the same syslog-ng (3.2.5 from EPEL) configuration I have on other (Debian based) machines. It is intended to add events log in JSON to a single file for further ...
0
votes
0answers
22 views

multiple use of /dev/log in sources

I would like to distribute on several systems (via ansible) a conf file which makes use of /dev/log events. Since it is not possible to use /dev/log in several src, I need to reuse the one defined in ...
0
votes
1answer
273 views

How do I filter on tags in syslog-ng when they don't seem to be available by the time it processes it?

I am having a hard time debugging an issue and I think it may be two-fold - problems in two separate programs. The main issue is that I'm logging nginx to syslog on Ubuntu 14.04 like so: access_log ...
1
vote
2answers
362 views

Does syslog-ng config file support log rotating files every 15 mins?

I using syslog-ng config file destination configuration to create hourly log files. The config I'm using for this is as follows: destination d_hourly ...
0
votes
2answers
155 views

syslog-ng prepending date to received logs, breaking patterns in patterndb

I'm setting up central logging for our servers using syslog-ng + patterndb, however the logs the logging server is receiving from the client are prepended with the date, host and other data. This of ...
0
votes
1answer
208 views

Syslog-ng loghost - filter not-match

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong. It seems like filters are not working for ...
3
votes
1answer
343 views

How can I run a shell script on a snort alert?

I have snort listening to the SPAN port of a cisco switch. I'd like to be able to add an iptables DROP rule on my webserver for specific snort alerts but having a hard time finding out exactly how to ...
2
votes
2answers
56 views

How to collect logs for statistics in site?

I want to collect logs from nginx ( several servers, 1 000 000 lines in logs for minute for all servers ) to central stat server for statistics processing. I see 2 variants: write logs to local ...
0
votes
1answer
248 views

syslog-ng 3.5 flush_lines not working with smtp

What I want: automatic emails every time someone successfully logs into my Ubuntu 14.04 LTS server. /var/log/auth.log gets 2 lines written to it every time I login. Example: Jul 22 13:55:49 server ...
1
vote
2answers
232 views

syslog-ng fails to log on lxc host

we are running CentOS 6 servers with multiple lxc-containers. For system logging we are using syslog-ng. After a while the syslog-ng daemon stops logging messages, but the daemon keeps running. This ...
0
votes
1answer
852 views

Filter python messages with regex in syslog-ng

I have syslog-ng (v3.4.7) configured to catch almost all messages in their respective logs, but recently I've included some python scripts in crontab and their output just goes to messages or debug ...
1
vote
1answer
154 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
1
vote
0answers
269 views

capture Parse.com application logs with syslog-ng

I need to setup a log drain for an application running on Parse. My source looks like this: source s_parse { #internal(); program("/home/ubuntu/parse/tailparse.sh" ...
0
votes
1answer
265 views

nginx and apache2 conflict - 403 Forbidden

I am running nginx on my server, and by mistake I stared apache2 on the server. After doing that I have a 403 Forbidden error on my home page. I killed apache2 process, but I still facing the same ...
1
vote
2answers
877 views

Trying to convert syslog-ng to rsyslog

I'me trying to get nginx to log direct to piwik. I am having problems getting rsyslog to accecpt some syslog-ng syntax. The rsyslog doc says syslog-ng conf is compatible with it. source s_nginx_20 { ...
1
vote
0answers
454 views

Sending certain logs to a remote syslog-ng server

I am unable to send /var/log/audit/audit.log to remote server. I have tried below methods but no luck. After done below configuration am not able to restart the syslog-ng service. syslog-ng version ...
1
vote
1answer
1k views

Forwarding from rsyslog to syslog-ng over TCP not working (although packets are reaching server)

We use syslog-ng on our central syslog server (syslog-ng-2.1.4-9.el5 on CentOS 5.9). We were happily sending logs using syslogd and rsyslog from a mixture of Linux and Solaris hosts over UDP until ...
4
votes
0answers
301 views

How do you use patterndb variables in syslog-ng?

I'd like to parse some custom (network appliance) syslog files to create my own formatted output. As I am new to syslog-ng & patterndb I have been trying to build an example using the ...
4
votes
1answer
204 views

How is “kernel.*” syslog spoofing prevented?

I'm finding instances of syslog-ng writing out garbage followed by a blank kernel.emerg line in one of our production environments. Example of one: Dec 21 00:14:56 someserver [syslog-ng.err] Error ...
1
vote
0answers
201 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages ...
0
votes
1answer
883 views

Syslog-ng how to get domain names instead of IP address

How can syslog-ng get the domain names instead of IP address that I received? I'm able to get those information but in IP address, I would like to get the DST/HOST to domain names instead of getting ...
1
vote
1answer
914 views

sending json based messages using syslog-ng and amqp

How do you properly format json messages and send them over amqp with syslog-ng? The json format should look something like this. {"log":"This is the error message...", "date":"xxx", "source":"xxx"} ...
2
votes
1answer
2k views

Forwarding rsyslog to syslog-ng, with FQDN and facility separation

I'm attempting to configure my rsyslog clients to forward messages to my syslog-ng log repository systems. Forwarding messages works "out of the box", but my clients are logging short names, not ...
1
vote
1answer
2k views

Excluding some messages from syslog-ng

I'm trying to exclude some messages from being logged by syslog-ng, such as this LDAP log entry: Sep 18 15:18:34 myserver slapd[9682]: conn=1043 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text= ...
0
votes
1answer
322 views

Syslog-ng Events Per Second Graphing

I have a distributed syslog-ng setup and am trying to determine how many events per second (EPS) we are receiving on each one. I know that syslog-ng does some general performance statistic to ...
0
votes
1answer
61 views

Log Review Process

Currently I have a fairly large syslog-ng cluster setup that is my main log aggregation point. I have the need to be able to acknowledge certain logs and mark them as review for auditing purposes. ...
1
vote
1answer
581 views

Amazon EC2 Servers with syslog-ng communication

I have 3 Amazon EC instances with ubuntu 12.04 Production Server (LAMP Server w/o MYSQL, syslog-ng client) Development Server (LAMP w/ MYSQL, syslog-ng client) Logging Server (syslog-ng Server) I ...
2
votes
1answer
1k views

Error setting capabilities, capability management disabled;

root@monitor:/opt/observium# service syslog-ng restart Stopping system logging: syslog-ng. Starting system logging: syslog-ngsyslog-ng: Error setting capabilities, capability management disabled; ...