The syslog-ng tag has no wiki summary.
0
votes
1answer
27 views
Syslog-ng Load Balancing
I am working on setting up a syslog-ng server to accept logs from various sources. The general setup is going to be:
Device1
Device2 Syslog1
Device3 --> Load ...
0
votes
0answers
33 views
Syslog-ng Hostnames
I am currently filtering logs to a CentOS 6.3 syslog-ng server. Below is my basic syslog-ng config.
options {
use_fqdn(yes);
use_dns(yes);
dns_cache_hosts(/etc/hosts);
...
0
votes
2answers
123 views
rsyslog Text File Input Module error
I'm using:
root@u1210: /etc () # lsb_release -d
Description: Ubuntu 12.10
root@u1210: /etc () # dpkg -l | grep rsyslog
ii rsyslog 5.8.6-1ubuntu9 ...
0
votes
2answers
93 views
syslog-ng unable to capture syslog from ASA
My syslog-ng.conf:
@version: 3.0
# Default configuration file for syslog-ng.
#
# For a description of syslog-ng configuration file directives, please read
# the syslog-ng Administrator's guide at:
#
...
1
vote
0answers
57 views
Writing templates for rsyslog
When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
1answer
41 views
Syslog-ng log template \\011 character
I have a problem with syslog-ng. I want to make syslog-ng to format the logs like below:
template("$YEAR-$MONTH-$DAY\\011$HOUR:$MIN:$SEC\\011$HOST\\011$MSGHDR$MSGONLY\n")
But it logs without the ...
1
vote
0answers
298 views
syslog-ng and nginx logs to mysql
So couple of days ago I asked
how to log php and nginx logs to centralized MySQL database, and m0ntassar gave a perfect answer :) cheer !
The problem I am facing now is that I can not seem to get it ...
0
votes
1answer
204 views
Invalid Parameter on node puppet
I am getting an error of err: Could not retrieve catalog from remote server: Error 400 on SERVER: Invalid parameter port at /etc/puppet/manifests/nodes/node.pp:652 on node test-puppet
My puppet ...
2
votes
1answer
80 views
Puppet language configuration file editing
I am trying to create a puppet recipe for a log server and client using syslog-ng. I know I can have custom configuration files using template erb files and replace certain variables in the erb files. ...
3
votes
2answers
423 views
How to redirect third party logs to log server in Centos
I want to setup a simple log server to accept logs from all clients. I am not talking about standard system logs such as /var/log/mail , message, boot etc. I want to redirect or send application logs ...
2
votes
1answer
163 views
Linux logger doesn't write tags to log files?
I have a problem with logger command. After upgrading syslog-ng to 3.3th version (maybe it is not directly depend on it), logger (using command below) doesn't log tag names:
logger -t "BLABLA" ...
3
votes
8answers
250 views
How best to monitor and alert on the absence of an event in the logs?
With logs getting captured in syslog-ng, I'd like to be able to automatically monitor the logs and receive an alert if NO log events appear that match a certain criteria. For instance, for a ...
0
votes
0answers
163 views
Reverse tunnelling with “stunnel” in linux
Scenario:
Central Log-Server(say logserv)- only private IP interfaces
Multiple client servers (logclient)- has public IPs.
Requirement:
Need to tcp logs of syslog application from logclient to ...
3
votes
1answer
384 views
Avoiding log noise from cron jobs - with syslog-ng rather than syslog
On my small Debian squeeze web server, I have syslog-ng installed (not syslogd, like in this question). Generally, my logs are nice and quiet, with nice
-- MARK --
lines. My /var/log/syslog, ...
0
votes
1answer
220 views
installing syslog-ng
i have a monitoring server with nagios,cacti and nedi on Debian Squeeze. when i try to install syslog-ng via apt-get i get the errors see below. i think that there is a problem with the sym-links in ...
1
vote
2answers
98 views
Syslog-ng 3.0 %95CPU usage?
I am using syslog-ng 3.0 in my machines. There is one machine, which gets logs from other three machines. But lately, when I use top to monitor cpu usage (in the main one), I see syslog-ng uses ...
0
votes
1answer
61 views
Syslog-ng prepends <[0-9]+> to my messages
I'm writing some parsing logic for syslog-ng messages and am noticing that for many of the commands syslog-ng prepends a <[0-9]+> string to most of my messages.
Here is an example from me ...
0
votes
1answer
425 views
/var/log/messages spammed with POLLERR messages
I've started seeing /var/log/messages growing in size indefinitely with these lines:
Aug 1 12:47:27 linux-jblp syslog-ng[1947]: POLLERR occurred while idle; fd='16'
Process 1947 is this:
root ...
0
votes
2answers
45 views
Almost-live copy of log from one server to another
We have an authentication daemon on a Debian 6.0 box generating logs at a rate of about 4-6 lines\entries every second. For legal reasons this log file has to be written to disk locally first, before ...
0
votes
1answer
137 views
syslog-ng show errors every time start
everyone! After i install syslog-ng in my freebsd9.1 and use it for my log systerm. Every time i start it there display an error:
Error opening plugin module; module='afuser', ...
1
vote
2answers
503 views
Squid logging to syslog-ng - program name has brackets
Using Ubuntu 10.04.4 LTS and Squid3 I want to log to syslog-ng
Edited /etc/squid3/squid.conf and added the following line:
access_log syslog squid
Logs are being written but the program name ...
0
votes
1answer
249 views
Syslog-ng duplicate log lines
I have a very annoying situation concerning apache access/error logs on a remote log server.
Webserver:
Stock apache logging with:
ErrorLog "|/usr/bin/logger -p local7.err -t www.sitename.com"
...
0
votes
1answer
205 views
Configuring 'audit' facility in syslog-ng on solaris server?
This is a follow-up to this question. mghocke was kind enough to help me out with that question, but this is really a separate question, therefor a new post.
I really don't know a lot about syslog, ...
2
votes
1answer
316 views
Moving from syslog.conf to syslogng.conf
I'm moving a Solaris box from syslogd to syslog-ng, because the Solaris version of syslogd obliterates the original source hostname on the logs. I'm looking through the syslogng.conf documentation, ...
2
votes
1answer
117 views
Capture only certain logs with syslong-NG
I'm new to Syslog-ng. sofar I deployed it and it is running fine pushing some logs to MongoDB. Now, what I really want to do is push some logs (e.g. /var/log/secure) to MongoDb while pushing some ...
1
vote
1answer
116 views
Can I create a new syslog-ng file() source and tell syslog-ng to ignore existing data and process only new data
I have a large amount of existing data stored in files on a NAS (stored in hierarchical date-based directories, not that I think that matters). These directories are still being written to.
I have ...
3
votes
1answer
674 views
Can a hostname be added to syslog-ng?
How can syslog-ng be configured to send both the hostname and the IP address. Currently, logs are sent with the IP address of the device/machine, but we want to add the hostname so I could keep my ip ...
0
votes
1answer
383 views
syslog-ng not flushing the pipe to external program (SOLVED)
I have written a python script that takes log entries from syslog-ng and writes them to MongoDB (I couldn't do it with afmongodb driver because I need to do some special processing).
This is how it ...
1
vote
2answers
235 views
syslog-ng mongodb plugin configuration
I am using syslog-ng's mongodb plugin and it works great, but I can't find a way to customize the format of the saved log entries ("DATE", "FACILITY",...). Does anyone know how to do this?
All ...
2
votes
2answers
469 views
iptables logging to diferent file via syslog-ng
I have the following configuration in my iptables and syslog files:
IPTABLES
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m ...
1
vote
2answers
1k views
Syslog-ng: how to change a message before sending to a remote host
I'm using syslog-ng 1.6.8 on SLES 10. From this machine, I need to forward all events to the remote host 10.30.38.115. But preliminary I have to change messages a little bit, adding "MyMark" prefix to ...
1
vote
0answers
54 views
how to filter syslog messages by interfaced received
with a server assigned two interfaces, .234 and .235, how can I create a filter separating the incoming messages ?
This configuration, only outputs to one folder
---- list interfaces ----
eth0:234 ...
1
vote
1answer
223 views
using syslog-ng and patterndb, how do I specify an “empty” ruleset pattern?
In a similar vein to my previous question regarding syslog-ng's patterndb patterns to match an empty description, I am now trying to match "--MARK--" messages. The messages look like this:
-- MARK --
...
0
votes
2answers
307 views
log forwarding performance and OS bottleneck
How many logs/second can usually be handled by syslog servers? By syslog servers, I am referring to rsyslog, syslog-ng, splunk etc. The intent of the question is to find out at what logs/second rate ...
2
votes
1answer
210 views
using syslog-ng and patterndb, how do I specify an “empty” pattern?
When I receive kernel traces in my logs, the last line is empty. I'd like to filter/ignore these empty kernel messages using syslog-ng and patterndb. Here is the pattern I have so far that is not ...
3
votes
1answer
168 views
Zensyslog Clear Events
I've hooked up Zenoss' Zensyslog so that messages from a distributed list of client machines are all conglomerated into events on the Zenoss server. This is all fantastic, and I can bump messages by ...
3
votes
3answers
498 views
How to collect logs with syslog-ng from www servers in dmz and send them to server behind firewall(NAT). Can Zabbix proxy solve this?
I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like
WWW server in DMZ ----> monitor server in LAN.
I can connect DMZ from my ...
0
votes
1answer
103 views
Syslog-ng fulls disk with recursive logs
i have some problem with syslog-ng, i've configured a server wich recive logs from different remotes devices.
My syslog-ng demon is configured for swap logs in a file based pipe, a different process ...
3
votes
2answers
2k views
An alternative to /usr/bin/logger for getting logs from Apache to syslog-ng
We currently use logger to get our Apache access logs to syslog-ng with a line like this one in each vhost:
CustomLog "|/usr/bin/logger -p local1.info -t www_main" combined
It seems that almost ...
1
vote
1answer
190 views
Why is syslog-ng randomly change the logging file from messages to messages.yyyymmddhhmm?
Sometimes syslog-ng will change from logging to the file messages to filename with timestamp appended like this messages.yyyymmddhhmm. Of course this then breaks anything I have that is reviewing ...
2
votes
2answers
142 views
Managing and configuring syslog-ng for very large logs
I have the logs traditionally kept in /var/log/ piped through syslog-ng. The logs can reach to the terabyte size on a daily basis. In order to make them more manageable. I would like break them out ...
0
votes
1answer
79 views
Syslog-ng not sending to fifo when template directive is used
Ok, so i need syslog to log to a fifo with a specific template for the log in mind.
So I set my destination as follows...
destination d_pipe { pipe("/var/run/some_pipe.fifo"); };
This works fine ...
3
votes
1answer
172 views
syslog-ng: Switch logs on demand
How can I tell syslog-ng that I would like to switch the logfiles.
I'm looking for a command or signal to tell syslog-ng to perform a logswitch. A search of the documentation and FAQ did not come up ...
5
votes
1answer
466 views
Permission denied when opening file as root with mode 777
I'm attempting to install and run syslog-ng but I'm blocked with the following error.
Error opening configuration file; filename='/etc/syslog-ng/syslog-ng.conf', error='Permission denied (13)'
I'm ...
1
vote
2answers
220 views
SyslogNG message format
I am reading through some syslog-ng documentation, and in the section about filter functions, it says that the program() filter matches...
...messages by using a regular expression against the ...
0
votes
1answer
160 views
Set alternate log file for iptables with syslog-ng
Does anyone know how to set an alternate logging file for iptables with syslog-ng on Ubuntu Server?
0
votes
1answer
171 views
Filter out a facility in syslog-ng
Following are the some contents of my /etc/syslog-ng/syslog-ng.confrelated to logging in to the file debug.log
source s_sys {
file ("/proc/kmsg" log_prefix("kernel: "));
unix-stream ...
3
votes
3answers
1k views
Filtering bad requests from Apache -> logger -> rsyslog to syslog-ng on a remote logging server possible?
EDIT: Thanks for the help
Here is a quick idea of the setup:
webserver X
In apache httpd.conf:
LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vcombined
CustomLog ...
0
votes
1answer
189 views
Time jump in syslog-ng log files
I am running my proprietary application (the name of which I would prefer not to disclose) in Linux 2.6 kernel, running on PowerPC (P2020) in an embedded environment. I am using syslog-ng to collect ...
3
votes
2answers
435 views
Getting syslog-ng to recognize a java stacktrace
We are using the log4j SyslogAppender to send our logging statements to syslog-ng. Once the messages are in syslog-ng, we are having trouble getting syslog-ng to recognize that a stacktrace goes with ...
