The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

learn more… | top users | synonyms

1
vote
2answers
1k views

Squid logging to syslog-ng - program name has brackets

Using Ubuntu 10.04.4 LTS and Squid3 I want to log to syslog-ng Edited /etc/squid3/squid.conf and added the following line: access_log syslog squid Logs are being written but the program name ...
0
votes
1answer
816 views

Syslog-ng duplicate log lines

I have a very annoying situation concerning apache access/error logs on a remote log server. Webserver: Stock apache logging with: ErrorLog "|/usr/bin/logger -p local7.err -t www.sitename.com" ...
0
votes
1answer
839 views

Configuring 'audit' facility in syslog-ng on solaris server?

This is a follow-up to this question. mghocke was kind enough to help me out with that question, but this is really a separate question, therefor a new post. I really don't know a lot about syslog, ...
2
votes
1answer
685 views

Moving from syslog.conf to syslogng.conf

I'm moving a Solaris box from syslogd to syslog-ng, because the Solaris version of syslogd obliterates the original source hostname on the logs. I'm looking through the syslogng.conf documentation, ...
3
votes
3answers
5k views

Software to send windows notification eventlogs to linux syslog server and encode to utf8

I am trying to setup a windows 2008 server so it's able to send the eventlog messages to an syslog-ng server running linux. I'd prefer something native but I guess it won't be possible. UPDATE The ...
2
votes
1answer
148 views

Capture only certain logs with syslong-NG

I'm new to Syslog-ng. sofar I deployed it and it is running fine pushing some logs to MongoDB. Now, what I really want to do is push some logs (e.g. /var/log/secure) to MongoDb while pushing some ...
1
vote
1answer
187 views

Can I create a new syslog-ng file() source and tell syslog-ng to ignore existing data and process only new data

I have a large amount of existing data stored in files on a NAS (stored in hierarchical date-based directories, not that I think that matters). These directories are still being written to. I have ...
2
votes
2answers
1k views

iptables logging to diferent file via syslog-ng

I have the following configuration in my iptables and syslog files: IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m ...
2
votes
2answers
485 views

syslog-ng mongodb plugin configuration

I am using syslog-ng's mongodb plugin and it works great, but I can't find a way to customize the format of the saved log entries ("DATE", "FACILITY",...). Does anyone know how to do this? All ...
0
votes
1answer
1k views

syslog-ng not flushing the pipe to external program (SOLVED)

I have written a python script that takes log entries from syslog-ng and writes them to MongoDB (I couldn't do it with afmongodb driver because I need to do some special processing). This is how it ...
1
vote
2answers
3k views

Syslog-ng: how to change a message before sending to a remote host

I'm using syslog-ng 1.6.8 on SLES 10. From this machine, I need to forward all events to the remote host 10.30.38.115. But preliminary I have to change messages a little bit, adding "MyMark" prefix to ...
1
vote
0answers
69 views

how to filter syslog messages by interfaced received

with a server assigned two interfaces, .234 and .235, how can I create a filter separating the incoming messages ? This configuration, only outputs to one folder ---- list interfaces ---- eth0:234 ...
1
vote
1answer
341 views

using syslog-ng and patterndb, how do I specify an “empty” ruleset pattern?

In a similar vein to my previous question regarding syslog-ng's patterndb patterns to match an empty description, I am now trying to match "--MARK--" messages. The messages look like this: -- MARK -- ...
2
votes
1answer
270 views

using syslog-ng and patterndb, how do I specify an “empty” pattern?

When I receive kernel traces in my logs, the last line is empty. I'd like to filter/ignore these empty kernel messages using syslog-ng and patterndb. Here is the pattern I have so far that is not ...
0
votes
2answers
387 views

log forwarding performance and OS bottleneck

How many logs/second can usually be handled by syslog servers? By syslog servers, I am referring to rsyslog, syslog-ng, splunk etc. The intent of the question is to find out at what logs/second rate ...
3
votes
3answers
909 views

How to collect logs with syslog-ng from www servers in dmz and send them to server behind firewall(NAT). Can Zabbix proxy solve this?

I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like WWW server in DMZ ----> monitor server in LAN. I can connect DMZ from my ...
0
votes
1answer
191 views

Syslog-ng fulls disk with recursive logs

i have some problem with syslog-ng, i've configured a server wich recive logs from different remotes devices. My syslog-ng demon is configured for swap logs in a file based pipe, a different process ...
3
votes
2answers
4k views

An alternative to /usr/bin/logger for getting logs from Apache to syslog-ng

We currently use logger to get our Apache access logs to syslog-ng with a line like this one in each vhost: CustomLog "|/usr/bin/logger -p local1.info -t www_main" combined It seems that almost ...
1
vote
1answer
221 views

Why is syslog-ng randomly change the logging file from messages to messages.yyyymmddhhmm?

Sometimes syslog-ng will change from logging to the file messages to filename with timestamp appended like this messages.yyyymmddhhmm. Of course this then breaks anything I have that is reviewing ...
2
votes
2answers
191 views

Managing and configuring syslog-ng for very large logs

I have the logs traditionally kept in /var/log/ piped through syslog-ng. The logs can reach to the terabyte size on a daily basis. In order to make them more manageable. I would like break them out ...
0
votes
1answer
94 views

Syslog-ng not sending to fifo when template directive is used

Ok, so i need syslog to log to a fifo with a specific template for the log in mind. So I set my destination as follows... destination d_pipe { pipe("/var/run/some_pipe.fifo"); }; This works fine ...
3
votes
1answer
318 views

syslog-ng: Switch logs on demand

How can I tell syslog-ng that I would like to switch the logfiles. I'm looking for a command or signal to tell syslog-ng to perform a logswitch. A search of the documentation and FAQ did not come up ...
6
votes
1answer
988 views

Permission denied when opening file as root with mode 777

I'm attempting to install and run syslog-ng but I'm blocked with the following error. Error opening configuration file; filename='/etc/syslog-ng/syslog-ng.conf', error='Permission denied (13)' I'm ...
0
votes
1answer
227 views

Set alternate log file for iptables with syslog-ng

Does anyone know how to set an alternate logging file for iptables with syslog-ng on Ubuntu Server?
0
votes
1answer
304 views

Filter out a facility in syslog-ng

Following are the some contents of my /etc/syslog-ng/syslog-ng.confrelated to logging in to the file debug.log source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ...
0
votes
1answer
260 views

Time jump in syslog-ng log files

I am running my proprietary application (the name of which I would prefer not to disclose) in Linux 2.6 kernel, running on PowerPC (P2020) in an embedded environment. I am using syslog-ng to collect ...
0
votes
1answer
142 views

Open Source syslog-ng RPM for SLES

Can anyone point me to an Open source syslog-ng RPM package for SLES 11 (x86, 64-bit)?
1
vote
2answers
388 views

Syslog - capturing event logs from Win2k boxes

I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist. We have a central syslog server and we want it to capture event log events from Windows ...
0
votes
1answer
2k views

Remote logging for multiple Apache virtual hosts using syslog-ng

I'm running a couple Apache web servers that each have 4-8 separate virtual hosts on each of them. I'm trying to setup a dedicated log server that stores each virtual host access and errors logs in a ...
1
vote
1answer
157 views

Log “date -s” command

I know that the date -s <STRING> command sets the time described by the string STRING. What i want is to log the above command whenever it is used to set the time into the file ...
6
votes
2answers
4k views

syslog-ng on Solaris 10 (how to install and configure)

If anyone has got syslog-ng working on Solaris 10, do you have a set of instructions I could follow to get it installed and working? I tried following this ...
0
votes
1answer
1k views

Syslog-ng log format

I am using a centralised syslog-ng loghost to collect logs and syslog-ng on some of the clients. On one particular client, running syslog-ng on Devil Linux, syslog entries are sent ( confirmed with ...
0
votes
1answer
847 views

how do you convert this syslog-ng cfg to rsyslog?

How do I convert the following to rsyslog syntax? filter local2 { facility(local2); }; filter not_local2 { not facility(local2); }; destination server2 { tcp("server2" port(1111)); }; ...
4
votes
3answers
3k views

Syslog-ng: how to log severity/facility?

Here is the system: SUSE Linux Enterprise Server 10 syslog-ng with predefined syslog-ng.conf messages in /var/log/messages look like: Feb 8 09:29:53 sles1 sshd[17529]: Accepted ...
2
votes
0answers
639 views

How does syslog-ng handles flush_lines(0)?

I wanted to make sure my syslog-ng was doing async logging. Reading through the documentation I see the flush_lines() option for file() destinations, if unspecified, will use the global default. Then ...
1
vote
2answers
490 views

Is there a reason to use /dev/lognull instead of /dev/null when logging with syslog-ng?

At my office I recently wondered aloud to all, "Why shouldn't these logs be redirected to /dev/null instead of /dev/lognull?" I was told that there is (or was) a reason, but no one could remember it. ...