The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
885 views

syslog-ng not flushing the pipe to external program (SOLVED)

I have written a python script that takes log entries from syslog-ng and writes them to MongoDB (I couldn't do it with afmongodb driver because I need to do some special processing). This is how it ...
2
votes
2answers
414 views

syslog-ng mongodb plugin configuration

I am using syslog-ng's mongodb plugin and it works great, but I can't find a way to customize the format of the saved log entries ("DATE", "FACILITY",...). Does anyone know how to do this? All ...
2
votes
2answers
1k views

iptables logging to diferent file via syslog-ng

I have the following configuration in my iptables and syslog files: IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m ...
1
vote
2answers
3k views

Syslog-ng: how to change a message before sending to a remote host

I'm using syslog-ng 1.6.8 on SLES 10. From this machine, I need to forward all events to the remote host 10.30.38.115. But preliminary I have to change messages a little bit, adding "MyMark" prefix to ...
1
vote
0answers
62 views

how to filter syslog messages by interfaced received

with a server assigned two interfaces, .234 and .235, how can I create a filter separating the incoming messages ? This configuration, only outputs to one folder ---- list interfaces ---- eth0:234 ...
1
vote
1answer
308 views

using syslog-ng and patterndb, how do I specify an “empty” ruleset pattern?

In a similar vein to my previous question regarding syslog-ng's patterndb patterns to match an empty description, I am now trying to match "--MARK--" messages. The messages look like this: -- MARK -- ...
0
votes
2answers
371 views

log forwarding performance and OS bottleneck

How many logs/second can usually be handled by syslog servers? By syslog servers, I am referring to rsyslog, syslog-ng, splunk etc. The intent of the question is to find out at what logs/second rate ...
2
votes
1answer
248 views

using syslog-ng and patterndb, how do I specify an “empty” pattern?

When I receive kernel traces in my logs, the last line is empty. I'd like to filter/ignore these empty kernel messages using syslog-ng and patterndb. Here is the pattern I have so far that is not ...
3
votes
1answer
225 views

Zensyslog Clear Events

I've hooked up Zenoss' Zensyslog so that messages from a distributed list of client machines are all conglomerated into events on the Zenoss server. This is all fantastic, and I can bump messages by ...
3
votes
3answers
768 views

How to collect logs with syslog-ng from www servers in dmz and send them to server behind firewall(NAT). Can Zabbix proxy solve this?

I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like WWW server in DMZ ----> monitor server in LAN. I can connect DMZ from my ...
0
votes
1answer
157 views

Syslog-ng fulls disk with recursive logs

i have some problem with syslog-ng, i've configured a server wich recive logs from different remotes devices. My syslog-ng demon is configured for swap logs in a file based pipe, a different process ...
3
votes
2answers
3k views

An alternative to /usr/bin/logger for getting logs from Apache to syslog-ng

We currently use logger to get our Apache access logs to syslog-ng with a line like this one in each vhost: CustomLog "|/usr/bin/logger -p local1.info -t www_main" combined It seems that almost ...
1
vote
1answer
217 views

Why is syslog-ng randomly change the logging file from messages to messages.yyyymmddhhmm?

Sometimes syslog-ng will change from logging to the file messages to filename with timestamp appended like this messages.yyyymmddhhmm. Of course this then breaks anything I have that is reviewing ...
2
votes
2answers
181 views

Managing and configuring syslog-ng for very large logs

I have the logs traditionally kept in /var/log/ piped through syslog-ng. The logs can reach to the terabyte size on a daily basis. In order to make them more manageable. I would like break them out ...
0
votes
1answer
91 views

Syslog-ng not sending to fifo when template directive is used

Ok, so i need syslog to log to a fifo with a specific template for the log in mind. So I set my destination as follows... destination d_pipe { pipe("/var/run/some_pipe.fifo"); }; This works fine ...
3
votes
1answer
269 views

syslog-ng: Switch logs on demand

How can I tell syslog-ng that I would like to switch the logfiles. I'm looking for a command or signal to tell syslog-ng to perform a logswitch. A search of the documentation and FAQ did not come up ...
5
votes
1answer
775 views

Permission denied when opening file as root with mode 777

I'm attempting to install and run syslog-ng but I'm blocked with the following error. Error opening configuration file; filename='/etc/syslog-ng/syslog-ng.conf', error='Permission denied (13)' I'm ...
1
vote
2answers
428 views

SyslogNG message format

I am reading through some syslog-ng documentation, and in the section about filter functions, it says that the program() filter matches... ...messages by using a regular expression against the ...
0
votes
1answer
219 views

Set alternate log file for iptables with syslog-ng

Does anyone know how to set an alternate logging file for iptables with syslog-ng on Ubuntu Server?
0
votes
1answer
263 views

Filter out a facility in syslog-ng

Following are the some contents of my /etc/syslog-ng/syslog-ng.confrelated to logging in to the file debug.log source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ...
3
votes
3answers
2k views

Filtering bad requests from Apache -> logger -> rsyslog to syslog-ng on a remote logging server possible?

EDIT: Thanks for the help Here is a quick idea of the setup: webserver X In apache httpd.conf: LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vcombined CustomLog ...
0
votes
1answer
241 views

Time jump in syslog-ng log files

I am running my proprietary application (the name of which I would prefer not to disclose) in Linux 2.6 kernel, running on PowerPC (P2020) in an embedded environment. I am using syslog-ng to collect ...
3
votes
2answers
574 views

Getting syslog-ng to recognize a java stacktrace

We are using the log4j SyslogAppender to send our logging statements to syslog-ng. Once the messages are in syslog-ng, we are having trouble getting syslog-ng to recognize that a stacktrace goes with ...
0
votes
1answer
136 views

Open Source syslog-ng RPM for SLES

Can anyone point me to an Open source syslog-ng RPM package for SLES 11 (x86, 64-bit)?
3
votes
3answers
4k views

Software to send windows notification eventlogs to linux syslog server and encode to utf8

I am trying to setup a windows 2008 server so it's able to send the eventlog messages to an syslog-ng server running linux. I'd prefer something native but I guess it won't be possible. UPDATE The ...
1
vote
1answer
157 views

Log “date -s” command

I know that the date -s <STRING> command sets the time described by the string STRING. What i want is to log the above command whenever it is used to set the time into the file ...
0
votes
1answer
1k views

Remote logging for multiple Apache virtual hosts using syslog-ng

I'm running a couple Apache web servers that each have 4-8 separate virtual hosts on each of them. I'm trying to setup a dedicated log server that stores each virtual host access and errors logs in a ...
0
votes
1answer
1k views

Syslog-ng log format

I am using a centralised syslog-ng loghost to collect logs and syslog-ng on some of the clients. On one particular client, running syslog-ng on Devil Linux, syslog entries are sent ( confirmed with ...
1
vote
2answers
376 views

Syslog - capturing event logs from Win2k boxes

I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist. We have a central syslog server and we want it to capture event log events from Windows ...
0
votes
1answer
782 views

how do you convert this syslog-ng cfg to rsyslog?

How do I convert the following to rsyslog syntax? filter local2 { facility(local2); }; filter not_local2 { not facility(local2); }; destination server2 { tcp("server2" port(1111)); }; ...
2
votes
0answers
590 views

How does syslog-ng handles flush_lines(0)?

I wanted to make sure my syslog-ng was doing async logging. Reading through the documentation I see the flush_lines() option for file() destinations, if unspecified, will use the global default. Then ...
4
votes
3answers
2k views

Syslog-ng: how to log severity/facility?

Here is the system: SUSE Linux Enterprise Server 10 syslog-ng with predefined syslog-ng.conf messages in /var/log/messages look like: Feb 8 09:29:53 sles1 sshd[17529]: Accepted ...
6
votes
2answers
4k views

syslog-ng on Solaris 10 (how to install and configure)

If anyone has got syslog-ng working on Solaris 10, do you have a set of instructions I could follow to get it installed and working? I tried following this ...
1
vote
2answers
433 views

Is there a reason to use /dev/lognull instead of /dev/null when logging with syslog-ng?

At my office I recently wondered aloud to all, "Why shouldn't these logs be redirected to /dev/null instead of /dev/lognull?" I was told that there is (or was) a reason, but no one could remember it. ...