The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

learn more… | top users | synonyms

1
vote
1answer
4k views

Excluding some messages from syslog-ng

I'm trying to exclude some messages from being logged by syslog-ng, such as this LDAP log entry: Sep 18 15:18:34 myserver slapd[9682]: conn=1043 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text= I'...
1
vote
1answer
668 views

Amazon EC2 Servers with syslog-ng communication

I have 3 Amazon EC instances with ubuntu 12.04 Production Server (LAMP Server w/o MYSQL, syslog-ng client) Development Server (LAMP w/ MYSQL, syslog-ng client) Logging Server (syslog-ng Server) I ...
1
vote
2answers
2k views

Squid logging to syslog-ng - program name has brackets

Using Ubuntu 10.04.4 LTS and Squid3 I want to log to syslog-ng Edited /etc/squid3/squid.conf and added the following line: access_log syslog squid Logs are being written but the program name "...
1
vote
1answer
299 views

Can I create a new syslog-ng file() source and tell syslog-ng to ignore existing data and process only new data

I have a large amount of existing data stored in files on a NAS (stored in hierarchical date-based directories, not that I think that matters). These directories are still being written to. I have ...
1
vote
1answer
237 views

Why is syslog-ng randomly change the logging file from messages to messages.yyyymmddhhmm?

Sometimes syslog-ng will change from logging to the file messages to filename with timestamp appended like this messages.yyyymmddhhmm. Of course this then breaks anything I have that is reviewing ...
1
vote
1answer
171 views

Log “date -s” command

I know that the date -s <STRING> command sets the time described by the string STRING. What i want is to log the above command whenever it is used to set the time into the file /tmp/log/user....
1
vote
0answers
231 views

Syslog-ng and Stunnel between two hosts (Connection refused)

I'd like to setup syslog-ng over stunnel between a host on my LAN and a host in my DMZ but can't quite figure out the configuration. The stunnel config seems to be correct. If I shutdown syslog on ...
1
vote
1answer
247 views

Example syslog-ng configuration to replicate rsyslog filename & locations?

ng 3.6.3 from source compilation on CentOS 6.6 64bit to play with and was wondering if anyone has pointers or example syslog-ng.conf that would as close as possible replicate the default rsyslog ...
1
vote
1answer
246 views

Why does syslog-ng drop debug messages when logging remote?

In the local log output, I can see debug messages but these won't show up on the remote logging server. It seems to ignore these but it does print warning and error level messages just fine. These ...
1
vote
1answer
344 views

syslog-ng fails to log on lxc host

we are running CentOS 6 servers with multiple lxc-containers. For system logging we are using syslog-ng. After a while the syslog-ng daemon stops logging messages, but the daemon keeps running. This ...
1
vote
0answers
360 views

capture Parse.com application logs with syslog-ng

I need to setup a log drain for an application running on Parse. My source looks like this: source s_parse { #internal(); program("/home/ubuntu/parse/tailparse.sh" ...
1
vote
0answers
640 views

Sending certain logs to a remote syslog-ng server

I am unable to send /var/log/audit/audit.log to remote server. I have tried below methods but no luck. After done below configuration am not able to restart the syslog-ng service. syslog-ng version ...
1
vote
0answers
282 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages -rw----...
1
vote
0answers
144 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
1answer
87 views

Syslog-ng log template \\011 character

I have a problem with syslog-ng. I want to make syslog-ng to format the logs like below: template("$YEAR-$MONTH-$DAY\\011$HOUR:$MIN:$SEC\\011$HOST\\011$MSGHDR$MSGONLY\n") But it logs without the "\"...
1
vote
2answers
5k views

Syslog-ng: how to change a message before sending to a remote host

I'm using syslog-ng 1.6.8 on SLES 10. From this machine, I need to forward all events to the remote host 10.30.38.115. But preliminary I have to change messages a little bit, adding "MyMark" prefix to ...
1
vote
0answers
77 views

how to filter syslog messages by interfaced received

with a server assigned two interfaces, .234 and .235, how can I create a filter separating the incoming messages ? This configuration, only outputs to one folder ---- list interfaces ---- eth0:234 -...
1
vote
2answers
440 views

Syslog - capturing event logs from Win2k boxes

I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist. We have a central syslog server and we want it to capture event log events from Windows ...
0
votes
1answer
2k views

Configuring 'audit' facility in syslog-ng on solaris server?

This is a follow-up to this question. mghocke was kind enough to help me out with that question, but this is really a separate question, therefor a new post. I really don't know a lot about syslog, ...
0
votes
2answers
1k views

syslog-ng unable to capture syslog from ASA

My syslog-ng.conf: @version: 3.0 # Default configuration file for syslog-ng. # # For a description of syslog-ng configuration file directives, please read # the syslog-ng Administrator's guide at: # #...
0
votes
1answer
106 views

Syslog-ng prepends <[0-9]+> to my messages

I'm writing some parsing logic for syslog-ng messages and am noticing that for many of the commands syslog-ng prepends a <[0-9]+> string to most of my messages. Here is an example from me ...
0
votes
2answers
151 views

Almost-live copy of log from one server to another

We have an authentication daemon on a Debian 6.0 box generating logs at a rate of about 4-6 lines\entries every second. For legal reasons this log file has to be written to disk locally first, before ...
0
votes
1answer
2k views

Syslog-ng duplicate log lines

I have a very annoying situation concerning apache access/error logs on a remote log server. Webserver: Stock apache logging with: ErrorLog "|/usr/bin/logger -p local7.err -t www.sitename.com" ...
0
votes
1answer
2k views

syslog-ng not flushing the pipe to external program

I have written a python script that takes log entries from syslog-ng and writes them to MongoDB (I couldn't do it with afmongodb driver because I need to do some special processing). This is how it ...
0
votes
1answer
2k views

Remote logging for multiple Apache virtual hosts using syslog-ng

I'm running a couple Apache web servers that each have 4-8 separate virtual hosts on each of them. I'm trying to setup a dedicated log server that stores each virtual host access and errors logs in a ...
0
votes
1answer
279 views

syslog-ng: Disable suppressing repeated messages

How can I disable last message repeated X times compression in syslog-ng? I use certain log messages as triggers and this effectively hides them. Defining suppress(0) doesn't do what I want.
0
votes
1answer
148 views

SFTP and syslog-ng custom logging format

I have modified sshd_config and syslog-ng configs to log sftp connections into separate files. Now I would like to create custom logging like: [date] [source_ip] has downloaded the [filename] [size] ...
0
votes
1answer
379 views

nginx and apache2 conflict - 403 Forbidden

I am running nginx on my server, and by mistake I stared apache2 on the server. After doing that I have a 403 Forbidden error on my home page. I killed apache2 process, but I still facing the same ...
0
votes
1answer
64 views

Log Review Process

Currently I have a fairly large syslog-ng cluster setup that is my main log aggregation point. I have the need to be able to acknowledge certain logs and mark them as review for auditing purposes. ...
0
votes
1answer
1k views

Invalid Parameter on node puppet

I am getting an error of err: Could not retrieve catalog from remote server: Error 400 on SERVER: Invalid parameter port at /etc/puppet/manifests/nodes/node.pp:652 on node test-puppet My puppet class:...
0
votes
1answer
616 views

installing syslog-ng

i have a monitoring server with nagios,cacti and nedi on Debian Squeeze. when i try to install syslog-ng via apt-get i get the errors see below. i think that there is a problem with the sym-links in ...
0
votes
1answer
323 views

syslog-ng show errors every time start

everyone! After i install syslog-ng in my freebsd9.1 and use it for my log systerm. Every time i start it there display an error: Error opening plugin module; module='afuser', error='/usr/local/lib/...
0
votes
1answer
244 views

Syslog-ng fulls disk with recursive logs

i have some problem with syslog-ng, i've configured a server wich recive logs from different remotes devices. My syslog-ng demon is configured for swap logs in a file based pipe, a different process ...
0
votes
1answer
245 views

Set alternate log file for iptables with syslog-ng

Does anyone know how to set an alternate logging file for iptables with syslog-ng on Ubuntu Server?
0
votes
1answer
460 views

Filter out a facility in syslog-ng

Following are the some contents of my /etc/syslog-ng/syslog-ng.confrelated to logging in to the file debug.log source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/...
0
votes
1answer
167 views

Open Source syslog-ng RPM for SLES

Can anyone point me to an Open source syslog-ng RPM package for SLES 11 (x86, 64-bit)?
0
votes
1answer
2k views

Syslog-ng log format

I am using a centralised syslog-ng loghost to collect logs and syslog-ng on some of the clients. On one particular client, running syslog-ng on Devil Linux, syslog entries are sent ( confirmed with ...
0
votes
1answer
1k views

how do you convert this syslog-ng cfg to rsyslog?

How do I convert the following to rsyslog syntax? filter local2 { facility(local2); }; filter not_local2 { not facility(local2); }; destination server2 { tcp("server2" port(1111)); }; ...
0
votes
1answer
23 views

cygwin64 on Windows server, syslog data prints out all in one line

I am trying to automatically format syslog data from cygwin64 to print out with line breaks at the end of each line, so I can do some parsing later on. However, I don't see any configs that could ...
0
votes
0answers
45 views

Syslog-ng "Error binding socket; addr='AF_INET($CLIENT)', error ='Cannot assign requested address (99)' Error initializing message pipeline;

I'm pretty new to syslog-ng, however after doing some research, found that it would be a good fit for the current project I am working on. Essentially all that I need to do is send syslog messages ...
0
votes
1answer
26 views

Reading syslog-ng logs being sent to a remote server

I have a Docker container which is sending syslog logs to logentries.com. This is working fine, but for times when logentries is down or delayed, I want a way to read logs generated in realtime inside ...
0
votes
1answer
120 views

syslog-ng working as foreground process but not as daemon

I'm working to implement syslog-ng OSE in my environment. Eventually I'd like to setup a central logging server, but in order to get my feet wet, I'm starting with a simple configuration. I've ...
0
votes
1answer
86 views

Referencing journald fields when forwarding messages to syslog-ng

How can I change my syslog-ng template so that when the log originates from a systemd service / unit, the log message will include the unit's name? Using ${PROGRAM} just shows the name of the ...
0
votes
1answer
171 views

Send tomcat logs with syslog-ng in Ubuntu Linux

I am trying to setup syslog-ng to send tomcat logs (as well as all the other system logs) to a log server but it doesn't seem to be working, this is the line I have: destination d_tomcat { file("/opt/...
0
votes
2answers
150 views

syslog-ng “log_msg_size” maximum possible value

I read from syslog-ng doc and forums that log_msg_size to defaults to 8192. What is the possible maximum limit of this parameter? My application supports either syslog-ng or rsyslog depending upon ...
0
votes
1answer
109 views

Will Syslog-ng recreate syslog-ng.persist file if deleted?

I am running syslog-ng pe 4 lts on Centos 6. Syslog is recursing a local directory of web logs and moving them to a NAS. We are seeing that some old log lines are showing up on the NAS for current ...
0
votes
1answer
27 views

syslog clipping for particular applications

I have a few particular applications that are causing a LOT of logs in my syslog server. I would like to keep all of their logging in /var/log/messages or somewhere on the server, but I am trying to ...
0
votes
1answer
14 views

How to check for platform within syslog-ng configuration?

I run syslog-ng on several platforms with the default /etc/syslog-ng/syslog-ng.conf, as well as an independent /etc/syslog-ng/conf.d/myconfig.conf In that specifc configuration I would like to reuse ...
0
votes
1answer
258 views

How to write logs in JSON format?

I want to centralize logging on my servers using syslog-ng which will write a JSON-formatted line to a file, which in turn will be picked up by logstash, which will forward it to elasticsearch. This ...
0
votes
1answer
162 views

Syslog-ng service hanging on restart

I've been a long time lurker of the site but this is my first question. So please let me know if there are any issues with my post. Two of the servers in our Ubuntu server farm (25+ machines) take a ...