The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

learn more… | top users | synonyms

0
votes
1answer
23 views

cygwin64 on Windows server, syslog data prints out all in one line

I am trying to automatically format syslog data from cygwin64 to print out with line breaks at the end of each line, so I can do some parsing later on. However, I don't see any configs that could ...
-1
votes
1answer
25 views

syslog-ng logs storing with hostname year date

I have syslog-ng on Ubuntu 12.4 to store mikrotik router logs. At a moment its working fine and log gets stored in a file i set. Howto add store logs in a file/folder according to source IP so that ...
0
votes
0answers
45 views

Syslog-ng "Error binding socket; addr='AF_INET($CLIENT)', error ='Cannot assign requested address (99)' Error initializing message pipeline;

I'm pretty new to syslog-ng, however after doing some research, found that it would be a good fit for the current project I am working on. Essentially all that I need to do is send syslog messages ...
0
votes
1answer
1k views

Syslog-ng how to get domain names instead of IP address

How can syslog-ng get the domain names instead of IP address that I received? I'm able to get those information but in IP address, I would like to get the DST/HOST to domain names instead of getting ...
1
vote
1answer
32 views

syslog-ng doesn't parse messages

I'm trying to set up syslog-ng to properly parse RFC5424-compilant messages, thus far, with little success. According to the syslog-ng documentation, The syslog-ng OSE application can ...
3
votes
3answers
6k views

An alternative to /usr/bin/logger for getting logs from Apache to syslog-ng

We currently use logger to get our Apache access logs to syslog-ng with a line like this one in each vhost: CustomLog "|/usr/bin/logger -p local1.info -t www_main" combined It seems that almost ...
0
votes
1answer
120 views

syslog-ng working as foreground process but not as daemon

I'm working to implement syslog-ng OSE in my environment. Eventually I'd like to setup a central logging server, but in order to get my feet wet, I'm starting with a simple configuration. I've ...
0
votes
1answer
26 views

Reading syslog-ng logs being sent to a remote server

I have a Docker container which is sending syslog logs to logentries.com. This is working fine, but for times when logentries is down or delayed, I want a way to read logs generated in realtime inside ...
0
votes
1answer
84 views

Referencing journald fields when forwarding messages to syslog-ng

How can I change my syslog-ng template so that when the log originates from a systemd service / unit, the log message will include the unit's name? Using ${PROGRAM} just shows the name of the ...
0
votes
1answer
171 views

Send tomcat logs with syslog-ng in Ubuntu Linux

I am trying to setup syslog-ng to send tomcat logs (as well as all the other system logs) to a log server but it doesn't seem to be working, this is the line I have: destination d_tomcat { file("/opt/...
1
vote
1answer
115 views

How to format log data before forwarding them as JSON to elasticsearch?

I log all events on a system to a JSON file via syslog-ng: destination d_json { file("/var/log/all_syslog_in_json.log" perm(0666) template("{\"@timestamp\": \"$ISODATE\", \"facility\": \"$FACILITY\", ...
0
votes
2answers
150 views

syslog-ng “log_msg_size” maximum possible value

I read from syslog-ng doc and forums that log_msg_size to defaults to 8192. What is the possible maximum limit of this parameter? My application supports either syslog-ng or rsyslog depending upon ...
0
votes
1answer
108 views

Will Syslog-ng recreate syslog-ng.persist file if deleted?

I am running syslog-ng pe 4 lts on Centos 6. Syslog is recursing a local directory of web logs and moving them to a NAS. We are seeing that some old log lines are showing up on the NAS for current ...
0
votes
1answer
27 views

syslog clipping for particular applications

I have a few particular applications that are causing a LOT of logs in my syslog server. I would like to keep all of their logging in /var/log/messages or somewhere on the server, but I am trying to ...
0
votes
1answer
14 views

How to check for platform within syslog-ng configuration?

I run syslog-ng on several platforms with the default /etc/syslog-ng/syslog-ng.conf, as well as an independent /etc/syslog-ng/conf.d/myconfig.conf In that specifc configuration I would like to reuse ...
0
votes
1answer
258 views

How to write logs in JSON format?

I want to centralize logging on my servers using syslog-ng which will write a JSON-formatted line to a file, which in turn will be picked up by logstash, which will forward it to elasticsearch. This ...
1
vote
1answer
160 views

Syslog-ng with mysql destination - increase log retention

I have this dusty syslog-ng 3.1.3 that writes to a database and all is working well however it seems to keep only 30 days of logs (last table is logs20150826) How can I increase that? I see nothing ...
3
votes
2answers
455 views

Zensyslog Clear Events

I've hooked up Zenoss' Zensyslog so that messages from a distributed list of client machines are all conglomerated into events on the Zenoss server. This is all fantastic, and I can bump messages by ...
0
votes
1answer
162 views

Syslog-ng service hanging on restart

I've been a long time lurker of the site but this is my first question. So please let me know if there are any issues with my post. Two of the servers in our Ubuntu server farm (25+ machines) take a ...
8
votes
2answers
89 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
0
votes
1answer
278 views

syslog-ng: Disable suppressing repeated messages

How can I disable last message repeated X times compression in syslog-ng? I use certain log messages as triggers and this effectively hides them. Defining suppress(0) doesn't do what I want.
0
votes
1answer
86 views

Use syslog service to capture data logged to a file not managed by syslog?

Some services (nginx, buildbot, et cetera) only support logging to a file. Is there a way to reliably capture these log messages using syslog and friends, so that the log message can be reflected in ...
0
votes
0answers
623 views

How to forward Bro logs to Security Onion ELSA?

In my environment, I have one Bro IDS and one SecurityOnion running, I want to forward Bro logs to ELSA on SecurityOnion. I tried to configure syslog-ng on my Bro, and the configuration is like this: ...
0
votes
0answers
31 views

Filtering on syslog-ng from rsyslogd syslogtag

I have CentOS servers that are configured to send certain log files to a central log host, with each log being tagged vi the inputfiletag parameter. The client/sender configuration looks like this... ...
1
vote
1answer
63 views

Is it possible to use syslog-ng to forward logs to SecurityOnion ELSA?

I have installed Snort IDS and syslog-ng on my VM, and I want to use syslog-ng to forward my logs to another vm which is SecurityOnion. So I want to know can syslog-ng forward logs to ELSA which is in ...
0
votes
0answers
30 views

syslog-ng module with restriction

I have a syslog-ng and I also have another log collector wherein all the auth logs with filter is forwarded. On those servers I have this configuration on /etc/rsyslog.d/my.conf :msg, contains, "CRON"...
1
vote
0answers
230 views

Syslog-ng and Stunnel between two hosts (Connection refused)

I'd like to setup syslog-ng over stunnel between a host on my LAN and a host in my DMZ but can't quite figure out the configuration. The stunnel config seems to be correct. If I shutdown syslog on ...
1
vote
1answer
157 views

syslog-ng EC2 TLS

I am attempting to add TLS support to my syslog-ng service running on an AWS EC2 instance (logs are being sent to loggly). The basic configuration without TLS works, but when I replace the destination ...
2
votes
1answer
990 views

How does syslog-ng handles flush_lines(0)?

I wanted to make sure my syslog-ng was doing async logging. Reading through the documentation I see the flush_lines() option for file() destinations, if unspecified, will use the global default. Then ...
1
vote
1answer
1k views

sending json based messages using syslog-ng and amqp

How do you properly format json messages and send them over amqp with syslog-ng? The json format should look something like this. {"log":"This is the error message...", "date":"xxx", "source":"xxx"} ...
0
votes
2answers
182 views

How to resolve ssh/sftp log data not getting picked up by syslog-ng in cywgin64?

I've installed ssh and syslog-ng through cygwin (V3.2) on a Windows Server 2012 and attempting to get log output out of sshd. I'm using the default /etc/syslog-ng/syslog-ng.conf file... @version: 3.2 ...
0
votes
1answer
64 views

Syslog-ng reverse dns lookup for data fields

I would like to try a reverse-dns before storing the firewall logs. I know this is possibile in logstash but i don't know if syslog-ng can be configured to do the same. Actually my logs coming from ...
1
vote
1answer
247 views

Example syslog-ng configuration to replicate rsyslog filename & locations?

ng 3.6.3 from source compilation on CentOS 6.6 64bit to play with and was wondering if anyone has pointers or example syslog-ng.conf that would as close as possible replicate the default rsyslog ...
1
vote
1answer
2k views

How could I send the windows eventlog to the network logging of a linux server?

In Windows, I am using the "Eventlog to Syslog" utility to send event logs to the Linux syslog server (syslog-ng). But I am can't do the same with some log files, especially in the case of the IIS log....
0
votes
1answer
2k views

syslog-ng not flushing the pipe to external program

I have written a python script that takes log entries from syslog-ng and writes them to MongoDB (I couldn't do it with afmongodb driver because I need to do some special processing). This is how it ...
0
votes
1answer
109 views

How to filter cron messages in syslog-ng

I have a litte problem. I dont know ho to filter cron jobs in syslog-ng. It's spamming my log. Jun 05 16:09:01 CRON: pam_unix(cron:session): session opened for user root by (uid=0) Jun 05 16:09:...
2
votes
1answer
148 views

Is someone trying to hack into my VPS? [duplicate]

I was browsing my logs on papertail and I saw this. Jun 03 03:26:01 /USR/SBIN/CRON: (root) CMD (test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )) Jun 03 03:26:...
0
votes
0answers
157 views

How to log changes made in a particular file to syslog

How to log changes made in a particular file using syslog-ng. The log must contain the timestamp, hostname, user who modified the file and action performed. Is there any option other than audit in ...
1
vote
1answer
246 views

Why does syslog-ng drop debug messages when logging remote?

In the local log output, I can see debug messages but these won't show up on the remote logging server. It seems to ignore these but it does print warning and error level messages just fine. These ...
2
votes
1answer
280 views

How are filters combined in syslog-ng

If I've got an entry in syslog-ng log { source (src); filter (filter1); filter (filter2); filter (filter3); filter (filter4); destination (all_log) } And, say filter4 is a very ...
0
votes
1answer
207 views

Syslog-ng and Logrotate creating sparse files

We've been using syslog-ng to log our postgres logs. On top of it we run logrotate every 5 minutes which also gzips the files. Recently, we've noted that these postgres logs contain a lot of null ...
0
votes
1answer
148 views

SFTP and syslog-ng custom logging format

I have modified sshd_config and syslog-ng configs to log sftp connections into separate files. Now I would like to create custom logging like: [date] [source_ip] has downloaded the [filename] [size] ...
2
votes
2answers
3k views

iptables logging to diferent file via syslog-ng

I have the following configuration in my iptables and syslog files: IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m ...
0
votes
1answer
506 views

syslog-ng error on CentOS, works fine on other distributions

I want to add to a CentOS box (EL6) the same syslog-ng (3.2.5 from EPEL) configuration I have on other (Debian based) machines. It is intended to add events log in JSON to a single file for further ...
0
votes
1answer
765 views

How do I filter on tags in syslog-ng when they don't seem to be available by the time it processes it?

I am having a hard time debugging an issue and I think it may be two-fold - problems in two separate programs. The main issue is that I'm logging nginx to syslog on Ubuntu 14.04 like so: access_log ...
1
vote
2answers
1k views

Does syslog-ng config file support log rotating files every 15 mins?

I using syslog-ng config file destination configuration to create hourly log files. The config I'm using for this is as follows: destination d_hourly {file("/var/log/tracker/pid$PID-track-$YEAR-$...
0
votes
2answers
280 views

syslog-ng prepending date to received logs, breaking patterns in patterndb

I'm setting up central logging for our servers using syslog-ng + patterndb, however the logs the logging server is receiving from the client are prepended with the date, host and other data. This of ...
0
votes
1answer
323 views

Syslog-ng loghost - filter not-match

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong. It seems like filters are not working for ...
3
votes
1answer
683 views

How can I run a shell script on a snort alert?

I have snort listening to the SPAN port of a cisco switch. I'd like to be able to add an iptables DROP rule on my webserver for specific snort alerts but having a hard time finding out exactly how to ...
2
votes
2answers
100 views

How to collect logs for statistics in site?

I want to collect logs from nginx ( several servers, 1 000 000 lines in logs for minute for all servers ) to central stat server for statistics processing. I see 2 variants: write logs to local ...