The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

learn more… | top users | synonyms

3
votes
2answers
862 views

Getting syslog-ng to recognize a java stacktrace

We are using the log4j SyslogAppender to send our logging statements to syslog-ng. Once the messages are in syslog-ng, we are having trouble getting syslog-ng to recognize that a stacktrace goes with ...
1
vote
2answers
440 views

Syslog - capturing event logs from Win2k boxes

I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist. We have a central syslog server and we want it to capture event log events from Windows ...
0
votes
2answers
182 views

How to resolve ssh/sftp log data not getting picked up by syslog-ng in cywgin64?

I've installed ssh and syslog-ng through cygwin (V3.2) on a Windows Server 2012 and attempting to get log output out of sshd. I'm using the default /etc/syslog-ng/syslog-ng.conf file... @version: 3.2 ...
1
vote
1answer
247 views

Example syslog-ng configuration to replicate rsyslog filename & locations?

ng 3.6.3 from source compilation on CentOS 6.6 64bit to play with and was wondering if anyone has pointers or example syslog-ng.conf that would as close as possible replicate the default rsyslog ...
1
vote
1answer
246 views

Why does syslog-ng drop debug messages when logging remote?

In the local log output, I can see debug messages but these won't show up on the remote logging server. It seems to ignore these but it does print warning and error level messages just fine. These ...
1
vote
1answer
344 views

syslog-ng fails to log on lxc host

we are running CentOS 6 servers with multiple lxc-containers. For system logging we are using syslog-ng. After a while the syslog-ng daemon stops logging messages, but the daemon keeps running. This ...
1
vote
1answer
87 views

Syslog-ng log template \\011 character

I have a problem with syslog-ng. I want to make syslog-ng to format the logs like below: template("$YEAR-$MONTH-$DAY\\011$HOUR:$MIN:$SEC\\011$HOST\\011$MSGHDR$MSGONLY\n") But it logs without the "\"...
0
votes
1answer
120 views

syslog-ng working as foreground process but not as daemon

I'm working to implement syslog-ng OSE in my environment. Eventually I'd like to setup a central logging server, but in order to get my feet wet, I'm starting with a simple configuration. I've ...
0
votes
1answer
86 views

Referencing journald fields when forwarding messages to syslog-ng

How can I change my syslog-ng template so that when the log originates from a systemd service / unit, the log message will include the unit's name? Using ${PROGRAM} just shows the name of the ...
0
votes
1answer
27 views

syslog clipping for particular applications

I have a few particular applications that are causing a LOT of logs in my syslog server. I would like to keep all of their logging in /var/log/messages or somewhere on the server, but I am trying to ...
0
votes
1answer
14 views

How to check for platform within syslog-ng configuration?

I run syslog-ng on several platforms with the default /etc/syslog-ng/syslog-ng.conf, as well as an independent /etc/syslog-ng/conf.d/myconfig.conf In that specifc configuration I would like to reuse ...
0
votes
1answer
86 views

Use syslog service to capture data logged to a file not managed by syslog?

Some services (nginx, buildbot, et cetera) only support logging to a file. Is there a way to reliably capture these log messages using syslog and friends, so that the log message can be reflected in ...
0
votes
1answer
64 views

Syslog-ng reverse dns lookup for data fields

I would like to try a reverse-dns before storing the firewall logs. I know this is possibile in logstash but i don't know if syslog-ng can be configured to do the same. Actually my logs coming from ...
0
votes
1answer
109 views

How to filter cron messages in syslog-ng

I have a litte problem. I dont know ho to filter cron jobs in syslog-ng. It's spamming my log. Jun 05 16:09:01 CRON: pam_unix(cron:session): session opened for user root by (uid=0) Jun 05 16:09:...
0
votes
1answer
207 views

Syslog-ng and Logrotate creating sparse files

We've been using syslog-ng to log our postgres logs. On top of it we run logrotate every 5 minutes which also gzips the files. Recently, we've noted that these postgres logs contain a lot of null ...
0
votes
1answer
765 views

How do I filter on tags in syslog-ng when they don't seem to be available by the time it processes it?

I am having a hard time debugging an issue and I think it may be two-fold - problems in two separate programs. The main issue is that I'm logging nginx to syslog on Ubuntu 14.04 like so: access_log ...
0
votes
1answer
323 views

Syslog-ng loghost - filter not-match

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong. It seems like filters are not working for ...
0
votes
1answer
323 views

syslog-ng 3.5 flush_lines not working with smtp

What I want: automatic emails every time someone successfully logs into my Ubuntu 14.04 LTS server. /var/log/auth.log gets 2 lines written to it every time I login. Example: Jul 22 13:55:49 server ...
0
votes
1answer
1k views

Syslog-ng how to get domain names instead of IP address

How can syslog-ng get the domain names instead of IP address that I received? I'm able to get those information but in IP address, I would like to get the DST/HOST to domain names instead of getting ...
0
votes
1answer
448 views

Syslog-ng Events Per Second Graphing

I have a distributed syslog-ng setup and am trying to determine how many events per second (EPS) we are receiving on each one. I know that syslog-ng does some general performance statistic to /var/log/...
0
votes
1answer
121 views

Syslog-ng not sending to fifo when template directive is used

Ok, so i need syslog to log to a fifo with a specific template for the log in mind. So I set my destination as follows... destination d_pipe { pipe("/var/run/some_pipe.fifo"); }; This works fine ...
0
votes
1answer
390 views

Time jump in syslog-ng log files

I am running my proprietary application (the name of which I would prefer not to disclose) in Linux 2.6 kernel, running on PowerPC (P2020) in an embedded environment. I am using syslog-ng to collect ...
4
votes
0answers
477 views

How do you use patterndb variables in syslog-ng?

I'd like to parse some custom (network appliance) syslog files to create my own formatted output. As I am new to syslog-ng & patterndb I have been trying to build an example using the ...
2
votes
0answers
2k views

syslog-ng and nginx logs to mysql

So couple of days ago I asked how to log php and nginx logs to centralized MySQL database, and m0ntassar gave a perfect answer :) cheer ! The problem I am facing now is that I can not seem to get it ...
1
vote
0answers
230 views

Syslog-ng and Stunnel between two hosts (Connection refused)

I'd like to setup syslog-ng over stunnel between a host on my LAN and a host in my DMZ but can't quite figure out the configuration. The stunnel config seems to be correct. If I shutdown syslog on ...
1
vote
0answers
360 views

capture Parse.com application logs with syslog-ng

I need to setup a log drain for an application running on Parse. My source looks like this: source s_parse { #internal(); program("/home/ubuntu/parse/tailparse.sh" ...
1
vote
0answers
640 views

Sending certain logs to a remote syslog-ng server

I am unable to send /var/log/audit/audit.log to remote server. I have tried below methods but no luck. After done below configuration am not able to restart the syslog-ng service. syslog-ng version ...
1
vote
0answers
282 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages -rw----...
1
vote
0answers
144 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
0answers
77 views

how to filter syslog messages by interfaced received

with a server assigned two interfaces, .234 and .235, how can I create a filter separating the incoming messages ? This configuration, only outputs to one folder ---- list interfaces ---- eth0:234 -...
0
votes
0answers
45 views

Syslog-ng "Error binding socket; addr='AF_INET($CLIENT)', error ='Cannot assign requested address (99)' Error initializing message pipeline;

I'm pretty new to syslog-ng, however after doing some research, found that it would be a good fit for the current project I am working on. Essentially all that I need to do is send syslog messages ...
0
votes
0answers
624 views

How to forward Bro logs to Security Onion ELSA?

In my environment, I have one Bro IDS and one SecurityOnion running, I want to forward Bro logs to ELSA on SecurityOnion. I tried to configure syslog-ng on my Bro, and the configuration is like this: ...
0
votes
0answers
31 views

Filtering on syslog-ng from rsyslogd syslogtag

I have CentOS servers that are configured to send certain log files to a central log host, with each log being tagged vi the inputfiletag parameter. The client/sender configuration looks like this... ...
0
votes
0answers
30 views

syslog-ng module with restriction

I have a syslog-ng and I also have another log collector wherein all the auth logs with filter is forwarded. On those servers I have this configuration on /etc/rsyslog.d/my.conf :msg, contains, "CRON"...
0
votes
0answers
157 views

How to log changes made in a particular file to syslog

How to log changes made in a particular file using syslog-ng. The log must contain the timestamp, hostname, user who modified the file and action performed. Is there any option other than audit in ...