Questions tagged [syslog-ng]

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

61 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
0 answers
1k views

How do you use patterndb variables in syslog-ng?

I'd like to parse some custom (network appliance) syslog files to create my own formatted output. As I am new to syslog-ng & patterndb I have been trying to build an example using the ...
Nick's user avatar
  • 51
3 votes
0 answers
2k views

Sending certain logs to a remote syslog-ng server

I am unable to send /var/log/audit/audit.log to remote server. I have tried below methods but no luck. After done below configuration am not able to restart the syslog-ng service. syslog-ng version ...
user210034's user avatar
3 votes
2 answers
2k views

Getting syslog-ng to recognize a java stacktrace

We are using the log4j SyslogAppender to send our logging statements to syslog-ng. Once the messages are in syslog-ng, we are having trouble getting syslog-ng to recognize that a stacktrace goes with ...
Matt Campbell's user avatar
2 votes
2 answers
2k views

syslog-ng working as foreground process but not as daemon

I'm working to implement syslog-ng OSE in my environment. Eventually I'd like to setup a central logging server, but in order to get my feet wet, I'm starting with a simple configuration. I've ...
NevDull's user avatar
  • 21
2 votes
1 answer
18k views

logrotate configuration on linux to rotate syslog-ng log files correctly

I am having some trouble trying to configure log rotation for some syslog-ng local log files I'm trying to keep. for some reason, the size is not respected and logs are filling my filesystem quickly. ...
olivierg's user avatar
  • 524
1 vote
1 answer
244 views

syslog-ng: Timezone change and $HOUR macro

Here's a log line from an appliance coming in as UTC: <166>2023-06-13T16:03:44Z .................. We store this as in files, in Europe/London timezone: destination d_all { file("/srv/...
Christopher Causer's user avatar
1 vote
2 answers
227 views

syslog-ng filter log by frequency to destination file

I have a syslog-ng that receives too many logs and I am trying a way to 'sample' them using some filter. I assume editing the /etc/syslog-ng/syslog-ng.conf with something like log { source(s_udp514); ...
asasa178's user avatar
  • 109
1 vote
1 answer
556 views

Find process that makes outbound HTTP calls, trying auditd with syslog-ng

Some of application (it's unknown) makes sporadic nonregular rare short outbound HTTP(S) requests to a known host/port/url (this is a WAF honeypot, host/url/port is known) using HTTPS protocol. ...
lospejos's user avatar
  • 906
1 vote
2 answers
2k views

syslog-ng execute script on syslog pattern

I have a simple requirement. I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script. ...
David Calderon's user avatar
1 vote
1 answer
611 views

rsyslog/syslog-ng pattern to log ssh and related sftp session for an user

I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename: I have this: Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port ...
Jiri B's user avatar
  • 577
1 vote
1 answer
305 views

AMQPS To Syslog

Currently I'm using basic API gets to pull down logs from a cloud security vendor but it's not a very clean process. I would like to transition over to the event streaming (AMQPS) service they provide....
Eric's user avatar
  • 1,393
1 vote
0 answers
1k views

Syslog-ng not triggering Python script

I am currently trying to setup a Syslog application to trigger a certain python script when a certain message is found however I'm having trouble calling the python script. Below is the current config ...
ggjono's user avatar
  • 11
1 vote
1 answer
365 views

Filtering dpkg logs in syslog-ng

I am new to syslog-ng, and I am setting a syslog-ng, where I am receiving logs of syslog, auth.log and dpkg.log. Although I was able to get the logs for syslog and auth.log, but I am unable to write ...
Bidyut's user avatar
  • 121
1 vote
0 answers
468 views

syslog-ng not recognizing "python" as a parser keyword

( Yes, I've seen syslog-ng does not recognize "python" keyword . However, 1) the mentioned solution doesn't help me because I checked and mod-python is loaded, and 2) it applies to file ...
Shadur-don't-feed-the-AI's user avatar
1 vote
0 answers
770 views

Get json output file for cisco router logs with syslog ng

Have cisco router logs as following Sep 18 20:55:30 2405:XXX:204:XXX:172:22:XXX:25 93596: 093382: Sep 18 20:53:17.848 IST: %TCP-6-BADAUTH: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to ...
user436054's user avatar
1 vote
0 answers
438 views

Syslog-ng - 6 day old log file touched when writing to today's log file

Nearly every time syslog-ng writes to the current log file, it touches the log file from 6 days prior. It is not writing any data into the old log files, just updating their last modified timestamp. ...
psitsyseng's user avatar
1 vote
0 answers
569 views

Kafka module missing on syslog-ng.

I'm trying to install syslog-ng and its kafka module. I'm using docker debian:latest for this if that matters. After running 'apt-get install syslog-ng' the syslog-ng can't reach the kafka module ...
kub1x's user avatar
  • 111
1 vote
0 answers
2k views

Syslog-ng and Stunnel between two hosts (Connection refused)

I'd like to setup syslog-ng over stunnel between a host on my LAN and a host in my DMZ but can't quite figure out the configuration. The stunnel config seems to be correct. If I shutdown syslog on ...
Server Fault's user avatar
  • 3,774
1 vote
1 answer
785 views

Example syslog-ng configuration to replicate rsyslog filename & locations?

ng 3.6.3 from source compilation on CentOS 6.6 64bit to play with and was wondering if anyone has pointers or example syslog-ng.conf that would as close as possible replicate the default rsyslog ...
p4guru's user avatar
  • 963
1 vote
1 answer
984 views

Why does syslog-ng drop debug messages when logging remote?

In the local log output, I can see debug messages but these won't show up on the remote logging server. It seems to ignore these but it does print warning and error level messages just fine. These ...
foraidt's user avatar
  • 111
1 vote
1 answer
667 views

syslog-ng fails to log on lxc host

we are running CentOS 6 servers with multiple lxc-containers. For system logging we are using syslog-ng. After a while the syslog-ng daemon stops logging messages, but the daemon keeps running. This ...
john.dough's user avatar
1 vote
0 answers
580 views

capture Parse.com application logs with syslog-ng

I need to setup a log drain for an application running on Parse. My source looks like this: source s_parse { #internal(); program("/home/ubuntu/parse/tailparse.sh" ...
emkman's user avatar
  • 111
1 vote
0 answers
843 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages -rw----...
Jason's user avatar
  • 3,941
1 vote
0 answers
272 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
Abhijeet Rastogi's user avatar
1 vote
1 answer
251 views

Syslog-ng log template \\011 character

I have a problem with syslog-ng. I want to make syslog-ng to format the logs like below: template("$YEAR-$MONTH-$DAY\\011$HOUR:$MIN:$SEC\\011$HOST\\011$MSGHDR$MSGONLY\n") But it logs without the "\"....
0xmtn's user avatar
  • 360
1 vote
0 answers
241 views

how to filter syslog messages by interfaced received

with a server assigned two interfaces, .234 and .235, how can I create a filter separating the incoming messages ? This configuration, only outputs to one folder ---- list interfaces ---- eth0:234 -...
netsirk's user avatar
  • 11
1 vote
2 answers
522 views

Syslog - capturing event logs from Win2k boxes

I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist. We have a central syslog server and we want it to capture event log events from Windows ...
molecule's user avatar
0 votes
1 answer
160 views

Postgrey logging options

I am running Debian 12, Postfix with Postgrey. I can not seem to get Postgrey to log to mail.log. I am using syslog-ng, was using rsyslog. I have mail pointing to the mail.log file and inside /etc/...
Rob Watson's user avatar
0 votes
1 answer
103 views

Syslog-ng Syslog Format to JSON Format are there pre-requisite?

My first time posting to Stack Overflow. I apologize if I am re-asking a question. I tried to search but nothing is really clear about what I'm trying to understand. Do I need to configure additional ...
Ajgonzalez18's user avatar
0 votes
1 answer
59 views

Can't exclude a specific message from a remote logging

I manage logs FreeBSD 13.2 via syslog-ng. The current syslog-ng config has some lines to send data to a remote server (Debian 10 - 192.168.0.2:3000). destination lc_net { tcp("192.168.0.2" ...
Ilya Shmadchenko's user avatar
0 votes
1 answer
131 views

Syslog-ng to Azure Event Hub

I'm looking to send specific logs from my syslog-ng cluster to Azure event hub so it can utilize ADX instead of Log Analytics workspace. Per the documentation found on syslog-ng's website (here), the ...
Eric's user avatar
  • 1,393
0 votes
1 answer
233 views

Syslog-ng enable TCP framing

I'm trying to send file entries as messages via TCP, where syslog-ng is in a container and it is sending to another container. I've had two different attempts both with problematic behavior. The first ...
Omri. B's user avatar
  • 109
0 votes
0 answers
926 views

Promtail - syslog configuration only logs localhost for hostname and IP

I have a number of boxes that run docker containers. To keep a record of all the logs, we have 1 instance of logspout on every box that grabs all container logs on that box, and routes it to a syslog-...
WorkAppropriateUsername's user avatar
0 votes
1 answer
1k views

Traefik don't keep real ip

I have a problem with Traefik, I want to log from a server with syslog-ng (docker). I have logs but I have reverse_proxy name and I want source IP not the name of traefik. I wish to keep source IP ...
warste's user avatar
  • 1
0 votes
0 answers
1k views

syslog-ng duplicate log message

Not duplicate of this question because that one uses rsyslog on client whereas I use syslog-ng on both sides. I have a syslog-ng instance on both the client and the server and for whatever reason the ...
ElpersonPL's user avatar
0 votes
1 answer
789 views

syslog-ng / telegraf : EOF occurred when idle - incompatible?

This is a follow-on question from this previous question, created because I found out more information and it's cleaner to pose this as a new question. I'm using syslog-ng OSE v3.31.2 to receive ...
davidA's user avatar
  • 393
0 votes
0 answers
375 views

RSyslogd is sending multiples CEF messages in the same Syslog message

There is a Python script sending multiple events to a remote host with Rsyslogd: CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=767000670128771115 CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=...
Cod1ngFree's user avatar
0 votes
1 answer
40 views

Save incoming log with suffix to its logfile-suffix.log using syslog-ng

I've been searching on the internet for answers relating to syslog-ng and how I can configure syslog-ng to save incoming log files with a specific suffix to a file and also carry over the suffix ...
OMG-1's user avatar
  • 156
0 votes
1 answer
386 views

using mysql to send a database of log messages to syslog-ng?

I want to create a database of my proxy-server log messages and then modify and change them then finally send them to syslog-ng!! Is it possible?
Morteza's user avatar
0 votes
0 answers
109 views

Wifi appliance not sending syslog

I am struggling a bit with my new syslog server which is not receiving log from my wifi appliance. My wifi appliance is an aerohive, there is almost nothing about configuring syslog on it on internet, ...
user7394492's user avatar
0 votes
1 answer
851 views

systemd unit alias (symlink) missing for syslog-ng / syslog

I am having issues with an Ubuntu 16.04.4 machine running systemd and syslog-ng (3.5.6-2.1), where messages logged to syslog by a process (let's call it X) were not received by syslog-ng. Digging into ...
Roman's user avatar
  • 1
0 votes
1 answer
921 views

syslog-ng 3.2.5 server stops receiving data, possibly related to logrotate

I asked this question in Unix & Linux but I think it actually fits better here. Currently, I use the following logrotate.d configuration /var/log/messages { daily compress rotate ...
Jbart's user avatar
  • 1
0 votes
0 answers
282 views

How to get data from a port and forward it to other syslog-ng Servers using nginx?

I am sending data to 9516 port on nginx server . From this server I want to forward it to two syslog-ng servers using roundrobin method. I have below nginx.conf file, with this I am able to load ...
user3332404's user avatar
0 votes
1 answer
516 views

Syslog-NG is spooling messages

I am currently using Balabit's Syslog-NG to concentrate my IT logs and convey them in a remote server, via a TCP connection, which can allow one listening port only. Thing is, my log volume is really ...
moutonjr's user avatar
  • 498
0 votes
1 answer
169 views

Syslog-NG version compatibility

I have 3 servers configured to run syslog-ng. We'll call the servers web, jump, and client. Web is CentOS 6 Jump and Client are CentOS 7 Jump is an OpenVPN server Client is an OpenVPN client Web is ...
Speeddymon's user avatar
0 votes
1 answer
870 views

Configure rsyslog client to send different log filename to a syslog-ng server

I have multiple servers with rsyslog configured to write logs to a remote syslog-ng server configured like this: # Log anything of level info or higher. # Don't log private authentication messages! *....
xergiopd's user avatar
  • 111
0 votes
1 answer
218 views

syslog clipping for particular applications

I have a few particular applications that are causing a LOT of logs in my syslog server. I would like to keep all of their logging in /var/log/messages or somewhere on the server, but I am trying to ...
JustNobody30's user avatar
0 votes
1 answer
399 views

Use syslog service to capture data logged to a file not managed by syslog?

Some services (nginx, buildbot, et cetera) only support logging to a file. Is there a way to reliably capture these log messages using syslog and friends, so that the log message can be reflected in ...
Monica For CEO's user avatar
0 votes
2 answers
1k views

How to resolve ssh/sftp log data not getting picked up by syslog-ng in cywgin64?

I've installed ssh and syslog-ng through cygwin (V3.2) on a Windows Server 2012 and attempting to get log output out of sshd. I'm using the default /etc/syslog-ng/syslog-ng.conf file... @version: 3.2 ...
Tony's user avatar
  • 1
0 votes
1 answer
729 views

Syslog-ng reverse dns lookup for data fields

I would like to try a reverse-dns before storing the firewall logs. I know this is possibile in logstash but i don't know if syslog-ng can be configured to do the same. Actually my logs coming from ...
Tobia's user avatar
  • 1,322