Questions tagged [syslog-ng]
The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.
61
questions with no upvoted or accepted answers
5
votes
0
answers
1k
views
How do you use patterndb variables in syslog-ng?
I'd like to parse some custom (network appliance) syslog files to create my own formatted output.
As I am new to syslog-ng & patterndb I have been trying to build an example using the ...
3
votes
0
answers
2k
views
Sending certain logs to a remote syslog-ng server
I am unable to send /var/log/audit/audit.log to remote server.
I have tried below methods but no luck.
After done below configuration am not able to restart the syslog-ng service.
syslog-ng version ...
3
votes
2
answers
2k
views
Getting syslog-ng to recognize a java stacktrace
We are using the log4j SyslogAppender to send our logging statements to syslog-ng. Once the messages are in syslog-ng, we are having trouble getting syslog-ng to recognize that a stacktrace goes with ...
2
votes
2
answers
2k
views
syslog-ng working as foreground process but not as daemon
I'm working to implement syslog-ng OSE in my environment. Eventually I'd like to setup a central logging server, but in order to get my feet wet, I'm starting with a simple configuration. I've ...
2
votes
1
answer
18k
views
logrotate configuration on linux to rotate syslog-ng log files correctly
I am having some trouble trying to configure log rotation for some syslog-ng local log files I'm trying to keep.
for some reason, the size is not respected and logs are filling my filesystem quickly.
...
1
vote
1
answer
244
views
syslog-ng: Timezone change and $HOUR macro
Here's a log line from an appliance coming in as UTC:
<166>2023-06-13T16:03:44Z ..................
We store this as in files, in Europe/London timezone:
destination d_all {
file("/srv/...
1
vote
2
answers
227
views
syslog-ng filter log by frequency to destination file
I have a syslog-ng that receives too many logs and I am trying a way to 'sample' them using some filter.
I assume editing the /etc/syslog-ng/syslog-ng.conf with something like
log { source(s_udp514); ...
1
vote
1
answer
556
views
Find process that makes outbound HTTP calls, trying auditd with syslog-ng
Some of application (it's unknown) makes sporadic nonregular rare short outbound HTTP(S) requests to a known host/port/url (this is a WAF honeypot, host/url/port is known) using HTTPS protocol.
...
1
vote
2
answers
2k
views
syslog-ng execute script on syslog pattern
I have a simple requirement.
I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script.
...
1
vote
1
answer
611
views
rsyslog/syslog-ng pattern to log ssh and related sftp session for an user
I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename:
I have this:
Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port ...
1
vote
1
answer
305
views
AMQPS To Syslog
Currently I'm using basic API gets to pull down logs from a cloud security vendor but it's not a very clean process. I would like to transition over to the event streaming (AMQPS) service they provide....
1
vote
0
answers
1k
views
Syslog-ng not triggering Python script
I am currently trying to setup a Syslog application to trigger a certain python script when a certain message is found however I'm having trouble calling the python script. Below is the current config ...
1
vote
1
answer
365
views
Filtering dpkg logs in syslog-ng
I am new to syslog-ng, and I am setting a syslog-ng, where I am receiving logs of syslog, auth.log and dpkg.log. Although I was able to get the logs for syslog and auth.log, but I am unable to write ...
1
vote
0
answers
468
views
syslog-ng not recognizing "python" as a parser keyword
( Yes, I've seen syslog-ng does not recognize "python" keyword . However, 1) the mentioned solution doesn't help me because I checked and mod-python is loaded, and 2) it applies to file ...
1
vote
0
answers
770
views
Get json output file for cisco router logs with syslog ng
Have cisco router logs as following
Sep 18 20:55:30 2405:XXX:204:XXX:172:22:XXX:25 93596: 093382: Sep 18 20:53:17.848 IST: %TCP-6-BADAUTH: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to ...
1
vote
0
answers
438
views
Syslog-ng - 6 day old log file touched when writing to today's log file
Nearly every time syslog-ng writes to the current log file, it touches the log file from 6 days prior. It is not writing any data into the old log files, just updating their last modified timestamp.
...
1
vote
0
answers
569
views
Kafka module missing on syslog-ng.
I'm trying to install syslog-ng and its kafka module. I'm using docker debian:latest for this if that matters.
After running 'apt-get install syslog-ng' the syslog-ng can't reach the kafka module ...
1
vote
0
answers
2k
views
Syslog-ng and Stunnel between two hosts (Connection refused)
I'd like to setup syslog-ng over stunnel between a host on my LAN and a host in my DMZ but can't quite figure out the configuration. The stunnel config seems to be correct. If I shutdown syslog on ...
1
vote
1
answer
785
views
Example syslog-ng configuration to replicate rsyslog filename & locations?
ng 3.6.3 from source compilation on CentOS 6.6 64bit to play with and was wondering if anyone has pointers or example syslog-ng.conf that would as close as possible replicate the default rsyslog ...
1
vote
1
answer
984
views
Why does syslog-ng drop debug messages when logging remote?
In the local log output, I can see debug messages but these won't show up on the remote logging server. It seems to ignore these but it does print warning and error level messages just fine.
These ...
1
vote
1
answer
667
views
syslog-ng fails to log on lxc host
we are running CentOS 6 servers with multiple lxc-containers. For system logging we are using syslog-ng. After a while the syslog-ng daemon stops logging messages, but the daemon keeps running. This ...
1
vote
0
answers
580
views
capture Parse.com application logs with syslog-ng
I need to setup a log drain for an application running on Parse.
My source looks like this:
source s_parse {
#internal();
program("/home/ubuntu/parse/tailparse.sh"
...
1
vote
0
answers
843
views
Syslog-ng not logging on debian
I have syslog-ng running but it does not seem to be logging to /var/log anymore.
Looking at the logs it apparently used to awhile back:
-rw------- 1 root root 0 Sep 8 00:55 messages
-rw----...
1
vote
0
answers
272
views
Writing templates for rsyslog
When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
1
answer
251
views
Syslog-ng log template \\011 character
I have a problem with syslog-ng. I want to make syslog-ng to format the logs like below:
template("$YEAR-$MONTH-$DAY\\011$HOUR:$MIN:$SEC\\011$HOST\\011$MSGHDR$MSGONLY\n")
But it logs without the "\"....
1
vote
0
answers
241
views
how to filter syslog messages by interfaced received
with a server assigned two interfaces, .234 and .235, how can I create a filter separating the incoming messages ?
This configuration, only outputs to one folder
---- list interfaces ----
eth0:234 -...
1
vote
2
answers
522
views
Syslog - capturing event logs from Win2k boxes
I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist.
We have a central syslog server and we want it to capture event log events from Windows ...
0
votes
1
answer
160
views
Postgrey logging options
I am running Debian 12, Postfix with Postgrey. I can not seem to get Postgrey to log to mail.log. I am using syslog-ng, was using rsyslog. I have mail pointing to the mail.log file and inside /etc/...
0
votes
1
answer
103
views
Syslog-ng Syslog Format to JSON Format are there pre-requisite?
My first time posting to Stack Overflow. I apologize if I am re-asking a question. I tried to search but nothing is really clear about what I'm trying to understand.
Do I need to configure additional ...
0
votes
1
answer
59
views
Can't exclude a specific message from a remote logging
I manage logs FreeBSD 13.2 via syslog-ng. The current syslog-ng config has some lines to send data to a remote server (Debian 10 - 192.168.0.2:3000).
destination lc_net { tcp("192.168.0.2" ...
0
votes
1
answer
131
views
Syslog-ng to Azure Event Hub
I'm looking to send specific logs from my syslog-ng cluster to Azure event hub so it can utilize ADX instead of Log Analytics workspace.
Per the documentation found on syslog-ng's website (here), the ...
0
votes
1
answer
233
views
Syslog-ng enable TCP framing
I'm trying to send file entries as messages via TCP, where syslog-ng is in a container and it is sending to another container. I've had two different attempts both with problematic behavior. The first ...
0
votes
0
answers
926
views
Promtail - syslog configuration only logs localhost for hostname and IP
I have a number of boxes that run docker containers. To keep a record of all the logs, we have 1 instance of logspout on every box that grabs all container logs on that box, and routes it to a syslog-...
0
votes
1
answer
1k
views
Traefik don't keep real ip
I have a problem with Traefik, I want to log from a server with syslog-ng (docker). I have logs but I have reverse_proxy name and I want source IP not the name of traefik. I wish to keep source IP ...
0
votes
0
answers
1k
views
syslog-ng duplicate log message
Not duplicate of this question because that one uses rsyslog on client whereas I use syslog-ng on both sides.
I have a syslog-ng instance on both the client and the server and for whatever reason the ...
0
votes
1
answer
789
views
syslog-ng / telegraf : EOF occurred when idle - incompatible?
This is a follow-on question from this previous question, created because I found out more information and it's cleaner to pose this as a new question.
I'm using syslog-ng OSE v3.31.2 to receive ...
0
votes
0
answers
375
views
RSyslogd is sending multiples CEF messages in the same Syslog message
There is a Python script sending multiple events to a remote host with Rsyslogd:
CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=767000670128771115
CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=...
0
votes
1
answer
40
views
Save incoming log with suffix to its logfile-suffix.log using syslog-ng
I've been searching on the internet for answers relating to syslog-ng and how I can configure syslog-ng to save incoming log files with a specific suffix to a file and also carry over the suffix ...
0
votes
1
answer
386
views
using mysql to send a database of log messages to syslog-ng?
I want to create a database of my proxy-server log messages and then modify and change them then finally send them to syslog-ng!!
Is it possible?
0
votes
0
answers
109
views
Wifi appliance not sending syslog
I am struggling a bit with my new syslog server which is not receiving log from my wifi appliance.
My wifi appliance is an aerohive, there is almost nothing about configuring syslog on it on internet, ...
0
votes
1
answer
851
views
systemd unit alias (symlink) missing for syslog-ng / syslog
I am having issues with an Ubuntu 16.04.4 machine running systemd and syslog-ng (3.5.6-2.1), where messages logged to syslog by a process (let's call it X) were not received by syslog-ng. Digging into ...
0
votes
1
answer
921
views
syslog-ng 3.2.5 server stops receiving data, possibly related to logrotate
I asked this question in Unix & Linux but I think it actually fits better here.
Currently, I use the following logrotate.d configuration
/var/log/messages
{
daily
compress
rotate ...
0
votes
0
answers
282
views
How to get data from a port and forward it to other syslog-ng Servers using nginx?
I am sending data to 9516 port on nginx server . From this server I want to forward it to two syslog-ng servers using roundrobin method. I have below nginx.conf file, with this I am able to load ...
0
votes
1
answer
516
views
Syslog-NG is spooling messages
I am currently using Balabit's Syslog-NG to concentrate my IT logs and convey them in a remote server, via a TCP connection, which can allow one listening port only.
Thing is, my log volume is really ...
0
votes
1
answer
169
views
Syslog-NG version compatibility
I have 3 servers configured to run syslog-ng.
We'll call the servers web, jump, and client.
Web is CentOS 6
Jump and Client are CentOS 7
Jump is an OpenVPN server
Client is an OpenVPN client
Web is ...
0
votes
1
answer
870
views
Configure rsyslog client to send different log filename to a syslog-ng server
I have multiple servers with rsyslog configured to write logs to a remote syslog-ng server configured like this:
# Log anything of level info or higher.
# Don't log private authentication messages!
*....
0
votes
1
answer
218
views
syslog clipping for particular applications
I have a few particular applications that are causing a LOT of logs in my syslog server. I would like to keep all of their logging in /var/log/messages or somewhere on the server, but I am trying to ...
0
votes
1
answer
399
views
Use syslog service to capture data logged to a file not managed by syslog?
Some services (nginx, buildbot, et cetera) only support logging to a file. Is there a way to reliably capture these log messages using syslog and friends, so that the log message can be reflected in ...
0
votes
2
answers
1k
views
How to resolve ssh/sftp log data not getting picked up by syslog-ng in cywgin64?
I've installed ssh and syslog-ng through cygwin (V3.2) on a Windows Server 2012 and attempting to get log output out of sshd. I'm using the default /etc/syslog-ng/syslog-ng.conf file...
@version: 3.2
...
0
votes
1
answer
729
views
Syslog-ng reverse dns lookup for data fields
I would like to try a reverse-dns before storing the firewall logs. I know this is possibile in logstash but i don't know if syslog-ng can be configured to do the same.
Actually my logs coming from ...