Questions tagged [syslog]
syslog is a standard for logging messages about the operation of a system.
668
questions
7
votes
2
answers
10k
views
rsyslogd: Any way to get around the number of local facilities?
We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
- 10.9k
7
votes
5
answers
10k
views
Recommended software for a Centralized logging server? [closed]
I'd like to centralize logging for all my servers. Server operating systems include Windows 2003, 2008, Ubuntu and Redhat. I think Splunk is too expensive, has anyone set up something like this ...
- 4,780
7
votes
2
answers
19k
views
exclude syslog facility from all others
I'm adding some custom logging on local0 in syslog.
Writing these messages to a specific log is easy, in my syslog.conf I have
local0.* -/var/log/my.log
But how can I exclude local0 from all ...
- 2,439
7
votes
5
answers
3k
views
Is centralized logging a good idea?
Right now, my organization has a solution comprised of 10+ components, and some have a log file per thread. Since files are rotated hourly, tracking all of this is a chore.
Is centralizing all ...
- 275
7
votes
2
answers
5k
views
Avoiding log noise from cron jobs - with syslog-ng rather than syslog
On my small Debian squeeze web server, I have syslog-ng installed (not syslogd, like in this question). Generally, my logs are nice and quiet, with
-- MARK --
lines. My /var/log/syslog, however, is ...
- 1,722
7
votes
1
answer
9k
views
How do I configure rsyslog on Ubuntu 14.04 to use ISO8601 timestamps?
In a file in /etc/rsyslog.d/ I have the following:
local3.* /var/log/mylog.log
When I log to this facility, records have timestamps which look like this:
Apr 27 21:12:20 hostname msg
How do ...
- 2,635
7
votes
1
answer
5k
views
OSX /var/log/system.log -- where do i define pruning interval?
I have a script that periodically checks /var/log/system.log and I've noticed across our network that some machines keep logfiles for a month through reboots and other activities, while some purge the ...
- 3,210
7
votes
1
answer
25k
views
rsyslog filters on message contents and facility
I have found examples of how to filter based on the contents of a log entry with rsyslog. But is there a way to do this so it is only filtering on the contents of a certain facility? For example ...
- 84.4k
7
votes
1
answer
8k
views
rsyslog udp forwarding truncates at 2048 characters
Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
- 173
7
votes
1
answer
17k
views
Send NGINX logs to Graylog
I'm trying to collect nginx error and access logs with graylog, I think everything is correctly configured, but Graylog receive nothing from NGINX
(Graylog & NGINX are in docker containers and ...
- 96
7
votes
1
answer
194
views
How old is the "severity" paradigm in logging?
Years of sysadmin left syslog's severity levels, as described by The BSD Syslog Protocol, clearly imprinted in my mind. You know the drill: Emergency, Alert, Critical, Error, Warning, Notice, ...
- 5,833
7
votes
1
answer
1k
views
Ubuntu server hang with ascii NUL characters in syslog and other files ( ^@^@^@… )
We are experiencing occasional hangs with ubuntu 16.04 LTS (kernel 4.4.0-34-generic) and we wonder if somebody has some clues how to get to bottom of this.
The log looks like this:
Aug 24 10:02:04 ...
- 191
6
votes
2
answers
34k
views
Why is Syslog Not Writing Logs To The Designated Files?
I've been trying to route Apache's logs through Syslog (for some reason log rotation had stopped, and using Syslog and logrotate seemed a reasonable solution).
I have sent Apache's error logs to ...
- 503
6
votes
3
answers
30k
views
Log Locally and Remotely with rsyslogd
How can I make it so log file is stored both remotely and locally using rsyslog?
- 84.4k
6
votes
3
answers
1k
views
What's the best centralized syslog viewing tool for *nix out there
Looking for what people think are the best for doing web viewing of a centralized syslog server. I am open to using any syslog server also.
EDIT
I actually went with GrayLog2
- 22.5k
6
votes
3
answers
11k
views
Increase rsyslog/syslog precision to include fractional seconds?
I use syslog and rsyslog to handle logging on my Linux & FreeBSD systems.
The timestamp is currently in seconds but I would like to increase the precision of these timestamps to include ...
- 24k
6
votes
1
answer
41k
views
Create separated syslog file for each host with rsyslog
I have a syslog server (running rsyslog on RHEL 7.4) that consolidates all the syslogs from my network devices. It's listening on port TCP/514.
I want to redirect the logs of each device to a ...
- 215
6
votes
4
answers
41k
views
imuxsock messages in syslog and system becomes unresponsive
I am getting such messages in syslog.
rsyslogd-2177: imuxsock lost 21869 messages from pid 3418 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 3427 due to rate-limiting
...
- 287
6
votes
4
answers
14k
views
Wildcard support for InputFileName in rsyslog?
We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName?
Example:
InputFileName: /...
- 707
6
votes
1
answer
26k
views
rsyslog not logging messages
i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check ...
- 309
6
votes
1
answer
5k
views
Ubuntu syslog: After log rotation nothing is written on /var/log/syslog
I've been running a Ubuntu VPS for a few weeks now, so a couple of monthly log rotations took place yestarday. For things like /var/log/wtmp things look as expected: logfile has recent entries, while ...
- 577
6
votes
3
answers
4k
views
Syslog severity levels when to use Alert vs Critical
Short overview: Is Alert more severe than Critical.
RFC 5424 briefly defines syslog severity levels and gives a short description. Each syslog level is given a code 0 - 7. It was my understanding that ...
- 751
6
votes
2
answers
3k
views
How does an administrator generalize alerting when an event doesn't happen?
Often my users require me to be just as responsible for knowing if an event hasn't happened.
I've always had to build custom and brittle solutions with cron'ed shell scripts and lots of date edge ...
- 3,002
6
votes
1
answer
2k
views
Getting journald to send email on certain events
I found these solutions for syslogd that send emails on certain events like local0.crit or local1.err
How can I make syslogd email certain log messages to me?
http://www.johnandcailin.com/blog/john/...
6
votes
1
answer
12k
views
How to configure rsyslog to log into PostgreSQL without too much latency?
I'm trying to configure RSyslog on a Debian machine to log everythingo into PostgreSQL, while also logging as usual on disk.
I'm using a pretty stock Debian configuration and I activated the related ...
- 161
6
votes
1
answer
1k
views
Reduce munin logging level
Munin is quite verbose, and logs a bunch of things into munin-graph.log, munin-html.log, munin-limits.log and munin-update.log at each run of munin-cron.
I already reduced munin-node logging level by ...
- 5,327
6
votes
1
answer
3k
views
Configuring JBoss AS 7.2 to log to syslog
In my standalone.xml, I have the syslog-handler configured like so:
<syslog-handler name="SYSLOG" enabled="true">
<level name="INFO"/>
<hostname value="i-XXXXXXX"/>
&...
- 283
5
votes
2
answers
6k
views
What is this in my syslog and should I be concerned?
I'm seeing a lot of the following line in /var/log/syslog:
Jun 21 14:36:15 my-server kernel: [416219.080061] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:the-mac-address:08:00 SRC=0.0.0.0 DST=...
- 2,873
5
votes
5
answers
9k
views
Script to delete files older than 30days
Shell script should not delete any files under* root dir*. My* path will be like
/export/home/ftp/ ...
I did some research and figured out the way for finding and deleting the files older than 30 ...
- 298
5
votes
2
answers
12k
views
Ubuntu syslog does not show previous days's logs
My Cron job is not running and i want to see what's problem in the syslog.
But that log is only showing current date only ,
Is there any way to keep logs for the last 10 days?
John
5
votes
5
answers
17k
views
reliable export of journalctl logs
I search a way for a reliable export of journalctl logs.
I could use the --since=... option, but this is a bit fuzzy.
In my case a script would call journalctl --output=json every ten minutes.
I ...
- 3,843
5
votes
1
answer
313
views
Syslog produces hundreds of lines
I have recently been "promoted" to lab admin, as I have the most experience with linux. My logcheck keeps sending me emails with hundreds of lines stemming from my syslog file. It repeats itself over, ...
- 200
5
votes
1
answer
15k
views
nginx logs to syslog - connection refused
I'm trying to setup nginx 1.7.3 to send logs to syslog, but when I this configuration:
server {
access_log syslog:server=localhost;
}
this shows up in nginx's error log:
2015/01/15 21:42:47 [...
- 161
5
votes
1
answer
8k
views
Error setting capabilities, capability management disabled;
root@monitor:/opt/observium# service syslog-ng restart
Stopping system logging: syslog-ng.
Starting system logging: syslog-ngsyslog-ng: Error setting capabilities, capability management disabled; ...
- 6,691
5
votes
2
answers
2k
views
How can you filter mail.info from syslog?
How do I filter mail.info from /var/log/syslog (rsyslog.conf/Debian) while keeping messages greater than or equal to mail.warn?
I've tried just about every different variation of appending and ...
- 1,426
5
votes
2
answers
23k
views
rsyslog: How do I direct messages from all remote machines to one file?
We have a syslog server and we have all our servers logging to it.
We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.
Anyone know how to ...
- 10.9k
5
votes
4
answers
4k
views
Forward UNIX syslog to Windows Event viewer
I'm running a pfSense firewall which runs syslog and can forward it's logs to a remote syslog server. I'd like to be able to view these on my SBS 2011 server's event viewer, via a subscription. I ...
- 956
5
votes
3
answers
6k
views
Software to send windows notification eventlogs to linux syslog server and encode to utf8
I am trying to setup a windows 2008 server so it's able to send the eventlog messages to an syslog-ng server running linux. I'd prefer something native but I guess it won't be possible.
UPDATE
The ...
- 717
5
votes
2
answers
25k
views
How can I ship Windows Server 2008 event logs to a syslog server?
In the past with Windows Server 2003 I was able to ship the event logs to a central network syslog server using evtsys (https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys). It does not ...
- 1,904
5
votes
1
answer
2k
views
Random SSH entries in Auth.log out of date order [duplicate]
Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue.
Some ...
- 153
5
votes
3
answers
11k
views
Where is syslog.conf file on ubuntu 10
i want to LOG my droppped packets in firewall.
The tutorial told me write some lines in /etc/syslog.conf
I have searched but could not foound anything named syslog.conf
There was the file called ...
John
5
votes
5
answers
4k
views
Forwarding Windows log event using TCP [closed]
I'm looking for a way to safely centralize all my Windows and Linux logs on one location. Since I'm in a mixed environment, with both Linux and Windows, I started using Syslog-ng on the Linux boxes ...
- 725
5
votes
1
answer
4k
views
Difference between /dev/udp and netcat
I have a syslog server listening on localhost:514 as UDP and would like to write messages to it on that port. (Using Ubuntu 14.04)
If I run either of these commands from bash it prints the date ...
- 395
5
votes
1
answer
9k
views
How can I query rsyslog settings?
I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
- 151
5
votes
1
answer
7k
views
UDP Traffic from outside to docker container is dropped after container restart
following situation:
i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4
I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to ...
- 183
5
votes
2
answers
3k
views
Cannot find upstart logs in syslog despite a log-priority of debug (ubuntu 13.04 & mint 16)
I've set upstart log level to "debug"
sudo initctl log-priority debug
But I still cannot see anything in /var/log/syslog.
sudo initctl emit hello # no log
sudo initctl start my-broken-service # ...
- 161
5
votes
1
answer
5k
views
Using linux environment variable in rsyslog template
I'm trying to add an environment variable to my rsyslog template.
I tried using 'getenv()' function without any luck, I always get an empty string in return.
I'm attaching an example of my rsyslog ...
- 153
5
votes
2
answers
9k
views
How does one manually rotate log without logrotate on open/live file?
My Google-Fu is getting me so close but just not quite there, and I guess I'm too green in Linux to put the pieces together.
I have a very large >200GB log file, still being written to. Logrotate ...
- 61
5
votes
1
answer
5k
views
Best Practices for rotating syslog logs on RHEL with different schedules?
OS:
Running RHEL 5.6.
Situation:
I need to rotate /var/log/messagees on a different schedule than the rest of the syslog logs.
By default syslog logs are rotated weekly based on the /etc/logrotate....
- 53
5
votes
3
answers
10k
views
Chained Syslog forwarding
Is there a way to chain syslog forwarding? For example, how can a clienthost forward its syslogs to ServerA and ServerA forward everything to CentralSyslogServer?
I'm using rsyslog.
The reason is ...
- 635