syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

0
votes
1answer
490 views

NTP synchronisation not visible in syslog

I am trying to set up a local NTP server for our LAN. I am able run ntpdate server_ip to manually update the time. However, ntp daemon does not seem to be logging anything into syslog, and so I can't ...
2
votes
1answer
817 views

Failing forwarding rsyslog

I have a centralised rsyslog server A that receives a bunch of logs through TCP from servers X, Y, Z. It then stores the files on disk but also forwards them to logstash server B (on a different ...
2
votes
1answer
139 views

Disable syslog remote connections

I'm securing a server and closing all the ports that are not used, but i can't close the syslogd port, even worse I cannot find where the syslogd is called. This is what sockstat shows me: USER ...
1
vote
1answer
703 views

Strange syslog for my server

Today i go on my log with nano /var/log/syslog I have this, and i think it's not very good : Aug 27 06:25:02 ks3309528 rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="2235" ...
1
vote
1answer
289 views

syslogd filtering not working on FreeBSD

I am failing to get filtering by program or facility working in FreeBSD syslogd. I added local6.debug /var/log/test.log !testd *.debug /var/log/test.log to my ...
1
vote
3answers
92 views

Syslog to IPFIX

I was reading about logs (syslog) being exported in IPFIX format. And some products which do this as well. What I didn't find, was if there is any standard/known ways of doing this ?. Like if there ...
2
votes
1answer
1k views

How to send NAGIOS alerts to OSSIM server

I've installed an OSSIM server and I wanto to retrieve the alerts generated by a remote Nagios server in order to analyze them and perform correlation of security events. Before putting hands on it, ...
3
votes
3answers
320 views

To use syslog or not [closed]

Can someone make a decent case here: I want to use syslog so logging is integrated and so I can direct it based on severity etc not to mention log rotate, but at the same time I like the idea of ...
2
votes
1answer
1k views

Error setting capabilities, capability management disabled;

root@monitor:/opt/observium# service syslog-ng restart Stopping system logging: syslog-ng. Starting system logging: syslog-ngsyslog-ng: Error setting capabilities, capability management disabled; ...
2
votes
2answers
423 views

How can you filter mail.info from syslog?

How do I filter mail.info from /var/log/syslog (rsyslog.conf/Debian) while keeping messages greater than or equal to mail.warn? I've tried just about every different variation of appending and ...
3
votes
1answer
4k views

How do I setup rsyslog to send all logs to multiple remote servers?

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails. *.* @@server1 *.* @@server2 If I put the above in ...
0
votes
1answer
174 views

syslog-ng 2.0.9 closing tcp connections from some clients instantly..?

I've a syslog-ng instance on 2.0.9, which is old, but... this is enterprise IT and upgrading the versions is... fun... running on Solaris 10. I have this strange problem where some clients stop being ...
0
votes
0answers
189 views

FreeBSD 7 syslog messages: “kernel: 15.xxxxxxxxxxxxxxx too long” (or “too short”)?

I'm experiencing poor performance on an old FreeBSD system and the only anomaly I see so far are syslog messages of the form: Jul 1 12:10:50 myserverXXX kernel: 16.0ccdd219377c0d80 too long Jul 1 ...
1
vote
1answer
599 views

Logstash shipper & server on the samebox

I'm trying to setup a central logstash configuration. However I would like to be sending my logs through syslog-ng and not third party shippers. This means that my logstash server is accepting via ...
4
votes
2answers
1k views

What is this in my syslog and should I be concerned?

I'm seeing a lot of the following line in /var/log/syslog: Jun 21 14:36:15 my-server kernel: [416219.080061] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:the-mac-address:08:00 SRC=0.0.0.0 ...
1
vote
0answers
168 views

How to dynamically generate $LocalHostName value rsyslog

I have set up a central remote syslog server where I am sending all my logs. There will be many machines logging to the syslog server. On the client machine, in the rsyslog.conf I am trying to modify ...
5
votes
2answers
4k views

how to filer rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based ...
0
votes
1answer
206 views

intercept, evaluate, change syslog messages

is it possible to intercept syslog messages and evaluate (in special cases change) them before they are written into /var/log/? At the moment i m using inotify to monitor the log file and write the ...
2
votes
3answers
4k views

How do I stop postfix log info going into syslog?

We have a vps running Ubuntu 10.04.4 LTS, and while trying to find a solution to a php problem, I've become aware of what looks like a problem with the syslog system - I'm not sure though. The ...
3
votes
1answer
2k views

How to configure rsyslog to log into PostgreSQL without too much latency?

I'm trying to configure RSyslog on a Debian machine to log everythingo into PostgreSQL, while also logging as usual on disk. I'm using a pretty stock Debian configuration and I activated the related ...
-1
votes
2answers
438 views

Syslog-ng.conf csv parser lost first columns

I try to split information that come from IIS server with syslog-ng configuration. I create and fill the syslog-ng.conf but my csv parser lost the first column. let see: source s_network { ...
4
votes
3answers
718 views

Server crashes Sundays at 6 a.m. - out of memory

I have a weird problem: Every Sunday at 6 am my LAMP server crashes. Looking at the logs I see about 500 apache2 processes at the time (this is a test server without any load - especially not at 6 am) ...
-1
votes
2answers
488 views

Rsyslog: Difference between logging to a UNIX domain socket or an INET socket (UDP)

I am observing the following behaviour when logging to syslog from an external application: if I send a well-formed syslog message to a UDP socket, rsyslog correctly parses it, however if the very ...
4
votes
3answers
1k views

Wildcard support for InputFileName in rsyslog?

We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName? Example: InputFileName: ...
0
votes
1answer
324 views

syslog-ng stopped and don't want to start

I noticed lately that my syslog is empty. I tried restarting it but i get this error: $ /etc/init.d/syslog-ng reload Reload system logging: syslog-ngsyntax error in /etc/syslog-ng/syslog-ng.conf at ...
0
votes
2answers
242 views

log server setup and testing, with log manager opensource

I've been trying to get a new, centralized, log-server up and running for some testing and have run into some problems. First part is that I've installed Kibana but can't get anything indexed, tried ...
1
vote
3answers
819 views

SSD read errors; should I be worried?

An SSD just over a month old is producing read errors in my syslog whenever rsync backs it up: [276877.360221] ata1.00: exception Emask 0x0 SAct 0x1 SErr 0x0 action 0x0 [276877.360226] ata1.00: ...
0
votes
1answer
172 views

Can Rsyslog process messages before saving them?

The messages that I'm sending to syslog have some tags like so: "[date] [text here] tags:tag1,tag2,tag3 [more text here]" I already have a rule that only saves lines that contain the text "tags:" ...
3
votes
3answers
8k views

CentOS 6: strange page allocation failure messages [duplicate]

I set up a new Server with CentOS 6.4 final as successor for an old mysql server and I'm facing some problems with it. From time to time mysql connections are being disconnected. Furthermore the ...
0
votes
0answers
60 views

VMware ESX/i syslog content

I am working on an expansion of our monitoring footprint, and we are currently looking at including data from our visualized environment. As our monitoring license is based on logged volumes, and we ...
0
votes
1answer
229 views

Can I collect Syslog events in the Windows Event Collector? [duplicate]

I have a couple of *nix based systems that I'd like to start collecting logging information for. Is there a way to forward Syslog events to a Widnows server running the Windows Event Collector ...
1
vote
1answer
389 views

ubuntu server becomes unresponsive via web, ftp, ssh and more

I have a ubuntu server hosted and a couple of times it becomes unresponsive to everything, until a hard reboot is done.. i have pulled the logs but i need a little bit of help working out what they ...
0
votes
2answers
748 views

Setting up SysLog on Windows

I'm trying without any luck to use NTSysLog in order to grab my network computers Security Logs and send them into a Log Service (Loggly in this case). I can install and run NTSysLog from a Windows 7 ...
1
vote
1answer
641 views

Netflow to syslog converter

Is there any way to have netflow v9 converted to syslog? Which would be the best way to have the following idea working? Procedure: 1) The router sends UDP with the following structure: ...
0
votes
2answers
285 views

Is it possible to modify the date/time format for sendmail logs?

CentOS 5.x | SendMail I'm cross-referencing logs with another application/server and would like to change the date format on the SendMail maillog. Presently it's MMM DD HH:MM:SS Is there any way ...
3
votes
3answers
452 views

Find out how long a user was logged into a Linux server

In my Debian Squeeze server, all user logins and logouts are recorded in the file /var/log/auth.log Jan 28 07:11:06 xen8 sshd[29826]: pam_unix(sshd:session): session opened for user root by (uid=0) ...
0
votes
2answers
432 views

Server reboots, no idea why [closed]

I'm by no means experienced with system administration. I have a Linode vm mostly for the fun of it, hosting a webserver (nginx -> nodejs) and a Minecraft server I share with some friends. I ...
1
vote
0answers
122 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
2answers
2k views

IIS Advanced Logging Forward to Syslog

I am looking for a method that would allow us to forward the IIS Advanced Logging logs to a centralized log source via syslog or something similar. We are able to perform this currently for the ...
2
votes
1answer
495 views

Sending output from php script called from bash script to syslog

Sending output from php script called from bash script to syslog Im trying to create a bash script (to be called by a cron job) which calls a php file (which I have not made). Calling the php file is ...
2
votes
1answer
275 views

Rsyslog messages are truncated, not sent to the correct file

On Ubuntu 10.04 LTS, I'm using the stock rsyslog configuration and added a custom file in /etc/rsyslog.d with the following contents: # cat /etc/rsyslog.d/62-pc local3.debug /var/log/pc/debug.log ...
2
votes
2answers
464 views

rsyslog - regex trouble

I'm trying to setup the logentries service. If a log entry has a token in it then I would like to send it to api.logentries.com:10000. The token is a guid in the format ...
1
vote
1answer
89 views

In logrotate, where does postrotate log errors?

If there are errors in the postrotate script block, where are they logged in Ubuntu?
3
votes
2answers
2k views

Use a Mac (10.8) as a remote log server

I'm trying to use my Mac Mini server as a remote log server for our router. I set the router to forward the logs to the server but I'm not seeing the logs anywhere in the console app. Am I missing ...
1
vote
1answer
142 views

Unable to log iptables

I'm having trouble getting iptables to log to any file. My iptables looks like: Chain INPUT (policy ACCEPT 1366 packets, 433582 bytes) pkts bytes target prot opt in out source ...
1
vote
0answers
235 views

Snort/Barnyard2-1.10 LOG_SYSLOG_FULL Output Logging

With log_syslog_full opertion mode set to complete you get the below output. Can some explain to me what the bold parts are? I have been searching and cannot find any documention explaining the new ...
1
vote
1answer
90 views

NetBSD syslog timestamp format

Syslog uses a timestamps like the following: Sep 19 13:36:56 Is there a way to adjust the format (to add the year for example) without touching the source code? I am some what shocked to find that ...
4
votes
4answers
1k views

CentOS centralised logging, syslogd, rsyslog, syslog-ng, logstash sender?

I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc. I've found a few different options but I'm not sure what would be best. ...
0
votes
1answer
353 views

Route from Cisco ASA over site to site VPN

I want to be able to push f/w logging traffic to a server at a remote site. This server is accepting syslog traffic on port 514. In the ASA I've configured it to use this server as a syslog server. ...
-1
votes
2answers
744 views

MySQL server stops randomly. Is it possible that system kills it during high loads or low available memory? [duplicate]

Possible Duplicate: How to diagnose causes of oom-killer killing processes I have an Ubuntu webserver (Apache + MySQL + PHP) on a very small machine on Amazon Web Services (EC2 micro ...