syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

4
votes
1answer
7k views

rsyslog not logging messages

i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check ...
0
votes
1answer
839 views

Configuring 'audit' facility in syslog-ng on solaris server?

This is a follow-up to this question. mghocke was kind enough to help me out with that question, but this is really a separate question, therefor a new post. I really don't know a lot about syslog, ...
2
votes
1answer
685 views

Moving from syslog.conf to syslogng.conf

I'm moving a Solaris box from syslogd to syslog-ng, because the Solaris version of syslogd obliterates the original source hostname on the logs. I'm looking through the syslogng.conf documentation, ...
3
votes
3answers
5k views

Software to send windows notification eventlogs to linux syslog server and encode to utf8

I am trying to setup a windows 2008 server so it's able to send the eventlog messages to an syslog-ng server running linux. I'd prefer something native but I guess it won't be possible. UPDATE The ...
1
vote
2answers
198 views

Alternative solution to replace aging swatch

We are using swatch installation to sort through 3-5 gig worth of networking syslog and alert us on patterns , we are using splunk to index and search the data but splunk alerting capabilities are ...
1
vote
1answer
124 views

cisco syslog host dns

When I tell my Cisco router (IOS) to (config)# logging syslog.mydomain.com and then look at the config, the config contains the IP of syslog.mydomain.com, i.e. 1.2.3.4. Now the whole purpose of ...
1
vote
1answer
4k views

How to log to /var/log/messages on Debian Squeeze as normal user?

In Ubuntu I could do something like: sudo echo something | logger -t logstuff Then I would get well formatted message in syslog (/var/log/messages). On Debian Squeeze that isn't the case, the above ...
1
vote
1answer
71 views

Syslog message '^@' indicates server crash

The php-cgi's died on a vps I look after and the only syslog entry is this followed by me restarting the VM: ...
0
votes
1answer
315 views

How to process, transform and re-send 1000req/sec log entries from syslogd?

I currently have two machines that receive about 1000 HTTP req/sec both and generate a log entry on every request. This log is centralized on a syslog daemon running on a different machine. For ...
2
votes
1answer
301 views

Rsyslog Discarding Unwanted Messages

Once again, i found that Rsyslog is not as flexible as i expected... My application logs to LOCAL5.* ( depending on the severity ) I would like to see on my centralized log server only ...
1
vote
2answers
1k views

Postfix logs missing information on delivery status (postfix/smtp message)

I noticed a problem with postfix logs, that information on some of emails delivery status is missing. The issue affects about 1% of emails. "Healthy" log: <server># grep 8EB992EFBB44 ...
1
vote
1answer
839 views

HAProxy running in chroot jail is only logging started messages

I've configured my HAProxy server to run in a chroot jail logging messages to syslog socket. My problem is that the only messsages currently being logged are for when haproxy is starting up. May 26 ...
0
votes
1answer
1k views

syslog written on console

I have odd problem with syslog local7, my syslog configure the syslog to be written to local7.info /var/log/syslog_info it's working just fine for years but recent days one device syslog message ...
2
votes
2answers
875 views

VMware: Is my SYSLOG Collector running?

I am trying to determine if my Syslog Collector I just set up in vCenter 5 is working correctly. According to this VMware KB article and this VMware blog article, everything seems to be up and ...
4
votes
1answer
2k views

Best Practices for rotating syslog logs on RHEL with different schedules?

OS: Running RHEL 5.6. Situation: I need to rotate /var/log/messagees on a different schedule than the rest of the syslog logs. By default syslog logs are rotated weekly based on the ...
-1
votes
2answers
394 views

Can it be because of any Kernel Bugs?specifically spin lock

We are running ubuntu 11.04 with 2.6.38-13-generic kernel on Intel(R) Xeon(R) CPU E5620 @ 2.40GHz with 48 GB RAM dedicated server with Hardware RAID. top command output is showing many kernel ...
3
votes
2answers
3k views

Getty flooding syslog after kernel upgrade with “cannot open as standard input”

I just updated my kernel on an Ubuntu 9.10 system from 2.6.32.1 to 2.6.33.5, and everything seemed to go well, except now my system log is getting flooded with errors from getty: Jul 25 11:01:54 ...
3
votes
2answers
6k views

rsyslog: How do I direct messages from all remote machines to one file?

We have a syslog server and we have all our servers logging to it. We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for. Anyone know how to ...
4
votes
3answers
4k views

rsyslogd: Any way to get around the number of local facilities?

We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
2
votes
1answer
1k views

syslog writing to general instead of specific file

I'm running Ubuntu and Postgresql 9. I've enabled postgresql to log to syslog, and added the following directive to the config file: syslog_facility = 'local0'". I've tried to configure syslog ...
0
votes
2answers
147 views

What is the “facility” of SnapGear SG560 System Log Syslog

My SnapGear (now McAfee) SG560 (firmware Version 4.0.10) has a "remote system log" feature, which can send syslog-type data to a host in my network. It's working, but writing to /var/log/messages. I'd ...
2
votes
3answers
2k views

How to stop syslog from listening to 514 on CentOS 5.8

I have a CentOS 5.8 machine (with regular syslog) that for some reason is listening to port 514, even though it is not started with "-r" (to receive remote syslog messages). # netstat -tulpn | grep ...
3
votes
2answers
2k views

Increase rsyslog/syslog precision to include fractional seconds?

I use syslog and rsyslog to handle logging on my Linux & FreeBSD systems. The timestamp is currently in seconds but I would like to increase the precision of these timestamps to include ...
1
vote
1answer
541 views

Additional Security Measures for Syslog over SSH

I'm currently working on setting up some secure syslog connections between a few Fedora servers. This is my currently setup 192.168.56.110 (syslog-server) <----> 192.168.57.110 (syslog-agent) ...
0
votes
1answer
345 views

On Solaris, how to log IP when using winbind auth and invalid user?

This is on Solaris 10 sparc platform. I'm trying to make our denyhosts script block the dictionary ssh attacks. Unfortunately, the logging does not show an IP when the user name is invalid. We are ...
1
vote
2answers
3k views

Syslog-ng: how to change a message before sending to a remote host

I'm using syslog-ng 1.6.8 on SLES 10. From this machine, I need to forward all events to the remote host 10.30.38.115. But preliminary I have to change messages a little bit, adding "MyMark" prefix to ...
0
votes
1answer
376 views

Opensource log correlation application - an alternative to SEC?

is there a opensource log correlation application? I know only SEC[1]. The best would be if the application could work in clustered setup and would understand even structured logs, not only free-text ...
0
votes
1answer
114 views

syslog - log line classifications [closed]

A very generic question; in the context of a programmer, with operational aspect of the process (program) in mind. Is there any sort of best-practice / guide to classify messages, particularly in the ...
1
vote
2answers
2k views

RSyslog does not work with a log file located outside of /var/log

I am unable to get rsyslog to write to a log file located in a directory other than /var/log. The server is RHELS 5.6 and for the most part with a default configuration. Other than the rsyslog ...
7
votes
5answers
2k views

Is centralized logging a good idea?

Right now, my organization has a solution comprised of 10+ components, and some have a log file per thread. Since files are rotated hourly, tracking all of this is a chore. Is centralizing all ...
3
votes
4answers
788 views

rsyslog or a similar distributed logging standard, for Windows?

I have a bunch of Windows Servers that run a bunch of apps, that log into local text files. I want to aggregate these text files into a centralized log server, where I can search them. Building ...
1
vote
2answers
1k views

Remote Logging with syslog

I have two machines running FreeBSD, bsdclient and bsdserver. I am trying to setup remote logging such that bsdclient sends all the logs to bsdserver. My syslog.conf on bsdclient goes like this *.* ...
11
votes
7answers
3k views

How did you implement log management on your servers?

I'm trying to figure out how other people implement their log management systems. I have 20-30 Linux servers and a few Windows boxes (most of them virtualized). We utilize a lot of Perl and Bash ...
2
votes
2answers
487 views

What is the best method/software to log from a Windows 2008 server to your standard (syslog) loghost?

Centralized logging is a good thing, and all unix/linux/bsd machines are able to syslog over udp/tcp. Windows servers have the event log. I've previously used NTSyslog (http://ntsyslog.sf.net) for ...
2
votes
5answers
1k views

Free / Open Source — Log Management appliances/platforms [duplicate]

Possible Duplicate: Alternatives to Splunk? I need to deploy a centralized log management device or appliance. It should be able to handle at least 100 devices giving it input. I would ...
5
votes
3answers
1k views

Where is dhcpd's syslog message formats documented?

I am looking at bunch of syslog messages written by dhcpd. I want to write a quick parser that can deconstruct the message into its component parts, but I don't know what the various parts mean. I ...
1
vote
1answer
1k views

Why does iptables output to /dev/console?

For some reason I see the output from this iptables rule $IPT -A FORWARD --jump LOG $IPT -A FORWARD --jump ACCEPT on the console eventhough I have disabled kern in /etc/syslog.conf #kern.* ...
2
votes
1answer
225 views

How can I get around a length limit on EC2 system logs retrieved through the console?

I am running ami-ccf405a5, which is a Ubuntu 10.10 Maverick EBS boot from alestic.com in a micro instance in us-east from the AWS Console. I use the user-data field to load in a script, the beginning ...
2
votes
3answers
536 views

free windows logs forwarding

I have the following problem. I have some log files (In Windows) and i want to forward them via syslog to a centralised log server (Linux). how could i do it ? I used snare , syslogagent , kiwi but ...
0
votes
1answer
1k views

Lots of nfs4_reclaim_open_state: Lock reclaim failed entries in syslog

I have an Ubuntu 11.10 VM set up in VMSphere. I'm storing some data on a nfs mount. The VM has been going down frequently. I haven't been able to pin the reason why down, but I think it has to do with ...
0
votes
2answers
387 views

log forwarding performance and OS bottleneck

How many logs/second can usually be handled by syslog servers? By syslog servers, I am referring to rsyslog, syslog-ng, splunk etc. The intent of the question is to find out at what logs/second rate ...
4
votes
1answer
273 views

Unusual server crash on EC2, syslog has line of ^@^@^@^@^@

Trying to get at the root of why a server went down for 20 minutes, I looked at the syslog for that time period and saw this: Jan 3 07:50:01 tools CRON[17085]: (munin) CMD (if [ -x ...
0
votes
1answer
669 views

Redirecting rabbitmq-server log messages to syslog

I have a CentOS machine running rabbitmq-server v2.2.0-1.el5, and rabbitmq is outputting it's log messages to various files under /var/log/rabbitmq. If there anyway to configure rabbitmq to tell it ...
0
votes
1answer
228 views

FreeBSD: Syslog configuration for wireless routers ( BlueSocket )

Problem: Trying to isolate the issue preventing one of our BlueSocket routers from logging to a FreeBSD syslog box. The one that is not logging has identical logging settings to the other but is on a ...
2
votes
2answers
2k views

Nagios plugins/commands output to syslog

Do you know if is there any easy way to send output of every check run by nagios to syslog?
0
votes
1answer
2k views

Linux [Hardware Error] message from kernel

Since yesterday I get the following message every few minutes: Message from syslogd@hostname at Nov 23 12:31:17 ... kernel:[8024326.816370] [Hardware Error]: MC4_STATUS: Corrected error, other ...
1
vote
1answer
2k views

How do I disable nginx sending messages to syslog?

My nginx sends lots of messages to syslog, but I don't need them. In my nginx.conf: error_log /var/log/nginx-error.log notice; ...... server { access_log off; ...
1
vote
2answers
683 views

How to set up mysql storage for certain rsyslog input matches?

I'm draining various logs from Heroku to an rsyslog linux (ubuntu) server and am starting to have a little more to bite off than I can chew in terms of working with my log histories. I am needing to ...
2
votes
1answer
874 views

snort not logging full output to syslog

I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
2
votes
2answers
191 views

Managing and configuring syslog-ng for very large logs

I have the logs traditionally kept in /var/log/ piped through syslog-ng. The logs can reach to the terabyte size on a daily basis. In order to make them more manageable. I would like break them out ...