syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

1
vote
2answers
144 views

Server logging goes haywire and some system services die until hard reboot

The gist of our problem is that we lose ssh access to our VPS and our logfiles get all mixed up. Doing a hard reboot through our hosting provider's web console seems to fix things, but the problem ...
1
vote
1answer
60 views

Logging in iptables

I have created rules in iptables to log and edited the rsyslog.conf file to output any message which contains "iptables" to a different log file. It seems that it is logging to both places, the ...
6
votes
2answers
3k views

How does an administrator generalize alerting when an event doesn't happen?

Often my users require me to be just as responsible for knowing if an event hasn't happened. I've always had to build custom and brittle solutions with cron'ed shell scripts and lots of date edge ...
1
vote
1answer
2k views

Apache2 forward logs to rsyslog AND locally

Right now I'm storing apache2 logs locally: ErrorLog /var/log/apache2/one.error.log CustomLog /var/log/apache2/one.access.log common How can I keep storing the logs locally but also forward ...
3
votes
4answers
2k views

Stop Munin messages from /var/log/syslog

I am using munin on a system which is adding a log entry in syslog everytime the munin-node cron job executes. It is not an issue but it sometimes makes other errors spotting difficult. There are ...
0
votes
1answer
90 views

same filter works in rsyslog but not syslog

I have the following filters in new cpanel server with rsyslog to forward log to a central log server(use rsyslog), but these filters didn't work in older cpanel server with syslog. I don't see any ...
0
votes
2answers
626 views

Find syslog priortiy/ severity of a message

Is there a way to find the syslog priority or severity of log entries using a standard unix tool? For example I could grep for the word error in a log. But not all logs will state the word "error" ...
0
votes
1answer
1k views

Syslog info from vmware hosts to graylog are not collecting correctly

I have a graylog syslog server running on debian, running fine. I wanted to send syslogs from our Vmware ESX hosts to Graylog. I point a ESX host to the syslog by doing the following: I open vSphere ...
2
votes
1answer
1k views

Ubuntu syslog: After log rotation nothing is written on /var/log/syslog

I've been running a Ubuntu VPS for a few weeks now, so a couple of monthly log rotations took place yestarday. For things like /var/log/wtmp things look as expected: logfile has recent entries, while ...
2
votes
3answers
147 views

Syslog to IPFIX

I was reading about logs (syslog) being exported in IPFIX format. And some products which do this as well. What I didn't find, was if there is any standard/known ways of doing this ?. Like if there ...
4
votes
0answers
453 views

How do you use patterndb variables in syslog-ng?

I'd like to parse some custom (network appliance) syslog files to create my own formatted output. As I am new to syslog-ng & patterndb I have been trying to build an example using the ...
1
vote
0answers
679 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
1
vote
2answers
4k views

Cisco ASA syslog format description [closed]

Where can I find Cisco ASA syslog format description? Log example: Dec 11 08:01:24 <IP> %ASA-6-302015: Built outbound UDP connection 447235 for outside:NTP_Server_2/<port> ...
1
vote
0answers
271 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages ...
4
votes
4answers
1k views

CentOS centralised logging, syslogd, rsyslog, syslog-ng, logstash sender?

I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc. I've found a few different options but I'm not sure what would be best. ...
2
votes
1answer
300 views

cisco ios - syslog version

I am writing small article on Syslog and I was wondering, if there is any resource that tells me what version of Syslog is supported in what ios version? By Syslog version I mean rfc 3164/rfc ...
2
votes
2answers
734 views

Log ssh sessions to rsyslog

How can I setup rsyslog to log commands typed in a ssh session? Just in case someone unauthorized ever accesses the system, I'd like to know what he did.
2
votes
1answer
522 views

Pipe program output to rsyslog

I have a process running that writes it's output to a file, like this. processx > /var/log/processx.log 2>&1 How would I write/pipe/forward this to rsyslog instead (including the ...
0
votes
1answer
211 views

syslog, kernel.warning and iptables innerworking

Im tinkering with my iptables logging at the moment. So I got my syslog to use another log file with tips from the web. basically you end up changing some chains and rules plus aan extra line in the ...
0
votes
1answer
2k views

Wireshark - Capture syslog traffic form local workstation

I am using wireshark version 1.10.3 on windows 7 x64 enterprise. I am trying to capture all outbound UDP traffic, in particular syslog traffic. I have tried a capture filter UDP, but all I can see ...
3
votes
1answer
1k views

Failing forwarding rsyslog

I have a centralised rsyslog server A that receives a bunch of logs through TCP from servers X, Y, Z. It then stores the files on disk but also forwards them to logstash server B (on a different ...
0
votes
3answers
6k views

Splunk How do I get syslog to send data into splunk from remote machines

If I install the splunk forwarder, I can get the remote data into my splunk install, and index my logs, and searching is great. But I have a number of router devices and other devices that run syslog, ...
0
votes
1answer
485 views

Route from Cisco ASA over site to site VPN

I want to be able to push f/w logging traffic to a server at a remote site. This server is accepting syslog traffic on port 514. In the ASA I've configured it to use this server as a syslog server. ...
2
votes
1answer
3k views

Send Apache Access Logs to syslog

We have IBM HTTP Servers (Based on Apache 2.0) and want to send the access logs to syslog. (in addition to error logs which does work) The config we are using is as follows: ErrorLog ...
0
votes
0answers
48 views

software to view logs on remote server [closed]

I have configured syslog server on my linux machine like this Linux Machine (syslog client) -- > Linux Machine (syslog server) I have configured it and its working properly. Now, the problem is I ...
1
vote
1answer
3k views

Getting logs from remote clients via rsyslog

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp ...
3
votes
2answers
2k views

Send logs to mulitple syslog servers

we have a cisco 6500 chasis and I would like to send to the logs to two separate syslog servers. At present, it is already sent to one syslog server. That goes to our security team. But we would like ...
3
votes
2answers
4k views

Can a hostname be added to syslog-ng?

How can syslog-ng be configured to send both the hostname and the IP address. Currently, logs are sent with the IP address of the device/machine, but we want to add the hostname so I could keep my ip ...
0
votes
1answer
1k views

NTP synchronisation not visible in syslog

I am trying to set up a local NTP server for our LAN. I am able run ntpdate server_ip to manually update the time. However, ntp daemon does not seem to be logging anything into syslog, and so I can't ...
1
vote
1answer
2k views

/var/log/messages spammed with POLLERR messages

I've started seeing /var/log/messages growing in size indefinitely with these lines: Aug 1 12:47:27 linux-jblp syslog-ng[1947]: POLLERR occurred while idle; fd='16' Process 1947 is this: root ...
2
votes
1answer
253 views

Disable syslog remote connections

I'm securing a server and closing all the ports that are not used, but i can't close the syslogd port, even worse I cannot find where the syslogd is called. This is what sockstat shows me: USER ...
2
votes
1answer
1k views

Strange syslog for my server

Today i go on my log with nano /var/log/syslog I have this, and i think it's not very good : Aug 27 06:25:02 ks3309528 rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="2235" ...
1
vote
1answer
427 views

syslogd filtering not working on FreeBSD

I am failing to get filtering by program or facility working in FreeBSD syslogd. I added local6.debug /var/log/test.log !testd *.debug /var/log/test.log to my ...
-1
votes
2answers
618 views

Rsyslog: Difference between logging to a UNIX domain socket or an INET socket (UDP)

I am observing the following behaviour when logging to syslog from an external application: if I send a well-formed syslog message to a UDP socket, rsyslog correctly parses it, however if the very ...
2
votes
1answer
2k views

How to send NAGIOS alerts to OSSIM server

I've installed an OSSIM server and I wanto to retrieve the alerts generated by a remote Nagios server in order to analyze them and perform correlation of security events. Before putting hands on it, ...
4
votes
3answers
863 views

To use syslog or not [closed]

Can someone make a decent case here: I want to use syslog so logging is integrated and so I can direct it based on severity etc not to mention log rotate, but at the same time I like the idea of ...
3
votes
1answer
2k views

Error setting capabilities, capability management disabled;

root@monitor:/opt/observium# service syslog-ng restart Stopping system logging: syslog-ng. Starting system logging: syslog-ngsyslog-ng: Error setting capabilities, capability management disabled; ...
3
votes
2answers
718 views

How can you filter mail.info from syslog?

How do I filter mail.info from /var/log/syslog (rsyslog.conf/Debian) while keeping messages greater than or equal to mail.warn? I've tried just about every different variation of appending and ...
3
votes
1answer
8k views

How do I setup rsyslog to send all logs to multiple remote servers?

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails. *.* @@server1 *.* @@server2 If I put the above in ...
0
votes
1answer
237 views

syslog-ng 2.0.9 closing tcp connections from some clients instantly..?

I've a syslog-ng instance on 2.0.9, which is old, but... this is enterprise IT and upgrading the versions is... fun... running on Solaris 10. I have this strange problem where some clients stop being ...
4
votes
3answers
999 views

Server crashes Sundays at 6 a.m. - out of memory

I have a weird problem: Every Sunday at 6 am my LAMP server crashes. Looking at the logs I see about 500 apache2 processes at the time (this is a test server without any load - especially not at 6 am) ...
5
votes
1answer
3k views

How to maintain the log source host using logstash

I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter. In the ...
1
vote
0answers
280 views

How to dynamically generate $LocalHostName value rsyslog

I have set up a central remote syslog server where I am sending all my logs. There will be many machines logging to the syslog server. On the client machine, in the rsyslog.conf I am trying to modify ...
-1
votes
2answers
662 views

Syslog-ng.conf csv parser lost first columns

I try to split information that come from IIS server with syslog-ng configuration. I create and fill the syslog-ng.conf but my csv parser lost the first column. let see: source s_network { ...
0
votes
1answer
304 views

intercept, evaluate, change syslog messages

is it possible to intercept syslog messages and evaluate (in special cases change) them before they are written into /var/log/? At the moment i m using inotify to monitor the log file and write the ...
4
votes
1answer
3k views

How to configure rsyslog to log into PostgreSQL without too much latency?

I'm trying to configure RSyslog on a Debian machine to log everythingo into PostgreSQL, while also logging as usual on disk. I'm using a pretty stock Debian configuration and I activated the related ...
5
votes
2answers
3k views

Avoiding log noise from cron jobs - with syslog-ng rather than syslog

On my small Debian squeeze web server, I have syslog-ng installed (not syslogd, like in this question). Generally, my logs are nice and quiet, with -- MARK -- lines. My /var/log/syslog, however, ...
1
vote
3answers
9k views

Syslog not logging anything; /var/log/syslog is empty

Recently sendmail stopped accepting messages for delivery on my Solaris 10 x86 machine. I am trying to diagnose the problem but syslog doesn't seem to be working either. My /etc/syslog.conf: #ident ...
3
votes
2answers
2k views

Use a Mac (10.8) as a remote log server

I'm trying to use my Mac Mini server as a remote log server for our router. I set the router to forward the logs to the server but I'm not seeing the logs anywhere in the console app. Am I missing ...
0
votes
1answer
471 views

syslog-ng stopped and don't want to start

I noticed lately that my syslog is empty. I tried restarting it but i get this error: $ /etc/init.d/syslog-ng reload Reload system logging: syslog-ngsyntax error in /etc/syslog-ng/syslog-ng.conf at ...