syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

0
votes
1answer
103 views

Remote Logging for Syslog

I'm trying to set up syslog to accept remote logging. I already have changed the config file and set up the syslogd with "-r m 0" to accept remote logging. Now i need to change the /etc/services file. ...
11
votes
4answers
9k views

Linux: logwatch(8) is too noisy. How can I control the noise level?

Our Linux systems run logwatch(8) utility by default. On a RedHat/CentOS/SL system, Logwatch is called by the /etc/cron.daily/ cronjob, which then sends a daily email with the results. These emails ...
0
votes
1answer
127 views

Odd Postfix message right before system crash/freeze. What does it mean?

I just had my web server lock up on me, it stopped serving pages and wouldn't accept any SSH connections. I was able to reboot this server through the control panel Linode provides. Below you'll see ...
1
vote
3answers
192 views

Syslogd: translate facility on log messages going to a server

I want to send some log messages out to a remote log server, and change the facility on them to a configured value so the log server can tell more easily that they came from my hardware. That is, all ...
2
votes
2answers
2k views

Using rsyslog to create different log files for different processes

Scenario: I am running a cluster of machines. Each machine runs various python programs with a unique (across the cluster), but dynamically set, ID. Right now, they are all logging locally. So, I ...
1
vote
0answers
176 views

Rsyslog's RELP format; experience?

1) In your experience, does rsyslog's RELP log transfer format require a significant amount of resources over what plain TCP syslog transfer would use? (cpu, disk i/o, network) 2) IYHO, is TCP ...
0
votes
2answers
159 views

Determine which programs are logging to a specific syslog facility

Is there any way to determine which daemons are logging to a specific syslog facility? (spec. rsyslog) What I am specifically looking for is who logs to the auth.* severities. A 2001 audit for ...
3
votes
2answers
425 views

Formal separation marker of syslog events?

I've been looking at RFC5424 to find the formally specified marker that will end a syslog event. Unfortunately I couldn't find it. So If I wanted to implement some small syslog server that reacts on ...
0
votes
1answer
413 views

Zenoss - Performance issues with captured events

The problem I'm manually inserting events into Zenoss through the zensendevent command line tool. The events are successfully inserted into Zenoss. The problem is that I can just insert about 8 ...
3
votes
3answers
712 views

Forward UNIX syslog to Windows Event viewer

I'm running a pfSense firewall which runs syslog and can forward it's logs to a remote syslog server. I'd like to be able to view these on my SBS 2011 server's event viewer, via a subscription. I ...
2
votes
1answer
627 views

How to setup SysLogHandler with Django 1.3

I'm having no luck finding any information on setting up syslog logging with Django 1.3 dictionary configuration. The Django documents don't cover syslog and the python documentation is less than ...
2
votes
1answer
197 views

How can I get around a length limit on EC2 system logs retrieved through the console?

I am running ami-ccf405a5, which is a Ubuntu 10.10 Maverick EBS boot from alestic.com in a micro instance in us-east from the AWS Console. I use the user-data field to load in a script, the beginning ...
0
votes
2answers
74 views

Configuring Syslog to accept remote log submissions

By default syslog daemons don't accept remote log submissions. I need mine to, but don't really have a clue how to configure that. Can anyone help me out, send me a good tutorial, etc. I have been ...
0
votes
1answer
445 views

Qmail - replacing multilog with splogger

I currently manage a qmail installation, set up on Centos using the qmailrocks guide (which seems to have vanished from the Internet now). So - daemontools, multilog, vpopmail, qmail. I've been asked ...
1
vote
1answer
290 views

Best practices for discarding messages in (r)syslog?

I've setup a central rsyslog server that is writing events to a MySQL database. Looking through the events one sees all kinds of events that are probably unnecessarily captured. On RHEL/CentOS ...
0
votes
2answers
1k views

Proftpd doesn't send xferlogs to syslog

I have a Proftpd v1.3.2 server, and I need to send every logs (system logs + auths logs + xferlogs) to a remote syslog server. It works fine for system+auth logs. But even if "TransferLog" was removed ...
3
votes
1answer
585 views

OSX /var/log/system.log — where do i define pruning interval?

I have a script that periodically checks /var/log/system.log and I've noticed across our network that some machines keep logfiles for a month through reboots and other activities, while some purge the ...
1
vote
4answers
821 views

remote monitoring of linux logs

I would like to monitor syslog logs on few dozens of linux servers. In ideal world I'd prefer pull method where central monitoring server collects once per day logs from all machines via ssh, applies ...
2
votes
1answer
2k views

Syslog web interface recommendations?

We've got a central log server (syslog-ng) and I'd like to provide a slick web interface for viewing the logs. Most of what I've seen are either horribly broken, outdated, or just fugly. I'm not very ...
0
votes
2answers
286 views

server log problem

I have a linux server running Debain. My logs are not updated in my var/log/messages. Deamon syslogd is running. Below are the logs are updated in my var/log/messages. Apr xx 20:40:24 xxxxx -- MARK ...
3
votes
1answer
258 views

Adding Apache log export via Syslog still writing local log

we have configured syslog/syslog-ng to export Apache logs ton a dedicated log server, for security and log check reasons. But I want to keep a copy of the error log on Apache server for easy ...
6
votes
1answer
5k views

Rsyslog.conf disable mail.info and/or disable postfix reporting

I have log entries like: Apr 8 10:25:31 monitor postfix/smtpd[3131]: connect from localhost[127.0.0.1] Apr 8 10:25:31 monitor postfix/smtpd[3131]: lost connection after CONNECT from ...
0
votes
1answer
5k views

How does one enable remote listening with rsyslog?

I'm configuring a Debian Squeeze server to receive syslog from some appliances, but rsyslog is refusing to listen to UDP 514. The closest I have been able to get from it is to make it listen to TCP ...
2
votes
2answers
731 views

Netcat, Syslog, UDP, and <134>

Listening with netcat on UDP 514 to syslog data I see that each sent log message is separated by <134>. Does anyone note what <134> is?
1
vote
1answer
291 views

What do the extra parts of the iptables ping log entry mean?

I'm dropping all ICMP type 8 packets on the INPUT chain and so now I'm seeing log entries as a Fabric script tries to contact another server, like this: kernel: INPUT DROP IN=eth0 OUT= ...
0
votes
1answer
469 views

what does “net_ratelnet_ratelimit: 222 callbacks suppressed” mean?

The application is still responsive, but when I ssh into the server i cant do anything because errors keep popping up.
1
vote
1answer
403 views

rsyslog to fifo

I want to have a rsyslog log its data to a fifo that a daemon creates. However, if the daemon isn't running and the fifo isn't there then rsyslog will just start writing to a file in its place. Is ...
2
votes
1answer
332 views

how to make linux cdrom mounting/unmounting show up in syslog

I'd like a record of every time the cdrom drive is mounted. Ideally this would be in syslog. The system is CentOS 5.5 linux.
10
votes
4answers
15k views

Switch on PAM debugging to Syslog

I hate PAM since it came up. How do I switch on PAM debugging in Debian Squeeze at the admin level? I have checked every resource I was able to find. Google, manpages, whatever. The only thing I ...
0
votes
3answers
8k views

How do I setup a syslog server for my network?

I would like to setup a syslog server to forward all log file from all of my VMs and servers. I really don't much about what is out there. So I turn to the community, Something on Linux is fine, what ...
0
votes
1answer
2k views

How do you enable and configure syslog server in OSX server 10.6?

I am completely new to OSX server. How do I turn on the syslog service? I also need it to accept connections from remote network switches. This seems to answer the second part of my question.
6
votes
3answers
780 views

What's the best centralized syslog viewing tool for *nix out there

Looking for what people think are the best for doing web viewing of a centralized syslog server. I am open to using any syslog server also. EDIT I actually went with GrayLog2
0
votes
1answer
806 views

How to get perl stderr to httpd log file when using syslog

This question is about HTTPD (Apache) 2.? on centOS and modperl 1.7+ When I use the apache directive ErrorLog logs/error_log, my perl warnings show up in the error_log file. When I change this to ...
2
votes
4answers
1k views

Stop Munin messages from /var/log/syslog

I am using munin on a system which is adding a log entry in syslog everytime the munin-node cron job executes. It is not an issue but it sometimes makes other errors spotting difficult. There are ...
42
votes
4answers
70k views

Splunk is fantastically expensive: What are the alternatives? [duplicate]

Possible Duplicate: Alternatives to Splunk? This has been discussed, but it has been several months, so it may be time to revisit it: Earlier discussion RE Splunk alternatives For the ...
5
votes
6answers
5k views

Recommended software for a Centralized logging server? [closed]

I'd like to centralize logging for all my servers. Server operating systems include Windows 2003, 2008, Ubuntu and Redhat. I think Splunk is too expensive, has anyone set up something like this ...
0
votes
2answers
610 views

Detect port scanning using splunk

i have setup a log server with splunk running on it. i pinged one of the clients using backtrack....Does this also genrate log which is sent the log server?????? I wanted to detect port scanning ...
3
votes
3answers
4k views

Software to send windows notification eventlogs to linux syslog server and encode to utf8

I am trying to setup a windows 2008 server so it's able to send the eventlog messages to an syslog-ng server running linux. I'd prefer something native but I guess it won't be possible. UPDATE The ...
1
vote
1answer
826 views

syslog.conf - redirecting log entries from /var/log/messages

I'd like to redirect all messages from dhcpd to their own log file, rather than having them appear in /var/log/messages. When I put the following lines in /etc/syslog.conf: !dhcpd *.* ...
1
vote
2answers
936 views

How to redirect logs from Cisco firewall to a specific file?

We need to redirect the logs from our Cisco firewall(SA520-K9) to syslogd server(it's a CentOS server). The settings are done on the firewall. But the messages from firewall are going to ...
1
vote
1answer
627 views

Logparser for Linux (syslog) logs?

I'm looking for something like logparser on Windows. Requirements: simple tool, not engine like octopusy or sth, able to select on text in message part, start search in log from checkpoint on ...
0
votes
1answer
631 views

Stop messages from going to /var/log/debug

I have a daemon running, milter-regex that is absolutely polluting my /var/log/debug file. After some digging around I thought by adding the "daemon.err;daemon.notice /var/log/milter-regex" that that ...
2
votes
2answers
489 views

Lots of DNS queries

I have a lot of this entries in /var/log/syslog , 1 each 20 seconds. I see that are rejected but nevertheless I don't think is a good thing that somebody is pinging my server for DNS checks or ...
3
votes
2answers
2k views

exclude syslog facility from all others

I'm adding some custom logging on local0 in syslog. Writing these messages to a specific log is easy, in my syslog.conf I have local0.* -/var/log/my.log But how can I exclude local0 from all ...
0
votes
0answers
478 views

Anacron jobs can't access /dev/console

On my Ubuntu 10.04 server, "anacron" is sending error emails daily: Subject: Anacron job 'cron.daily' on xyz.com /etc/cron.daily/logrotate: /etc/init.d/apache2: 235: cannot open /dev/console: ...
0
votes
2answers
1k views

Solaris syslog.conf. What are root and operator?

In /etc/syslog.conf #ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */ # # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. ...
4
votes
5answers
2k views

Script to delete files older than 30days

Shell script should not delete any files under* root dir*. My* path will be like /export/home/ftp/ ... I did some research and figured out the way for finding and deleting the files older than 30 ...
0
votes
1answer
589 views

ASA5520 stops sending to splunk syslog

I have an ASA5520 that is set up to send logs to a splunk syslog server. the setup works for a while, usually around 24 hours or so, but then stops until either the logging is reconfigured (twiddling ...
2
votes
4answers
2k views

nginx logrotate config

Whats the best way to rotate nginx logfiles? In my opinion, I should create a file "nginx" in /etc/logrotate.d/ and fill it with the following code and do a /etc/init.d/syslog restart after that. ...
1
vote
5answers
227 views

Is there any web software to log syslog evens?

Is there any good website to keep Syslog events? I need a website to manage Syslog events and group them based on their priority.