Questions tagged [syslog]
syslog is a standard for logging messages about the operation of a system.
667
questions
0
votes
0
answers
2k
views
Send apache ssl access log to syslog
I'm having an issue piping apache ssl access logs to my syslog server. I've added the following line to my apache config:
CustomLog "|/usr/bin/nc -u <syslogserver> 514" "<134>%{%b %d %X}...
- 1,908
5
votes
1
answer
15k
views
nginx logs to syslog - connection refused
I'm trying to setup nginx 1.7.3 to send logs to syslog, but when I this configuration:
server {
access_log syslog:server=localhost;
}
this shows up in nginx's error log:
2015/01/15 21:42:47 [...
CommunityBot
- 1
1
vote
0
answers
1k
views
Syslog randomly logs bad time [duplicate]
Try as I might, I can't figure out why this server randomly timestamps syslog entries with bad time.
Here's a 5-minute stretch of syslog from a few minutes ago. You'll notice there are two places ...
-1
votes
1
answer
333
views
File monitoring using syslog [closed]
Can rsyslog, syslog-ng programs monitor change of file? I want to monitor files and receive the changes made to the file by syslog on server. Thank you.
- 614
5
votes
1
answer
7k
views
UDP Traffic from outside to docker container is dropped after container restart
following situation:
i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4
I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to ...
- 186
0
votes
2
answers
1k
views
syslog-ng prepending date to received logs, breaking patterns in patterndb
I'm setting up central logging for our servers using syslog-ng + patterndb, however the logs the logging server is receiving from the client are prepended with the date, host and other data. This of ...
- 148
1
vote
1
answer
2k
views
Not seeing kernel messages in syslog
I'm trying to track down a process that kills my mysql server on my CentOS box.
I have the following setting in /etc/syslog.conf:
*.*;mail.none;authpriv.none;cron.none /var/log/messages
I ...
- 2,859
-1
votes
1
answer
1k
views
Determine timezone in Rsyslog file
I would like to determine what time zone a specific log is in. I found this line in the log:
Aug 29 07:07:40 gw kernel: rtc_cmos rtc_cmos: setting system clock to 2013-08-29 11:07:08 UTC(1377774428)
...
- 4,296
5
votes
1
answer
2k
views
Random SSH entries in Auth.log out of date order [duplicate]
Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue.
Some ...
- 4,296
3
votes
3
answers
5k
views
Most common account names used in ssh brute force attacks
Does anyone maintain lists of the most frequently guessed account names that are used by attackers brute-forcing ssh?
For your amusement, from my main server's logs over the last month (43 313 failed ...
CommunityBot
- 1
1
vote
1
answer
80
views
Segmenting syslog logs and access to those logs
I'm trying to figure out if what I'm trying to accomplish is possible or not.
What I want is to have all my devices send logs to a syslog server, then have Splunk pull logs for everything EXCEPT my ...
- 2,465
2
votes
2
answers
314
views
How to collect logs for statistics in site?
I want to collect logs from nginx ( several servers, 1 000 000 lines in logs for minute for all servers ) to central stat server for statistics processing.
I see 2 variants:
write logs to local log ...
- 176
4
votes
2
answers
3k
views
how to collect and aggregate logs from multiple machines in Amazon AWS environment
We have multiple Ec2 servers running and they have a tendency to be started and shut down at unpredictable times (based on load etc). What is the best way to collate and aggregate logs from them in ...
- 101
2
votes
2
answers
14k
views
Apache httpd: Send error logs to syslog and local disk? Without touching /etc/syslog.conf?
I have an Apache httpd 2.2 server. I want to log all messages using syslog, so that the requests are sent to our central syslog server. I also want to ensure that all log messages are sent to local ...
- 32.8k
0
votes
1
answer
15k
views
DNS format error in syslog, how to debug?
I'm getting an error in my syslog when resolving a domain I also the DNS for.
Nov 24 21:51:55 moo named[4075]: DNS format error from 192.227.143.105#53 resolving bostonyoungentrepreneurs.com/NS for ...
- 468
13
votes
1
answer
355
views
How do I make sec ignore a timestamp properly
I have a rule that is set up like so;
In /etc/sec/rules.d I have;
type=SingleWithSuppress
ptype=regexp
pattern=(\S+) sshd\[\d+\]: PAM \d+ more authentication failures\; logname=.* uid=.* euid=.* tty=...
- 2,062
19
votes
4
answers
45k
views
Which program defaults uses syslog local[0-7] facilities?
As well as the common system facilities (mail, news, daemon, cron, etc), syslog provides a series of "local" facilities, numbers 0 to 7: LOCAL0, LOCAL1, ..., LOCAL7.
Which ones are program defaults ...
- 1
0
votes
1
answer
344
views
Logging only written on old [filename].1 log files
My log is not written on the correct log file for example syslog, mail.log, mysql.log, auth.log but for some reason the latest event are written on these old log files syslog.1, auth.log.1, mail.log.1 ...
CommunityBot
- 1
9
votes
1
answer
18k
views
Rsyslog.conf disable mail.info and/or disable postfix reporting
I have log entries like:
Apr 8 10:25:31 monitor postfix/smtpd[3131]: connect from localhost[127.0.0.1]
Apr 8 10:25:31 monitor postfix/smtpd[3131]: lost connection after CONNECT from localhost[127.0....
- 268
-5
votes
2
answers
2k
views
server hacked - cron continue to run [duplicate]
Someone accessed my EC2 Ubuntu 14.04 and installed some malicious cron to do port scanning with user eric. I removed user eric and the file executed, but in syslog I see
Sep 19 15:27:01 ip-xxx CRON[...
- 4,514
0
votes
1
answer
322
views
Cisco CGS2520 switch to reveal MAC address when port goes active?
Is there a way to have a Cisco switch reveal the MAC address of a device via Syslog when it is plugged in?
I get messages that a device is connected, but there isn't a lot of detail:
Sep 9 12:50:51 ...
- 71.3k
0
votes
1
answer
231
views
Understanding ntpd entry in syslog
Does anyone know what this entry in syslog means:
static1 ntpd[2397]: 2a00:xxxx:xxxx:239::2 interface 2a01:xxxx::xxxx:xxxx:fe70:a40c -> (null)
(I've replaced some of the values with xxxx)
Thank ...
- 963
2
votes
3
answers
3k
views
SSD read errors; should I be worried?
An SSD just over a month old is producing read errors in my syslog whenever rsync backs it up:
[276877.360221] ata1.00: exception Emask 0x0 SAct 0x1 SErr 0x0 action 0x0
[276877.360226] ata1.00: ...
- 1,091
2
votes
1
answer
259
views
TCP rsyslogd events showing up as 2000 character continuations
I'm taking syslog events from a proprietary app. This could be the app's fault or it could be rsyslogd.
Events are written like:
Aug 15 16:00:00 10.11.12.13 Event1 from this wonderful product using ...
CommunityBot
- 1
2
votes
2
answers
1k
views
Using (r)syslog's dynamic file generation
I am in the middle of configuring a (r)syslog server as a remote server that receives logs from various clients.
I wonder whether there is a nicer way to dynamically generate multiple file names as ...
CommunityBot
- 1
2
votes
1
answer
15k
views
How to prevent syslog message popping in a ssh session without affect other sessions?
i have a machine(RHEL 5.2) which receives syslog message from remote machines. And now it keeps popping message from remote machine in a ssh shell, which is annoying when i want to do something on it.
...
- 7,167
0
votes
1
answer
1k
views
Different log file per postfix instance
How can I set a custom log file for each postfix instance?
Specifically, I need to identify entries generated for different instances of postfix, and would be better for the tooling if each instance ...
- 1,142
5
votes
2
answers
3k
views
Cannot find upstart logs in syslog despite a log-priority of debug (ubuntu 13.04 & mint 16)
I've set upstart log level to "debug"
sudo initctl log-priority debug
But I still cannot see anything in /var/log/syslog.
sudo initctl emit hello # no log
sudo initctl start my-broken-service # ...
CommunityBot
- 1
2
votes
0
answers
827
views
RFC 5424 Syslog Viewer
I've been looking for a log viewer that understands syslog messages, specifically in RFC 5424 format (including structured data elements), and ideally allows live monitoring (tail like) and filtering/...
CommunityBot
- 1
-1
votes
1
answer
2k
views
Nginx Reverse Proxy Segfault on High Traffic
Recently my load balancer with Nginx rev proxy showing the following error messages on /var/log/dmesg:
[6278902.558300] nginx[15683]: segfault at ffffffffffffffff ip 0000000000457b99 sp ...
2
votes
1
answer
6k
views
Nxlog Multiline Input to 1 Syslog Message
I am using nxlog to tail a custom log file on one of my Windows servers. Each entry in the text file looks similar to this.
============================================================================...
- 986
2
votes
1
answer
242
views
Why don't cfn-init logs get sent by rsyslog?
I just signed up for Papertrail to aggregate logs from some AWS instances I'm setting up with CloudFormation::Init. I've followed the instructions and added *.* @logs.papertrailapp.com to the end of '...
- 945
1
vote
0
answers
540
views
Receiving Apache access and error logs via rsyslog and possible catchall filter
I'm new to rsyslog and have been trying to figure out why I am not receiving any of my Apache and mysql logs which are configured on the client-side to sent via rsyslog. I am currently receiving all ...
- 43
7
votes
1
answer
9k
views
How do I configure rsyslog on Ubuntu 14.04 to use ISO8601 timestamps?
In a file in /etc/rsyslog.d/ I have the following:
local3.* /var/log/mylog.log
When I log to this facility, records have timestamps which look like this:
Apr 27 21:12:20 hostname msg
How do ...
- 2,635
3
votes
3
answers
12k
views
nginx logrotate config
Whats the best way to rotate nginx logfiles? In my opinion, I should create a file "nginx" in /etc/logrotate.d/ and fill it with the following code and do a /etc/init.d/syslog restart after that.
...
- 111
1
vote
2
answers
18k
views
Rsyslog filter by client
I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side.
I added this line ...
- 261
1
vote
1
answer
355
views
Forwarding Syslog/Event Log Across Networks
I am trying to Forward syslogs and Event Logs across networks (internet).
Win Computer ----| (There will be multiples
of these forwarding to a single ...
CommunityBot
- 1
2
votes
2
answers
407
views
How to log remotely without syslog
I have a bunch of logs which are not created using syslog. I would like to export them to another host. If possible using syslog or rsyslog. A pipe?
how can I do that?
- 6,292
1
vote
1
answer
1k
views
Logstash shipper & server on the samebox
I'm trying to setup a central logstash configuration. However I would like to be sending my logs through syslog-ng and not third party shippers. This means that my logstash server is accepting via ...
- 76
8
votes
5
answers
55k
views
Linux: how to send new lines in log files to remote syslog?
We have several applications which are generating their own plain-text log files, which I would like to forward to a remote syslog server for centralized logging. I do not have access to root on ...
CommunityBot
- 1
2
votes
2
answers
5k
views
Logging ssh info using syslog-ng daemon in Cygwin
I have setup the syslog-ng daemon using Cygwin in Windows 7. What I want to do is to log all of the ssh failed passwords, etc to /var/log/sshd.log. I tried to do this by adding the following line:
...
- 282
1
vote
1
answer
3k
views
Converting to rsyslog v7 new config format
I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy ...
- 2,213
3
votes
1
answer
681
views
Wheezy processes die periodically
I have a very weird problem. Certain processes on my mail server, but not all, die periodically (every second month or so). A few of the process that die are:
ssh
dovecot
postfix
Processes that don'...
- 380
1
vote
1
answer
973
views
Syslog and LogAnalyzer - how to retrive source IPs and count them
I have set centralized Syslog (centOS + rsys) server which runs LogAnalyzer for better log presentation. Recently I have got asked to provide logs from the firewall of all IPs for particular firewall ...
- 3,488
1
vote
1
answer
1k
views
Logcheck alternative for central syslog server [closed]
I have to setup some open source log monitoring on a centralized syslog server.
A lot of machines (windows, linux) and some routers and switches sending their logs there.
Many years ago when I had to ...
CommunityBot
- 1
7
votes
1
answer
8k
views
rsyslog udp forwarding truncates at 2048 characters
Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
CommunityBot
- 1
0
votes
2
answers
5k
views
max open files - why is there no error?
I suspect that one of our server applications has hit its max open file limit.
The application is running in user-space with its own account. The init-script starts a large number of processes which ...
- 23.6k
1
vote
2
answers
175
views
Server logging goes haywire and some system services die until hard reboot
The gist of our problem is that we lose ssh access to our VPS and our logfiles get all mixed up. Doing a hard reboot through our hosting provider's web console seems to fix things, but the problem ...
- 111
1
vote
1
answer
95
views
Logging in iptables
I have created rules in iptables to log and edited the rsyslog.conf file to output any message which contains "iptables" to a different log file. It seems that it is logging to both places, the ...
- 98
6
votes
2
answers
3k
views
How does an administrator generalize alerting when an event doesn't happen?
Often my users require me to be just as responsible for knowing if an event hasn't happened.
I've always had to build custom and brittle solutions with cron'ed shell scripts and lots of date edge ...
- 3,002