syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

1
vote
1answer
2k views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
0
votes
0answers
19 views

Rsyslog output in GELF

rsyslog is powerful, but its docs aren't that explicit. I can't figure out how to parse a log file and route it directly to Graylog in GELF format. I have found bits of documentation about outputing ...
0
votes
0answers
15 views

Rsyslog filter by facility name and multiple string conditions

We have the following line in an rsyslog.d/conf.d file: if $syslogfacility-text == 'local6' and ($msg contains 'TID' and $msg contains 'JID' and $msg contains 'INFO') then ~ The issue is that the ...
4
votes
1answer
2k views

Configuring JBoss AS 7.2 to log to syslog

In my standalone.xml, I have the syslog-handler configured like so: <syslog-handler name="SYSLOG" enabled="true"> <level name="INFO"/> <hostname value="i-XXXXXXX"/> &...
4
votes
1answer
1k views

Separating java stdout and stderr with systemd and without filling journal

I am running java apps via systemd: [Unit] Description=test service [Service] Type=simple EnvironmentFile=/etc/sysconfig/testserver WorkingDirectory=/opt/testserver ExecStart=/usr/bin/java -jar /opt/...
0
votes
1answer
13 views

Syslog-ng can close connection

I have a server that collect secure/auth logs in my datacenter from all other server, it runs syslog-ng 3.2.5. It's configured to receive tcp connection, here is the conf: tcp(ip(0.0.0.0) port(514) ...
0
votes
0answers
5 views

Storing rsyslog remote events into ip based file

I was looking in the documentation and over google if it's possible to create single rule in rsyslog that would place the syslog events into files based on source ip/host/any other variable. What I ...
0
votes
0answers
48 views

Missing /var/log/messages file in CentOS 6.8

I'm not sure what I'm doing wrong, but my Linux box doesn't seem to be logging any info to the messages file. Will someone please help? Here's the content of the /etc/rsyslog.conf file (rsyslog-5.8....
0
votes
2answers
26 views

Multiple readers on a Unix Domain Socket?

I was hoping to have multiple clients reading from /dev/log (rsyslog and a custom tool) which I understand is a unix domain socket. How can this be achieved?
7
votes
3answers
3k views

Syslog forwarding loses original hostname

I have DMZ hosts forwarding to a DMZ syslog which in turn forwards all the syslog messages to an internal syslog server. It's working fine for the most part but the internal syslog host messages ...
0
votes
1answer
2k views

Syslog-ng how to get domain names instead of IP address

How can syslog-ng get the domain names instead of IP address that I received? I'm able to get those information but in IP address, I would like to get the DST/HOST to domain names instead of getting ...
1
vote
1answer
2k views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and kibana(...
1
vote
1answer
1k views

Cisco Nexus syslog messages format?

I'm trying to normalize Syslog messages generated by a Cisco Nexus box. Problem: Messages have the following format: <189>: yyyy mm dd hh:mm:ss UTC: text This is not a standard Syslog message, no ...
7
votes
2answers
10k views

how to filter rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based ...
0
votes
1answer
73 views

Pass host from nginx to rsyslog

I have a cluster of nginx web servers and a separate syslog server running rsyslog. The nginx vhost looks like this: access_log syslog:server=10.0.0.51,facility=local1,severity=info combined; ...
0
votes
0answers
16 views

Reset to device, \Device\RaidPort2, was issued

I get this warning log when the windows server 2012 starts backup service that include OS drives. Log Name: System Source: iaStorA Date: .... Event Id: 129 Task Category: none Level: Warning Keywords:...
1
vote
1answer
34 views

How do I handle messages from my custom application in rsyslog?

I have a Ruby application on my server, let's call it "alpha". The application emits syslog messages with the program name "alpha". I want to separate my log messages into separate files based on what ...
0
votes
2answers
36 views

Rsyslog pull tools or strategy

I would collect the log(in particolar auditd but also other syslog log) produced by several linux server in a centralized syslog server installed in a linux server. I would configure the centralized ...
19
votes
5answers
20k views

How can I prevent cron from filling up my syslog?

I have a script which needs to be executed each minute. The problem is that cron is logging to /var/log/syslog each time it executes. I end up seeing something like this repeated over and over in /...
3
votes
0answers
45 views

When configuring rsyslog to log to mysql DB, what is purpose of SystemEventsProperties table?

I've configured rsyslog on my servers to log to a remote mysql DB. I did this essentially by following the rsyslog wiki and it essentially creates two tables: mysql> show tables; +----------------...
3
votes
2answers
4k views

IIS Advanced Logging Forward to Syslog

I am looking for a method that would allow us to forward the IIS Advanced Logging logs to a centralized log source via syslog or something similar. We are able to perform this currently for the ...
0
votes
0answers
34 views

Forward to remote syslog in CoreOS

I want to aggregate CoreOS logs to Papertrail service, which basically provides a syslog endpoint for aggregate logging. Common advice for this setup seems to be starting a service that does ...
1
vote
0answers
17 views

Ubuntu 14.04 syslog showing @@@@ for long time period

My Ubuntu Server wasn't accessible for a long time, only after restarting the server I could access it again. I have checked the syslog file which shows something like @@@@@@@@@@@@@ from last night ...
1
vote
0answers
108 views

Nginx log to syslog on TCP port

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do: error_log syslog:server=192.168.1.1; However I need to ...
-1
votes
1answer
44 views

Which Nginx log file is for fail2ban?

I have files in /var/log/nginx/ the log file /var/log/nginx/access.log is empty. But the /var/log/nginx/access.log.1 is being appended as always. In file /etc/fail2ban/fail2ban.conf, logtarget = /...
1
vote
0answers
36 views

syslog spammed with authdaemond: pam_ecryptfs: pam_sm_authenticate: /home/user is already mounted

I setup my new server with harddisk-encryption and now I noticed that /var/log/syslog is full of the following lines: server authdaemond: pam_ecryptfs: pam_sm_authenticate: /home/user is already ...
0
votes
2answers
2k views

Proftpd doesn't send xferlogs to syslog

I have a Proftpd v1.3.2 server, and I need to send every logs (system logs + auths logs + xferlogs) to a remote syslog server. It works fine for system+auth logs. But even if "TransferLog" was removed ...
14
votes
7answers
10k views

How would you send syslog *securely* over the public Internet?

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet. I've tried syslog-ng but can't make it work in a secure way, a ...
1
vote
0answers
52 views

Postfix logs to remote log host

On my Ubuntu 14.04 server, I'm using Postfix as a front-end mailserver, and I would like to send all mail related info, including email addresses, to a remote host. In the file /etc/rsyslog.d/50-...
4
votes
1answer
1k views

Outbound Traffic Logging on ASA 5520 possible?

Taking a look at the ASDM (6.4) for my ASA 5520, I get a nice summary of the traffic status, with items like "interface traffic usage", and "connections per second". This works well, but only shows ...
0
votes
1answer
26 views

Reading syslog-ng logs being sent to a remote server

I have a Docker container which is sending syslog logs to logentries.com. This is working fine, but for times when logentries is down or delayed, I want a way to read logs generated in realtime inside ...
1
vote
0answers
18 views

rsyslog parsing logs with liblognorm

I'm trying to use such .rb file to parse logs: version=2 rule=:%Server:char-to:\t%\t%stamp:char-to:\t%\t%ip:ipv4%\t%Site:char-to:\t%\t%BID:char-to:\t%\t%SID:char-to:\t%\t%LD:char-to:\t%\t%UserID:...
0
votes
0answers
15 views

rsyslog 8.17 char changing

My rsyslog configuration do not want to work properly Here is my example log: Mar 10 10:57:35 servername log_tag servername.at.google.com#01120160310105735#01144.44.44.443#011app#011162040-...
1
vote
1answer
53 views

HaProxy suddenly crashing on new Ubuntu Images (same config works elsewhere)

I have been using HAProxy for about two years with the same working configuration. I've installed HaProxy multiple times over the last week on Ubuntu 14.04, 15.10 and I am getting out of Memory ...
0
votes
1answer
174 views

/var/log/syslog is empty. Service rsyslog is running, but not installed

Problem Periodically I encounter the problem that /var/log/syslog is empty. $ ls /var/log/syslog -rw-r----- 1 root adm 0 Dez 31 06:29 /var/log/syslog Environment and Installed packages I am using ...
0
votes
1answer
69 views

How to make svlogd send logs via UDP

I am currently using runit + svlogd for supervising some applications, but when deploying to multiple machines, I have the need to centralize/unify the logs in a single place in order to simplify ...
0
votes
1answer
688 views

ESX performance stats in Logstash

Dose anyone know if it is possible to collect ESX Performance Stats in LogStash/ELK stack? looking to see if I can collect ESXTOP data for use in the ELK stack.
0
votes
0answers
36 views

Log file bloat due to nouveau

Both my kern.log and syslog files have grown to >50Gb and contain a few hundred million lines of: Feb 23 23:32:43 Yawning-Angel kernel: [396111.179453] nouveau E[ PFIFO][0000:05:00.0] PBDMA0: ch 2 [...
7
votes
1answer
172 views

How old is the “severity” paradigm in logging?

Years of sysadmin left syslog's severity levels, as described by The BSD Syslog Protocol, clearly imprinted in my mind. You know the drill: Emergency, Alert, Critical, Error, Warning, Notice, ...
0
votes
1answer
60 views

Add a field to the Linux Login

I want to ask the user the reason for login on Linux Production Servers. Login prompt will ask as common for user, password and the "Reason for Login" question will be asked afterward and registered ...
0
votes
1answer
92 views

Referencing journald fields when forwarding messages to syslog-ng

How can I change my syslog-ng template so that when the log originates from a systemd service / unit, the log message will include the unit's name? Using ${PROGRAM} just shows the name of the ...
0
votes
1answer
23 views

Open relay or some other issue?

I am running a dovecot/postfix server with virtual users/aliases. According to tools such as http://www.mailradar.com/openrelay/ I do not have any open relays. However, I am getting a lot of records ...
1
vote
1answer
77 views

How to read sar file from different ubuntu system

I am using two different version on ubuntu one is 14.04 and other is 15.10. I want to read 14.04 systems sar files from ubuntu 15.10 system. I have transferred the sar files but can't read it.
5
votes
1answer
128 views

How can I reduce the verbosity of certain Ansible tasks to not leak passwords into syslog?

Sometimes I would like to use Ansible's lineinfile or blockinfile modules to write a password into some configuration file. If I do so, the whole line or block, password included, ends up in my syslog....
0
votes
0answers
30 views

How to get rid of unexpected nslcd related messages caused by resolvconf?

I'm on a Ubuntu 12.04 based system. Our system is setup to use nslcd to allow LDAP authentication. In syslog we see lines like this: /var/log/syslog.1:Dec 20 06:25:11 T53-1014-014 nslcd[1496]: [...
0
votes
1answer
228 views

Nginx reverse proxy to server with login not working as expected

I have two servers behind an nginx reverse proxy. I am being forwarded correctly to the sites, but one of the sites has a login before it allows you into the site (similar to sharepoint), and the ...
3
votes
4answers
22k views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
2
votes
1answer
132 views

What process is causing unexpected nslcd syslog entries?

We're using LDAP for authenticating users our devices using nslcd and we're seeing messages in syslog like this: /var/log/syslog.1:Dec 20 06:25:11 T53-1014-014 nslcd[1496]: [398c89] <passwd="*">...
0
votes
1answer
42 views

logrotate frequency - when and from when

if have lograte in my daily cron /etc/cron.daily/logrotate -- assume cron.daily is run at 1.05am daily and if my logrotate config has a weekly settings Does it means that my logrotate will ...
0
votes
1answer
31 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...