syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

1
vote
2answers
4k views

Apache httpd: Send error logs to syslog and local disk? Without touching /etc/syslog.conf?

I have an Apache httpd 2.2 server. I want to log all messages using syslog, so that the requests are sent to our central syslog server. I also want to ensure that all log messages are sent to local ...
0
votes
1answer
21 views

DNS format error in syslog, how to debug?

I'm getting an error in my syslog when resolving a domain I also the DNS for. Nov 24 21:51:55 moo named[4075]: DNS format error from 192.227.143.105#53 resolving bostonyoungentrepreneurs.com/NS for ...
12
votes
1answer
98 views

How do I make sec ignore a timestamp properly

I have a rule that is set up like so; In /etc/sec/rules.d I have; type=SingleWithSuppress ptype=regexp pattern=(\S+) sshd\[\d+\]: PAM \d+ more authentication failures\; logname=.* uid=.* euid=.* ...
0
votes
0answers
24 views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
4
votes
3answers
920 views

Wildcard support for InputFileName in rsyslog?

We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName? Example: InputFileName: ...
9
votes
3answers
18k views

Sending audit logs to SYSLOG server

I'm running several RHEL based systems which utilize the audit functionality within the 2.6 kernel to track user activity and I need to have these logs sent to centralized SYSLOG servers for ...
0
votes
0answers
22 views

Server crash with ascii NUL characters in syslog ( ^@^@^@… )

I have some dedicated server hosted by a OVH (French service provider). OS : Ubuntu 12.04 x64 A few months ago, one of my server crashed. The only weird thing was some "ASCII NUL" caracters in the ...
0
votes
0answers
37 views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
0
votes
1answer
20 views

How can I suppress Postfix anvil statistics from system logs?

After every email sent through my mail server, postfix/anvil appends something like the following: Nov 9 15:09:11 keutenberg postfix/anvil[30006]: statistics: max connection rate 1/60s for ...
1
vote
2answers
2k views

IIS Advanced Logging Forward to Syslog

I am looking for a method that would allow us to forward the IIS Advanced Logging logs to a centralized log source via syslog or something similar. We are able to perform this currently for the ...
13
votes
4answers
19k views

Which program defaults uses syslog local[0-7] facilities?

As well as the common system facilities (mail, news, daemon, cron, etc), syslog provides a series of "local" facilities, numbers 0 to 7: LOCAL0, LOCAL1, ..., LOCAL7. Which ones are program defaults ...
0
votes
1answer
14 views

Logging only written on old [filename].1 log files

My log is not written on the correct log file for example syslog, mail.log, mysql.log, auth.log but for some reason the latest event are written on these old log files syslog.1, auth.log.1, mail.log.1 ...
3
votes
0answers
68 views

Random SSH entries in Auth.log out of date order

Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue. Some ...
0
votes
1answer
65 views

SSH Failed password login - log password

today I checked the log of my sshd and I have discovered tons of lines like :Oct 12 Oct 12 12:31:34 my_user sshd[15324]: Failed password for invalid user admin from 104.194.25.135 port 2683 ssh2 ...
1
vote
2answers
70 views

Syslog does not record logs received over TCP to a file

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over ...
6
votes
1answer
5k views

Rsyslog.conf disable mail.info and/or disable postfix reporting

I have log entries like: Apr 8 10:25:31 monitor postfix/smtpd[3131]: connect from localhost[127.0.0.1] Apr 8 10:25:31 monitor postfix/smtpd[3131]: lost connection after CONNECT from ...
2
votes
3answers
2k views

How do I stop postfix log info going into syslog?

We have a vps running Ubuntu 10.04.4 LTS, and while trying to find a solution to a php problem, I've become aware of what looks like a problem with the syslog system - I'm not sure though. The ...
-5
votes
2answers
107 views

server hacked - cron continue to run [duplicate]

Someone accessed my EC2 Ubuntu 14.04 and installed some malicious cron to do port scanning with user eric. I removed user eric and the file executed, but in syslog I see Sep 19 15:27:01 ip-xxx ...
0
votes
0answers
31 views

No syslog using Kiwi 9.4 (free) directly connected on the inside of a Cisco ASA 5505 running a VPN

I have a number of remote branches (each with an IPSec site to site configuration. The main station has a Cisco 5510, the branches are each a Cisco ASA 5505. Works fine. I recently installed the paid ...
7
votes
5answers
15k views

logrotate does not compress /var/log/messages

Over time I noticed some logs in /var/log such as auth, kern and messages were getting huge. I made logrotate entries for them: $ cat /etc/logrotate.d/auth.log /var/log/kern.log { rotate 5 ...
0
votes
1answer
34 views

Cisco CGS2520 switch to reveal MAC address when port goes active?

Is there a way to have a Cisco switch reveal the MAC address of a device via Syslog when it is plugged in? I get messages that a device is connected, but there isn't a lot of detail: Sep 9 12:50:51 ...
0
votes
0answers
22 views

Input filtering in rsyslog 5?

I have some messages hitting my rsyslogd server which a network trace shows as: <5>1 2014-09-04T14:58:31Z HOSTNAME This=a message=that contains=some specially=formatted data= This is ...
0
votes
1answer
21 views

Understanding ntpd entry in syslog

Does anyone know what this entry in syslog means: static1 ntpd[2397]: 2a00:xxxx:xxxx:239::2 interface 2a01:xxxx::xxxx:xxxx:fe70:a40c -> (null) (I've replaced some of the values with xxxx) Thank ...
1
vote
3answers
680 views

SSD read errors; should I be worried?

An SSD just over a month old is producing read errors in my syslog whenever rsync backs it up: [276877.360221] ata1.00: exception Emask 0x0 SAct 0x1 SErr 0x0 action 0x0 [276877.360226] ata1.00: ...
0
votes
0answers
185 views

Separating java stdout and stderr with systemd and without filling journal

I am running java apps via systemd: [Unit] Description=test service [Service] Type=simple EnvironmentFile=/etc/sysconfig/testserver WorkingDirectory=/opt/testserver ExecStart=/usr/bin/java -jar ...
1
vote
1answer
23 views

TCP rsyslogd events showing up as 2000 character continuations

I'm taking syslog events from a proprietary app. This could be the app's fault or it could be rsyslogd. Events are written like: Aug 15 16:00:00 10.11.12.13 Event1 from this wonderful product using ...
2
votes
2answers
55 views

Using (r)syslog's dynamic file generation

I am in the middle of configuring a (r)syslog server as a remote server that receives logs from various clients. I wonder whether there is a nicer way to dynamically generate multiple file names as ...
3
votes
2answers
501 views

Properly Configured Rsyslog on CentOS

I'm trying to configure Rsyslog 5.8.10 on CentOS 6.4 to send Apache's error and access logs to a remote server. It's working, but I have a couple questions. UPDATE: A, B and C are the only ones ...
1
vote
1answer
28 views

Segmenting syslog logs and access to those logs

I'm trying to figure out if what I'm trying to accomplish is possible or not. What I want is to have all my devices send logs to a syslog server, then have Splunk pull logs for everything EXCEPT my ...
3
votes
1answer
276 views

Difference between /dev/udp and netcat

I have a syslog server listening on localhost:514 as UDP and would like to write messages to it on that port. (Using Ubuntu 14.04) If I run either of these commands this from bash it prints the date ...
0
votes
1answer
247 views

How to prevent syslog message popping in a ssh session without affect other sessions?

i have a machine(RHEL 5.2) which receives syslog message from remote machines. And now it keeps popping message from remote machine in a ssh shell, which is annoying when i want to do something on it. ...
0
votes
0answers
51 views

(rsyslog) Forwarding a specific log only

I've been trying to configure rsyslog to forward /var/log/syslog to a remote server. I was able to do this using the below configuration. $InputFileName /var/log/secure $InputFileTag hostname-secure ...
11
votes
4answers
19k views

Switch on PAM debugging to Syslog

I hate PAM since it came up. How do I switch on PAM debugging in Debian Squeeze at the admin level? I have checked every resource I was able to find. Google, manpages, whatever. The only thing I ...
-2
votes
1answer
41 views

How to convert syslog to json in syslog server on freeBSD8.3 OS

I am using FreeBSD 8.3 and syslog server is running on it. now i have configured my syslog server to send logs to remote server by simply adding these lines in /etc/syslog.conf file ...
3
votes
1answer
701 views

vSphere ESXi 5.0 hosts syslog to Graylog2 - Mangled log entries

I'm just setting up graylog2 (which is awesome) to be a syslog server for my virtualised environment. All my hosts and switches are happily logging away to graylog2, which is drawing some pretty ...
0
votes
1answer
75 views

Different log file per postfix instance

How can I set a custom log file for each postfix instance? Specifically, I need to identify entries generated for different instances of postfix, and would be better for the tooling if each instance ...
5
votes
2answers
918 views

Cannot find upstart logs in syslog despite a log-priority of debug (ubuntu 13.04 & mint 16)

I've set upstart log level to "debug" sudo initctl log-priority debug But I still cannot see anything in /var/log/syslog. sudo initctl emit hello # no log sudo initctl start my-broken-service # ...
1
vote
1answer
191 views

Weird syslog order

Have you ever seen wrong order in /var/log/syslog ? I think that it causes only crontab. Jun 28 22:20:01 alex CRON[2327]: (root) CMD (something > /dev/null) Jun 28 22:21:01 alex CRON[2700]: (root) ...
1
vote
3answers
104 views

How to log multiline message with logger command?

I want to log a multiline message into the system logger via the commabnd echo -e "foo\nbar" | logger But it appear as 2 logs. Is it possible to log as a single log?
0
votes
0answers
135 views

RFC 5424 Syslog Viewer

I've been looking for a log viewer that understands syslog messages, specifically in RFC 5424 format (including structured data elements), and ideally allows live monitoring (tail like) and ...
-1
votes
1answer
164 views

Nginx Reverse Proxy Segfault on High Traffic

Recently my load balancer with Nginx rev proxy showing the following error messages on /var/log/dmesg: [6278902.558300] nginx[15683]: segfault at ffffffffffffffff ip 0000000000457b99 sp ...
12
votes
5answers
11k views

How can I prevent cron from filling up my syslog?

I have a script which needs to be executed each minute. The problem is that cron is logging to /var/log/syslog each time it executes. I end up seeing something like this repeated over and over in ...
10
votes
2answers
7k views

Better logging for cronjobs? Send cron output to syslog?

I am looking for a better way to log cronjobs. Most cronjobs tend to spam email or the console, get ignored, or create yet another logfile. In this case, I have a Nagios NSCA script which sends data ...
0
votes
1answer
573 views

Nxlog Multiline Input to 1 Syslog Message

I am using nxlog to tail a custom log file on one of my Windows servers. Each entry in the text file looks similar to this. ...
2
votes
1answer
94 views

Why don't cfn-init logs get sent by rsyslog?

I just signed up for Papertrail to aggregate logs from some AWS instances I'm setting up with CloudFormation::Init. I've followed the instructions and added *.* @logs.papertrailapp.com to the end of ...
3
votes
2answers
418 views

Postfix - searching emails (logstash, greylog or other solution)

We are currently having ~100 servers and all of them are using remote syslog, so we have aggregated all logs on one server. The most questioned problem from our support team is: Has an email from ...
1
vote
0answers
101 views

Receiving Apache access and error logs via rsyslog and possible catchall filter

I'm new to rsyslog and have been trying to figure out why I am not receiving any of my Apache and mysql logs which are configured on the client-side to sent via rsyslog. I am currently receiving all ...
9
votes
4answers
3k views

How can I make syslogd email certain log messages to me?

I'd like to be able to get an email notification whenever syslogd logs something of, say err priority or higher. Assume this is a BSD compatible syslog daemon. Can this be accomplished? Should I ...
1
vote
1answer
3k views

How do I configure rsyslog on Ubuntu 14.04 to use ISO8601 timestamps?

In a file in /etc/rsyslog.d/ I have the following: local3.* /var/log/mylog.log When I log to this facility, records have timestamps which look like this: Apr 27 21:12:20 hostname msg How ...
2
votes
4answers
3k views

nginx logrotate config

Whats the best way to rotate nginx logfiles? In my opinion, I should create a file "nginx" in /etc/logrotate.d/ and fill it with the following code and do a /etc/init.d/syslog restart after that. ...