syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

10
votes
2answers
7k views

Better logging for cronjobs? Send cron output to syslog?

I am looking for a better way to log cronjobs. Most cronjobs tend to spam email or the console, get ignored, or create yet another logfile. In this case, I have a Nagios NSCA script which sends data ...
13
votes
6answers
5k views

How would you send syslog *securely* over the public Internet?

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet. I've tried syslog-ng but can't make it work in a secure way, a ...
13
votes
4answers
10k views

Linux: logwatch(8) is too noisy. How can I control the noise level?

Our Linux systems run logwatch(8) utility by default. On a RedHat/CentOS/SL system, Logwatch is called by the /etc/cron.daily/ cronjob, which then sends a daily email with the results. These emails ...
9
votes
3answers
18k views

Sending audit logs to SYSLOG server

I'm running several RHEL based systems which utilize the audit functionality within the 2.6 kernel to track user activity and I need to have these logs sent to centralized SYSLOG servers for ...
4
votes
4answers
2k views

Logging atd messages via syslog

I am running CentOS 5.3 and would like to log all messages from the "at" daemon. My syslog.conf contains the following entry: cron.* /var/log/cron I assumed that cron line in syslog refers to the ...
13
votes
5answers
11k views

How can I prevent cron from filling up my syslog?

I have a script which needs to be executed each minute. The problem is that cron is logging to /var/log/syslog each time it executes. I end up seeing something like this repeated over and over in ...
3
votes
3answers
5k views

Software to send windows notification eventlogs to linux syslog server and encode to utf8

I am trying to setup a windows 2008 server so it's able to send the eventlog messages to an syslog-ng server running linux. I'd prefer something native but I guess it won't be possible. UPDATE The ...
3
votes
3answers
877 views

Forward UNIX syslog to Windows Event viewer

I'm running a pfSense firewall which runs syslog and can forward it's logs to a remote syslog server. I'd like to be able to view these on my SBS 2011 server's event viewer, via a subscription. I ...
1
vote
3answers
3k views

(How) can I use syslog to diagnose mysterious crashes?

I run a LAMP stack on Ubuntu server. Twice today it has ground to a halt and required a hard reboot. Prior to this it had been stable for many months. It has been about a fortnight since the last ...
4
votes
5answers
3k views

Script to delete files older than 30days

Shell script should not delete any files under* root dir*. My* path will be like /export/home/ftp/ ... I did some research and figured out the way for finding and deleting the files older than 30 ...
3
votes
4answers
788 views

rsyslog or a similar distributed logging standard, for Windows?

I have a bunch of Windows Servers that run a bunch of apps, that log into local text files. I want to aggregate these text files into a centralized log server, where I can search them. Building ...
44
votes
4answers
77k views

Splunk is fantastically expensive: What are the alternatives? [duplicate]

Possible Duplicate: Alternatives to Splunk? This has been discussed, but it has been several months, so it may be time to revisit it: Earlier discussion RE Splunk alternatives For the ...
8
votes
3answers
4k views

Deciphering continuing mpt2sas syslog messages

Summary I have been getting these cryptic messages in syslog since I installed some new hardware and I can't figure out what the problem is, if it's serious, or what to do about it. They're from the ...
3
votes
2answers
1k views

How does an administrator generalize alerting when an event doesn't happen?

Often my users require me to be just as responsible for knowing if an event hasn't happened. I've always had to build custom and brittle solutions with cron'ed shell scripts and lots of date edge ...
11
votes
4answers
12k views

How to allow non-root user to listen on privileged port?

I want syslog to run as a non-root user on my linux box. That makes it impossible for it to bind to port 514 - because that's a privileged port. Is there any way I can grant non-admin user "foo" the ...
10
votes
6answers
9k views

Open source tomcat log viewer

I'm managing several tomcat instances (aprox 30-35) and looking for some console to centralize the logs. I tried php-syslog-ng before (no with tomcat), and found it useful. I would like that these ...
5
votes
1answer
4k views

Add a local application to syslog excluded from /var/log/messages

I have an application which logs to syslog facility local1. I would like to configure syslog to send all local1 messages to a log file separate from /var/log/messages -- that turned out to be easy. ...
5
votes
3answers
10k views

Is there a way to filter syslog entries?

I have a cluster of Linux servers that are fronted by a load-balancer, which probes each server every 5 seconds to determine if it's operational. These probes generate a lot of useless noise in the ...
2
votes
4answers
3k views

nginx logrotate config

Whats the best way to rotate nginx logfiles? In my opinion, I should create a file "nginx" in /etc/logrotate.d/ and fill it with the following code and do a /etc/init.d/syslog restart after that. ...
3
votes
3answers
3k views

FQDNs during migration from syslogd to syslog-ng

I'm migrating from syslogd to syslog-ng on SLES 9 server (syslog-ng at stock version 1.6.8). The server happens to be a loghost for some remote loggers. How do I configure syslog-ng to assure maximum ...
2
votes
1answer
689 views

Moving from syslog.conf to syslogng.conf

I'm moving a Solaris box from syslogd to syslog-ng, because the Solaris version of syslogd obliterates the original source hostname on the logs. I'm looking through the syslogng.conf documentation, ...
1
vote
1answer
2k views

Send Apache Access Logs to syslog

We have IBM HTTP Servers (Based on Apache 2.0) and want to send the access logs to syslog. (in addition to error logs which does work) The config we are using is as follows: ErrorLog ...
1
vote
3answers
5k views

Syslog not logging anything; /var/log/syslog is empty

Recently sendmail stopped accepting messages for delivery on my Solaris 10 x86 machine. I am trying to diagnose the problem but syslog doesn't seem to be working either. My /etc/syslog.conf: #ident ...
8
votes
1answer
2k views

No more logging after upgrade to Debian Wheezy

Syslog, auth.log, kern.log and messages log files are not updated anymore after upgrading to Debian Wheezy (Debian Squeeze was previously running). How could I fix it?
3
votes
2answers
238 views

Weird syslog order

Have you ever seen wrong order in /var/log/syslog ? I think that it causes only crontab. Jun 28 22:20:01 alex CRON[2327]: (root) CMD (something > /dev/null) Jun 28 22:21:01 alex CRON[2700]: (root) ...
3
votes
1answer
7k views

Why is Syslog Not Writing Logs To The Designated Files?

I've been trying to route Apache's logs through Syslog (for some reason log rotation had stopped, and using Syslog and logrotate seemed a reasonable solution). I have sent Apache's error logs to ...
2
votes
1answer
874 views

snort not logging full output to syslog

I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
1
vote
5answers
805 views

log rotation tool that keeps only a specified amount of logs and discards everything else

I'm looking for a cronolog-like tool that will keep only last n lines or last x minutes of logs piped to it and discard everything else Is there such a beast? UPDATE: I know about logrotate and it ...
0
votes
1answer
99 views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
0
votes
1answer
844 views

Configuring 'audit' facility in syslog-ng on solaris server?

This is a follow-up to this question. mghocke was kind enough to help me out with that question, but this is really a separate question, therefor a new post. I really don't know a lot about syslog, ...
0
votes
3answers
2k views

Splunk How do I get syslog to send data into splunk from remote machines

If I install the splunk forwarder, I can get the remote data into my splunk install, and index my logs, and searching is great. But I have a number of router devices and other devices that run syslog, ...
0
votes
2answers
161 views

Determine which programs are logging to a specific syslog facility

Is there any way to determine which daemons are logging to a specific syslog facility? (spec. rsyslog) What I am specifically looking for is who logs to the auth.* severities. A 2001 audit for ...
0
votes
1answer
5k views

How does one enable remote listening with rsyslog?

I'm configuring a Debian Squeeze server to receive syslog from some appliances, but rsyslog is refusing to listen to UDP 514. The closest I have been able to get from it is to make it listen to TCP ...