syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

3
votes
2answers
173 views

Automated Syslog Error Solution Finder

Any automated syslog solution finding frameworks? I want my central syslog server to email a list of problems, their severity and suggested solutions. There have been several questions about ...
3
votes
1answer
129 views

Launchd script's output not being logged to system.log

Sample script: #!/bin/bash echo "Hello?" ... (other things) When run via launchd, it definitely runs (the other things are being done) but nothing shows up in /var/log/system.log. I'm running OS ...
3
votes
1answer
754 views

Outbound Traffic Logging on ASA 5520 possible?

Taking a look at the ASDM (6.4) for my ASA 5520, I get a nice summary of the traffic status, with items like "interface traffic usage", and "connections per second". This works well, but only shows ...
3
votes
1answer
761 views

vSphere ESXi 5.0 hosts syslog to Graylog2 - Mangled log entries

I'm just setting up graylog2 (which is awesome) to be a syslog server for my virtualised environment. All my hosts and switches are happily logging away to graylog2, which is drawing some pretty ...
2
votes
1answer
246 views

UDP Traffic from outside to docker container is dropped after container restart

following situation: i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4 I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to ...
2
votes
1answer
869 views

Configuring JBoss AS 7.2 to log to syslog

In my standalone.xml, I have the syslog-handler configured like so: <syslog-handler name="SYSLOG" enabled="true"> <level name="INFO"/> <hostname value="i-XXXXXXX"/> ...
2
votes
1answer
99 views

Why don't cfn-init logs get sent by rsyslog?

I just signed up for Papertrail to aggregate logs from some AWS instances I'm setting up with CloudFormation::Init. I've followed the instructions and added *.* @logs.papertrailapp.com to the end of ...
1
vote
1answer
771 views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
1
vote
1answer
619 views

Netflow to syslog converter

Is there any way to have netflow v9 converted to syslog? Which would be the best way to have the following idea working? Procedure: 1) The router sends UDP with the following structure: ...
1
vote
1answer
142 views

Unable to log iptables

I'm having trouble getting iptables to log to any file. My iptables looks like: Chain INPUT (policy ACCEPT 1366 packets, 433582 bytes) pkts bytes target prot opt in out source ...
1
vote
1answer
89 views

NetBSD syslog timestamp format

Syslog uses a timestamps like the following: Sep 19 13:36:56 Is there a way to adjust the format (to add the year for example) without touching the source code? I am some what shocked to find that ...
1
vote
1answer
313 views

Why isn't /var/log/maillog written with sync option by default?

Some syslog implementations on linux (sysklogd, rsyslog) include the following line in their default configuration: mail.* -/var/log/maillog As far as I know the dash sign means that it is not ...
1
vote
1answer
78 views

Syslog message '^@' indicates server crash

The php-cgi's died on a vps I look after and the only syslog entry is this followed by me restarting the VM: ...
0
votes
1answer
70 views

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
0
votes
1answer
46 views

How do I filter on tags in syslog-ng when they don't seem to be available by the time it processes it?

I am having a hard time debugging an issue and I think it may be two-fold - problems in two separate programs. The main issue is that I'm logging nginx to syslog on Ubuntu 14.04 like so: access_log ...
0
votes
1answer
79 views

Syslog-ng loghost - filter not-match

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong. It seems like filters are not working for ...
0
votes
1answer
113 views

Server crash with ascii NUL characters in syslog ( ^@^@^@… )

I have some dedicated server hosted by a OVH (French service provider). OS : Ubuntu 12.04 x64 A few months ago, one of my server crashed. The only weird thing was some "ASCII NUL" caracters in the ...
0
votes
1answer
604 views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
0
votes
1answer
37 views

Logging only written on old [filename].1 log files

My log is not written on the correct log file for example syslog, mail.log, mysql.log, auth.log but for some reason the latest event are written on these old log files syslog.1, auth.log.1, mail.log.1 ...
0
votes
1answer
79 views

(rsyslog) Forwarding a specific log only

I've been trying to configure rsyslog to forward /var/log/syslog to a remote server. I was able to do this using the below configuration. $InputFileName /var/log/secure $InputFileTag hostname-secure ...
0
votes
1answer
329 views

Converting to rsyslog v7 new config format

I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy ...
0
votes
1answer
553 views

Syslog-ng how to get domain names instead of IP address

How can syslog-ng get the domain names instead of IP address that I received? I'm able to get those information but in IP address, I would like to get the DST/HOST to domain names instead of getting ...
0
votes
1answer
785 views

Cisco Nexus syslog messages format?

I'm trying to normalize Syslog messages generated by a Cisco Nexus box. Problem: Messages have the following format: <189>: yyyy mm dd hh:mm:ss UTC: text This is not a standard Syslog message, no ...
0
votes
1answer
133 views

syslog log of TCP packet

Occasionally, I noticed a lot of following messsages in syslog Nov {datetime} hostname kernel: [8226528.586232] AIF:PRIV TCP packet: IN=eth0 OUT= MAC={mac} SRC={sourceip} DST={destinationip} LEN=60 ...
0
votes
1answer
739 views

Amavisd-new cannot start - missing Unix::Syslog (CentOS)

I followed the basic instructions here for installing amavisd, spamassassin + clamav... http://wiki.centos.org/HowTos/Amavisd I get the following error when trying to start amavisd... # service ...
0
votes
1answer
361 views

On Solaris, how to log IP when using winbind auth and invalid user?

This is on Solaris 10 sparc platform. I'm trying to make our denyhosts script block the dictionary ssh attacks. Unfortunately, the logging does not show an IP when the user name is invalid. We are ...
0
votes
1answer
395 views

Opensource log correlation application - an alternative to SEC?

is there a opensource log correlation application? I know only SEC[1]. The best would be if the application could work in clustered setup and would understand even structured logs, not only free-text ...
0
votes
1answer
114 views

Remote Logging for Syslog

I'm trying to set up syslog to accept remote logging. I already have changed the config file and set up the syslogd with "-r m 0" to accept remote logging. Now i need to change the /etc/services file. ...
0
votes
1answer
494 views

Zenoss - Performance issues with captured events

The problem I'm manually inserting events into Zenoss through the zensendevent command line tool. The events are successfully inserted into Zenoss. The problem is that I can just insert about 8 ...
3
votes
0answers
217 views

How do you use patterndb variables in syslog-ng?

I'd like to parse some custom (network appliance) syslog files to create my own formatted output. As I am new to syslog-ng & patterndb I have been trying to build an example using the ...
2
votes
0answers
356 views

Separating java stdout and stderr with systemd and without filling journal

I am running java apps via systemd: [Unit] Description=test service [Service] Type=simple EnvironmentFile=/etc/sysconfig/testserver WorkingDirectory=/opt/testserver ExecStart=/usr/bin/java -jar ...
1
vote
0answers
128 views

Receiving Apache access and error logs via rsyslog and possible catchall filter

I'm new to rsyslog and have been trying to figure out why I am not receiving any of my Apache and mysql logs which are configured on the client-side to sent via rsyslog. I am currently receiving all ...
1
vote
0answers
296 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
1
vote
0answers
157 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages ...
1
vote
0answers
162 views

How to dynamically generate $LocalHostName value rsyslog

I have set up a central remote syslog server where I am sending all my logs. There will be many machines logging to the syslog server. On the client machine, in the rsyslog.conf I am trying to modify ...
1
vote
0answers
120 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
0answers
224 views

Snort/Barnyard2-1.10 LOG_SYSLOG_FULL Output Logging

With log_syslog_full opertion mode set to complete you get the below output. Can some explain to me what the bold parts are? I have been searching and cannot find any documention explaining the new ...
1
vote
0answers
113 views

XCP Project Kronos syslog error: “irq … : nobody cared” on Dom0 host

One of our production clusters driven by XCP suddenly went uresponsive. After restart and some investigation we found such logs in dom0 machine syslog: Oct 26 20:32:03 hetzner-2-mrx kernel: ...
1
vote
0answers
188 views

Rsyslog's RELP format; experience?

1) In your experience, does rsyslog's RELP log transfer format require a significant amount of resources over what plain TCP syslog transfer would use? (cpu, disk i/o, network) 2) IYHO, is TCP ...
0
votes
0answers
17 views

Getting journald to send email on certain events

I found these solutions for syslogd that send emails on certain events like local0.crit or local1.err How can I make syslogd email certain log messages to me? ...
0
votes
0answers
23 views

Segfault in libcurl.so.4.2.0 in syslog?

My syslog is being filled with entries declaring a segfault in libcurl.so.4.2.0: Mar 6 09:48:58 myserver kernel: crond[19450]: segfault at 7f46cfefbc3d ip 00007f46cff17f7d sp 00007fff79c939d8 ...
0
votes
0answers
25 views

How do I get auditd to push messages to a remote syslog server on Centos 6.6?

I'm a Windows guy trying to help a friend out. We need to get file auditing data off the Centos 6.6 server to a central syslog server. I found the auditd service and the audisp plugin. I edited the ...
0
votes
0answers
19 views

rsyslogd and FQDN - cannot get FQDN from clients

I setup a syslogserver with rsyslogd and 3 clients. Logs from 3 test clients are sent to the server, so far so good. My Problem is: I can't get the FQDN hostnames to work. According to rsyslog.com ...
0
votes
0answers
66 views

Send apache ssl access log to syslog

I'm having an issue piping apache ssl access logs to my syslog server. I've added the following line to my apache config: CustomLog "|/usr/bin/nc -u <syslogserver> 514" "<134>%{%b %d ...
0
votes
0answers
54 views

Suspicious web activitin in nginx logs

I'm seeing some strange entries in my NGINX logs: 2.71.139.98 - - [26/Dec/2014:12:36:24 +0000] ...
0
votes
0answers
78 views

No syslog using Kiwi 9.4 (free) directly connected on the inside of a Cisco ASA 5505 running a VPN

I have a number of remote branches (each with an IPSec site to site configuration. The main station has a Cisco 5510, the branches are each a Cisco ASA 5505. Works fine. I recently installed the paid ...
0
votes
0answers
38 views

Input filtering in rsyslog 5?

I have some messages hitting my rsyslogd server which a network trace shows as: <5>1 2014-09-04T14:58:31Z HOSTNAME This=a message=that contains=some specially=formatted data= This is ...
0
votes
0answers
164 views

RFC 5424 Syslog Viewer

I've been looking for a log viewer that understands syslog messages, specifically in RFC 5424 format (including structured data elements), and ideally allows live monitoring (tail like) and ...
0
votes
0answers
185 views

FreeBSD 7 syslog messages: “kernel: 15.xxxxxxxxxxxxxxx too long” (or “too short”)?

I'm experiencing poor performance on an old FreeBSD system and the only anomaly I see so far are syslog messages of the form: Jul 1 12:10:50 myserverXXX kernel: 16.0ccdd219377c0d80 too long Jul 1 ...
0
votes
0answers
60 views

VMware ESX/i syslog content

I am working on an expansion of our monitoring footprint, and we are currently looking at including data from our visualized environment. As our monitoring license is based on logged volumes, and we ...