syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

4
votes
1answer
1k views

Separating java stdout and stderr with systemd and without filling journal

I am running java apps via systemd: [Unit] Description=test service [Service] Type=simple EnvironmentFile=/etc/sysconfig/testserver WorkingDirectory=/opt/testserver ExecStart=/usr/bin/java -jar /opt/...
4
votes
0answers
127 views

Getting journald to send email on certain events

I found these solutions for syslogd that send emails on certain events like local0.crit or local1.err How can I make syslogd email certain log messages to me? http://www.johnandcailin.com/blog/john/...
4
votes
0answers
477 views

How do you use patterndb variables in syslog-ng?

I'd like to parse some custom (network appliance) syslog files to create my own formatted output. As I am new to syslog-ng & patterndb I have been trying to build an example using the ...
3
votes
0answers
44 views

When configuring rsyslog to log to mysql DB, what is purpose of SystemEventsProperties table?

I've configured rsyslog on my servers to log to a remote mysql DB. I did this essentially by following the rsyslog wiki and it essentially creates two tables: mysql> show tables; +----------------...
2
votes
0answers
150 views

How does one separate log data sent to a remote rsyslog server?

I have messages from multiple apache2 web servers logging to a rsyslog server. I've used a template to separate each /var/log/syslog file into its own folder based off of the ip address of the server ...
1
vote
0answers
16 views

Ubuntu 14.04 syslog showing @@@@ for long time period

My Ubuntu Server wasn't accessible for a long time, only after restarting the server I could access it again. I have checked the syslog file which shows something like @@@@@@@@@@@@@ from last night ...
1
vote
0answers
96 views

Nginx log to syslog on TCP port

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do: error_log syslog:server=192.168.1.1; However I need to ...
1
vote
0answers
35 views

syslog spammed with authdaemond: pam_ecryptfs: pam_sm_authenticate: /home/user is already mounted

I setup my new server with harddisk-encryption and now I noticed that /var/log/syslog is full of the following lines: server authdaemond: pam_ecryptfs: pam_sm_authenticate: /home/user is already ...
1
vote
0answers
51 views

Postfix logs to remote log host

On my Ubuntu 14.04 server, I'm using Postfix as a front-end mailserver, and I would like to send all mail related info, including email addresses, to a remote host. In the file /etc/rsyslog.d/50-...
1
vote
0answers
18 views

rsyslog parsing logs with liblognorm

I'm trying to use such .rb file to parse logs: version=2 rule=:%Server:char-to:\t%\t%stamp:char-to:\t%\t%ip:ipv4%\t%Site:char-to:\t%\t%BID:char-to:\t%\t%SID:char-to:\t%\t%LD:char-to:\t%\t%UserID:...
1
vote
0answers
37 views

Strange messages in my syslog on Debian

I am getting strange messages on my /var/log/syslog that aren't usual. I am running a Debian Jessie LXC Container inside of a Debian Wheezy machine. But I believe this is not the problem. An example ...
1
vote
0answers
52 views

How to modify the message string being logged by syslog?

I have a few linux systems with the keyboard and console shared via a KVM switch. When I switch between them, I get a lot of unwanted syslog messages regarding the keyboard connecting and ...
1
vote
0answers
30 views

Let Lemp and Lamp stack send Access/Error log to Graylog2

I have two servers running, one with Apache and one with Nginx (Both Ubuntu based) they are allreading sending syslogs to my graylog2 node but i want Nginx to provide me with the Access log and and ...
1
vote
0answers
172 views

rsyslog filter on authpriv facility in rsyslog.conf

This has been addressed in other post(s), but I still can't get this to work properly. I am trying to OMIT (discard) certain entries from being written to my " /var/log/secure ". Namely, any line ...
1
vote
0answers
59 views

audisp-remote signal USR1 works as root, not with sudo

So I have a weird problem that I'm running out of ideas to troubleshoot. My RedHat machines are using audisp-remote to send syslog messages to a central server. audisp-remote will respond to the ...
1
vote
0answers
198 views

How can I separate logs with rsyslog from a remote location for devices using the same IP?

I have a number of Yealink SIP phones at different locations that I am trying to centralize log collection for. I have set up a CentOS server at my main location with rsyslog. I am forwarding all ...
1
vote
0answers
42 views

Easily create a logcheck rule from a log message?

I’d like to more easily create logcheck rules from log messages. Ideally I’d like to have something set up such that I just take a logcheck message I receive, and pipe it to some tool, and it spits ...
1
vote
0answers
87 views

Unable to get structured data in logged messages even after adding mmpstrucdata and mmrfc5424addhmac?(RFC5424)

I am trying to log messages with structured data . But it is showing null value for structured data. I am working with rsyslog 8.9.0.Can someone tell me either i need to load some module or modify ...
1
vote
0answers
296 views

RFC 5424 Syslog Viewer

I've been looking for a log viewer that understands syslog messages, specifically in RFC 5424 format (including structured data elements), and ideally allows live monitoring (tail like) and filtering/...
1
vote
0answers
229 views

Receiving Apache access and error logs via rsyslog and possible catchall filter

I'm new to rsyslog and have been trying to figure out why I am not receiving any of my Apache and mysql logs which are configured on the client-side to sent via rsyslog. I am currently receiving all ...
1
vote
0answers
711 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
1
vote
0answers
282 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages -rw----...
1
vote
0answers
294 views

How to dynamically generate $LocalHostName value rsyslog

I have set up a central remote syslog server where I am sending all my logs. There will be many machines logging to the syslog server. On the client machine, in the rsyslog.conf I am trying to modify ...
1
vote
0answers
144 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
0answers
323 views

Snort/Barnyard2-1.10 LOG_SYSLOG_FULL Output Logging

With log_syslog_full opertion mode set to complete you get the below output. Can some explain to me what the bold parts are? I have been searching and cannot find any documention explaining the new ...
1
vote
0answers
139 views

XCP Project Kronos syslog error: “irq … : nobody cared” on Dom0 host

One of our production clusters driven by XCP suddenly went uresponsive. After restart and some investigation we found such logs in dom0 machine syslog: Oct 26 20:32:03 hetzner-2-mrx kernel: [1797931....
1
vote
0answers
208 views

Rsyslog's RELP format; experience?

1) In your experience, does rsyslog's RELP log transfer format require a significant amount of resources over what plain TCP syslog transfer would use? (cpu, disk i/o, network) 2) IYHO, is TCP ...
0
votes
0answers
15 views

Rsyslog output in GELF

rsyslog is powerful, but its docs aren't that explicit. I can't figure out how to parse a log file and route it directly to Graylog in GELF format. I have found bits of documentation about outputing ...
0
votes
0answers
15 views

Rsyslog filter by facility name and multiple string conditions

We have the following line in an rsyslog.d/conf.d file: if $syslogfacility-text == 'local6' and ($msg contains 'TID' and $msg contains 'JID' and $msg contains 'INFO') then ~ The issue is that the ...
0
votes
0answers
5 views

Storing rsyslog remote events into ip based file

I was looking in the documentation and over google if it's possible to create single rule in rsyslog that would place the syslog events into files based on source ip/host/any other variable. What I ...
0
votes
0answers
43 views

Missing /var/log/messages file in CentOS 6.8

I'm not sure what I'm doing wrong, but my Linux box doesn't seem to be logging any info to the messages file. Will someone please help? Here's the content of the /etc/rsyslog.conf file (rsyslog-5.8....
0
votes
0answers
16 views

Reset to device, \Device\RaidPort2, was issued

I get this warning log when the windows server 2012 starts backup service that include OS drives. Log Name: System Source: iaStorA Date: .... Event Id: 129 Task Category: none Level: Warning Keywords:...
0
votes
0answers
34 views

Forward to remote syslog in CoreOS

I want to aggregate CoreOS logs to Papertrail service, which basically provides a syslog endpoint for aggregate logging. Common advice for this setup seems to be starting a service that does ...
0
votes
0answers
15 views

rsyslog 8.17 char changing

My rsyslog configuration do not want to work properly Here is my example log: Mar 10 10:57:35 servername log_tag servername.at.google.com#01120160310105735#01144.44.44.443#011app#011162040-...
0
votes
0answers
35 views

Log file bloat due to nouveau

Both my kern.log and syslog files have grown to >50Gb and contain a few hundred million lines of: Feb 23 23:32:43 Yawning-Angel kernel: [396111.179453] nouveau E[ PFIFO][0000:05:00.0] PBDMA0: ch 2 [...
0
votes
0answers
30 views

How to get rid of unexpected nslcd related messages caused by resolvconf?

I'm on a Ubuntu 12.04 based system. Our system is setup to use nslcd to allow LDAP authentication. In syslog we see lines like this: /var/log/syslog.1:Dec 20 06:25:11 T53-1014-014 nslcd[1496]: [...
0
votes
0answers
28 views

How to forward logs and offenses from solarwinds to another server

There are several solarwinds servers in my Network. I want to aggregate some important logs and status from all of these different servers in a third party log server. I'v just searched but I didn't ...
0
votes
0answers
24 views

rsyslog not filtering message field

Trying to remove ALL cron log stuff from auth/syslog but I cannot get it. Here is a snippet of my rsyslog. Not sure how to get this to format right, it keeps wanting to mess with my paste. But here ...
0
votes
0answers
19 views

How can I select an output device for video from headless server?

I have a syslog server, and I call it headless, but it actually does have two monitors attached to it via an internal video card. I never actually use the monitors since I'm just ssh'd in, and the ...
0
votes
0answers
49 views

Systemd - do not log output from particular service, but forward to syslog

Is it possible for systemd to not log data from particular service, but to still forward it to the syslog? StandardOutput=syslog StandardError=syslog
0
votes
0answers
28 views

Journald: give users access to specific unit's logs

I'm taking care of a server (Debian Jessie) that several developers use for deploying and managing their work. Now there is a script on this server (managed by one of the developers) that does some ...
0
votes
0answers
46 views

Elasticsearch shuts down with no reason

We're running Elasticsearch 1.7.2 on ubuntu 14.04, the system has enough memory and other services on the server work just fine. But sometimes elastic shutsdown without any thing logged to it's log, ...
0
votes
0answers
14 views

Syslog not capturing from one vendor

We've had a syslogd server running on a FBSD box for years (now at 10.2). It captures remote logs sent across the LAN from a SonicWALL and some HP ProCurve switches. We just switched to a Meraki ...
0
votes
0answers
286 views

Getting journald logs to a plain text file

I want to log journald logs to a file so I can later on fetch it and send it to Logstash. I thought about running syslog-ng and make it a client of journald, so I'd get syslog files. I'm using Docker ...
0
votes
0answers
265 views

Cisco ASA 302014 syslog explaination

Can someone please explain the format of cisco asa syslog 302014 and more specifically the difference between idfw_user and AAA user? The message format is shown below: Error Message %ASA-6-302014: ...
0
votes
0answers
53 views

Rsyslog 8.12 doesn't like my TLS config

Rsyslog 8.11 -> 8.12 update stopped logging, but only when using TLS. I send to one destination without TLS (destination A) and to another with TLS (destination B). Destination A kept on working ...
0
votes
0answers
237 views

How to configure NetScaler to resend syslog traffic to two backend servers?

I am using NetScaler as load balancing syslog server which means that it does send the received syslog traffic to another syslog server. I am looking for a way to send this traffic to two different ...
0
votes
0answers
35 views

Network syslog with port number

I am collecting syslog from VoIP phones over the network and it is usual having several phones behind same NAT device. I need to collect syslog files to different files or be able to differ lines ...
0
votes
0answers
665 views

Send apache ssl access log to syslog

I'm having an issue piping apache ssl access logs to my syslog server. I've added the following line to my apache config: CustomLog "|/usr/bin/nc -u <syslogserver> 514" "<134>%{%b %d %X}...
0
votes
0answers
68 views

VMware ESX/i syslog content

I am working on an expansion of our monitoring footprint, and we are currently looking at including data from our visualized environment. As our monitoring license is based on logged volumes, and we ...