syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

43
votes
4answers
72k views

Splunk is fantastically expensive: What are the alternatives? [duplicate]

Possible Duplicate: Alternatives to Splunk? This has been discussed, but it has been several months, so it may be time to revisit it: Earlier discussion RE Splunk alternatives For the ...
21
votes
4answers
14k views

How to add message that will be read with dmesg?

I am trying to write some custom messages in my dmesg output. I tried: logger "Hello" but this does not work. It exits without error, but no "Hello" appears int the output of: dmesg I am using a ...
12
votes
6answers
5k views

How would you send syslog *securely* over the public Internet?

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet. I've tried syslog-ng but can't make it work in a secure way, a ...
12
votes
3answers
17k views

Which program defaults uses syslog local[0-7] facilities?

As well as the common system facilities (mail, news, daemon, cron, etc), syslog provides a series of "local" facilities, numbers 0 to 7: LOCAL0, LOCAL1, ..., LOCAL7. Which ones are program defaults ...
11
votes
4answers
9k views

Linux: logwatch(8) is too noisy. How can I control the noise level?

Our Linux systems run logwatch(8) utility by default. On a RedHat/CentOS/SL system, Logwatch is called by the /etc/cron.daily/ cronjob, which then sends a daily email with the results. These emails ...
11
votes
5answers
10k views

How can I prevent cron from filling up my syslog?

I have a script which needs to be executed each minute. The problem is that cron is logging to /var/log/syslog each time it executes. I end up seeing something like this repeated over and over in ...
11
votes
6answers
12k views

Good syslog server for Windows [closed]

I've been trying to find a "good" syslog server to provide centralized application login for a distributed system we've built. Our application logging system can not only log to files but also to a ...
11
votes
7answers
3k views

How did you implement log management on your servers?

I'm trying to figure out how other people implement their log management systems. I have 20-30 Linux servers and a few Windows boxes (most of them virtualized). We utilize a lot of Perl and Bash ...
10
votes
4answers
11k views

How to allow non-root user to listen on privileged port?

I want syslog to run as a non-root user on my linux box. That makes it impossible for it to bind to port 514 - because that's a privileged port. Is there any way I can grant non-admin user "foo" the ...
10
votes
4answers
16k views

Switch on PAM debugging to Syslog

I hate PAM since it came up. How do I switch on PAM debugging in Debian Squeeze at the admin level? I have checked every resource I was able to find. Google, manpages, whatever. The only thing I ...
10
votes
6answers
8k views

Open source tomcat log viewer

I'm managing several tomcat instances (aprox 30-35) and looking for some console to centralize the logs. I tried php-syslog-ng before (no with tomcat), and found it useful. I would like that these ...
9
votes
3answers
16k views

Sending audit logs to SYSLOG server

I'm running several RHEL based systems which utilize the audit functionality within the 2.6 kernel to track user activity and I need to have these logs sent to centralized SYSLOG servers for ...
9
votes
2answers
6k views

Better logging for cronjobs? Send cron output to syslog?

I am looking for a better way to log cronjobs. Most cronjobs tend to spam email or the console, get ignored, or create yet another logfile. In this case, I have a Nagios NSCA script which sends data ...
9
votes
4answers
3k views

How can I make syslogd email certain log messages to me?

I'd like to be able to get an email notification whenever syslogd logs something of, say err priority or higher. Assume this is a BSD compatible syslog daemon. Can this be accomplished? Should I ...
7
votes
5answers
2k views

Is centralized logging a good idea?

Right now, my organization has a solution comprised of 10+ components, and some have a log file per thread. Since files are rotated hourly, tracking all of this is a chore. Is centralizing all ...
7
votes
2answers
2k views

Syslog forwarding loses original hostname

I have DMZ hosts forwarding to a DMZ syslog which in turn forwards all the syslog messages to an internal syslog server. It's working fine for the most part but the internal syslog host messages ...
7
votes
3answers
4k views

Deciphering continuing mpt2sas syslog messages

Summary I have been getting these cryptic messages in syslog since I installed some new hardware and I can't figure out what the problem is, if it's serious, or what to do about it. They're from the ...
7
votes
1answer
157 views

How old is the “severity” paradigm in logging?

Years of sysadmin left syslog's severity levels, as described by The BSD Syslog Protocol, clearly imprinted in my mind. You know the drill: Emergency, Alert, Critical, Error, Warning, Notice, ...
6
votes
3answers
794 views

What's the best centralized syslog viewing tool for *nix out there

Looking for what people think are the best for doing web viewing of a centralized syslog server. I am open to using any syslog server also. EDIT I actually went with GrayLog2
6
votes
1answer
230 views

Syslog produces hundreds of lines

I have recently been "promoted" to lab admin, as I have the most experience with linux. My logcheck keeps sending me emails with hundreds of lines stemming from my syslog file. It repeats itself over, ...
6
votes
2answers
6k views

SNMPD not binding correctly

OS: Debian 5.0.3 SNMPD Version: 5.4.1 I have the following two lines in my snmpd.conf file: interface eth0agentaddress udp:161 I'm getting the following errors in my syslog: Oct 5 18:04:44 ...
6
votes
1answer
5k views

Rsyslog.conf disable mail.info and/or disable postfix reporting

I have log entries like: Apr 8 10:25:31 monitor postfix/smtpd[3131]: connect from localhost[127.0.0.1] Apr 8 10:25:31 monitor postfix/smtpd[3131]: lost connection after CONNECT from ...
6
votes
4answers
14k views

logrotate does not compress /var/log/messages

Over time I noticed some logs in /var/log such as auth, kern and messages were getting huge. I made logrotate entries for them: $ cat /etc/logrotate.d/auth.log /var/log/kern.log { rotate 5 ...
5
votes
6answers
5k views

Recommended software for a Centralized logging server? [closed]

I'd like to centralize logging for all my servers. Server operating systems include Windows 2003, 2008, Ubuntu and Redhat. I think Splunk is too expensive, has anyone set up something like this ...
5
votes
3answers
9k views

Is there a way to filter syslog entries?

I have a cluster of Linux servers that are fronted by a load-balancer, which probes each server every 5 seconds to determine if it's operational. These probes generate a lot of useless noise in the ...
5
votes
2answers
18k views

How can I ship Windows Server 2008 event logs to a syslog server?

In the past with Windows Server 2003 I was able to ship the event logs to a central network syslog server using evtsys (https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys). It does not ...
5
votes
1answer
4k views

Add a local application to syslog excluded from /var/log/messages

I have an application which logs to syslog facility local1. I would like to configure syslog to send all local1 messages to a log file separate from /var/log/messages -- that turned out to be easy. ...
5
votes
2answers
366 views

Cannot find upstart logs in syslog despite a log-priority of debug (ubuntu 13.04 & mint 16)

I've set upstart log level to "debug" sudo initctl log-priority debug But I still cannot see anything in /var/log/syslog. sudo initctl emit hello # no log sudo initctl start my-broken-service # ...
5
votes
3answers
1k views

Where is dhcpd's syslog message formats documented?

I am looking at bunch of syslog messages written by dhcpd. I want to write a quick parser that can deconstruct the message into its component parts, but I don't know what the various parts mean. I ...
5
votes
1answer
2k views

How to maintain the log source host using logstash

I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter. In the ...
4
votes
5answers
3k views

Script to delete files older than 30days

Shell script should not delete any files under* root dir*. My* path will be like /export/home/ftp/ ... I did some research and figured out the way for finding and deleting the files older than 30 ...
4
votes
4answers
11k views

Is there a way to remove “Last message repeated x times” from logs?

I have a script that updates me on any changes to the kernel log on my (Debian) servers. The problem is that occasionally the log contains lines like: last message repeated 4 times I realize that ...
4
votes
1answer
2k views

Any logs of if/when “at” jobs were executed?

I've setup a couple of "at" jobs to execute at specific times on CentOS 5. This morning I don't see these commands in the queue ("atq"), as expected, but I also don't see were can I check whether the ...
4
votes
5answers
1k views

Forwarding Windows log event using TCP

I'm looking for a way to safely centralize all my Windows and Linux logs on one location. Since I'm in a mixed environment, with both Linux and Windows, I started using Syslog-ng on the Linux boxes ...
4
votes
3answers
532 views

Log Shutdown Command Usage/Message

I want to monitor whenever any of our machines run the shutdown command so that it can send an email or notification of an imminent reboot/shutdown. I figured that when shutdown was run it probably ...
4
votes
3answers
10k views

Where is syslog.conf file on ubuntu 10

i want to LOG my droppped packets in firewall. The tutorial told me write some lines in /etc/syslog.conf I have searched but could not foound anything named syslog.conf There was the file called ...
4
votes
1answer
992 views

No more logging after upgrade to Debian Wheezy

Syslog, auth.log, kern.log and messages log files are not updated anymore after upgrading to Debian Wheezy (Debian Squeeze was previously running). How could I fix it?
4
votes
1answer
6k views

rsyslog not logging messages

i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check ...
4
votes
2answers
1k views

how to collect and aggregate logs from multiple machines in Amazon AWS environment

We have multiple Ec2 servers running and they have a tendency to be started and shut down at unpredictable times (based on load etc). What is the best way to collate and aggregate logs from them in ...
4
votes
4answers
932 views

CentOS centralised logging, syslogd, rsyslog, syslog-ng, logstash sender?

I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc. I've found a few different options but I'm not sure what would be best. ...
4
votes
3answers
340 views

Ubuntu 10.04 syslog not logging to correct file

In a similar vein to Why is Syslog Not Writing Logs To The Designated Files? I'm having a few problems with syslog on Ubuntu 10.0.4 I have an app which I have set to facility local7. I added the ...
4
votes
3answers
2k views

Centralizing PHP error logging with syslog

I have a PHP application that is running on 20 web servers. It's silly to check every servers' PHP error log. I'm planning to centralize the error logging on one (not a web server, a server just used ...
4
votes
1answer
736 views

Wildcard support for InputFileName in rsyslog?

We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName? Example: InputFileName: ...
4
votes
1answer
1k views

Best Practices for rotating syslog logs on RHEL with different schedules?

OS: Running RHEL 5.6. Situation: I need to rotate /var/log/messagees on a different schedule than the rest of the syslog logs. By default syslog logs are rotated weekly based on the ...
4
votes
1answer
260 views

Unusual server crash on EC2, syslog has line of ^@^@^@^@^@

Trying to get at the root of why a server went down for 20 minutes, I looked at the syslog for that time period and saw this: Jan 3 07:50:01 tools CRON[17085]: (munin) CMD (if [ -x ...
3
votes
3answers
327 views

Find out how long a user was logged into a Linux server

In my Debian Squeeze server, all user logins and logouts are recorded in the file /var/log/auth.log Jan 28 07:11:06 xen8 sshd[29826]: pam_unix(sshd:session): session opened for user root by (uid=0) ...
3
votes
5answers
2k views

Linux: how to send new lines in log files to remote syslog?

We have several applications which are generating their own plain-text log files, which I would like to forward to a remote syslog server for centralized logging. I do not have access to root on ...
3
votes
1answer
7k views

Why is Syslog Not Writing Logs To The Designated Files?

I've been trying to route Apache's logs through Syslog (for some reason log rotation had stopped, and using Syslog and logrotate seemed a reasonable solution). I have sent Apache's error logs to ...
3
votes
3answers
3k views

rsyslogd: Any way to get around the number of local facilities?

We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
3
votes
2answers
2k views

Increase rsyslog/syslog precision to include fractional seconds?

I use syslog and rsyslog to handle logging on my Linux & FreeBSD systems. The timestamp is currently in seconds but I would like to increase the precision of these timestamps to include ...