Tag Info

Hot answers tagged

6

For syslog-ng it's slightly different than regular syslog: You need to add cron to the filter associated with /var/log/syslog. In /etc/syslog-ng/syslog-ng.conf, replace this: filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); }; with: filter f_syslog3 { not facility(cron, auth, authpriv, mail) and not filter(f_debug); }; and ...


5

I use Snare. Snare for Windows is a Windows NT, Windows 2000, Windows XP, and Windows 2003 compatible service that interacts with the underlying Windows Eventlog subsystem to facilitate remote, real-time transfer of event log information. Snare for Windows also support 64 bit versions of Windows (X64 and IA64). Snare for Windows Vista is a Windows ...


5

It sounds like you want to rewrite your logfiles in a specific format. The link has the details on how to tell syslog-ng to do that :)


4

You can do this with syslog-ng, and it's one of the most common ways to break up logs. Please refer to the syslog-ng manual for information, as well as the destination configured in this guy's sample config file (the big hint I'll give you is you want to generate either the log path or the filename using the hostname of the sending server as a component). ...


4

It's logrotate which takes care of rotating logs. logrotate -f forces the log rotation even if logrotate think it is not needed. After that you can tell syslog-ng to reopen its logfiles with killall -HUP syslog-ng (or, quite likely, your logrotate will do that for you in its post-rotate hooks).


4

Okay, that turned out to be a SELinux-related problem. Just for the record, /var/log/audit/audit.log can be examined to get SELinux-related events, auditd should be started to enable this log. There are two possible solutions: to disable SELinux (not recommended) or to create a custom SELinux policy which allows access to this file. Maybe the file just does ...


4

I do not like the instructions on the opensystems blog you pointed to, as it replaces the default service in SMF. This is bad as it is likely that a future system patch will revert your changes. Here's my take on it, from a default system state: Disable the system syslog: svcadm disable system-log Download and install (using pkgadd) syslog-ng from ...


4

There are two main approaches to this I've seen. Firstly many applications will have the ability to write to a syslog host natively. This is the best route to go. In other cases I'll use a basic script - something like shown below works. sudo tail /my/app/log | nc -w0 -u 192.168.1.1 514 EDIT - there is indeed a way to handle this within syslog-ng if ...


3

Updating my answer after looking into this more. This seems to a limit with /usr/bin/logger, which is expected to conform with the syslog RFCs. http://www.faqs.org/rfcs/rfc3164.html says: The total length of the packet MUST be 1024 bytes or less. If you to send more then 1024 characters to syslog via the commandline (outside of Apache), you'll ...


3

omit the <pattern> element of the ruleset, then syslog-ng should match the rules of this ruleset for messages without a PROGRAM field. Regards, Robert


3

For the record, if you don't set a scope, then you don't need to exclude the DATE field, because it wouldn't be included anyway. With syslog-ng 3.4, there is another way to customize key names, which may or may not be useful. I wrote a small howto demonstrating and briefly explaining what one can do with value-pairs.


3

syslog-ng is very straight forward (but a lot wordier) once you understand the structure of its configuration file. In such a simple installation like yours all you need to know for now is that you have to configure sources, filters, and destinations. I am not sure what version of syslog-ng you are running but here's one for 3.0.x (which will work for more ...


3

Instead of using the symbolic name 'audit' you have to use the numeric code 13: filter f_audit { facility (13); };


3

Another option is preventing cron from logging anything except errors: change /etc/default/cron: # Or, to log standard messages, plus jobs with exit status != 0: # EXTRA_OPTS='-L 5' # # For quick reference, the currently available log levels are: # 0 no logging (errors are logged regardless) # 1 log start of jobs # 2 log end of ...


3

rsyslog's imfile input module can: Provide(s) the ability to convert any standard text file into a syslog message. A standard text file is a file consisting of printable characters with lines being delimited by LF. You can read the official documentation for more. I have never tried it, and it may not be terribly efficient, but it sounds like it can ...


3

rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ] rsyslogd: the last error occured in /etc/rsyslog.conf, line 68:"$InputFilePollingInterval 10" According to this document, it should be $InputFilePollInterval 10 instead of: $InputFilePollingInterval 10


3

You should use the $(format-json) template function instead of handcrafting the json payload. That will do the escaping for you. Not to mention that you can query the set of name-value pairs within a message and make the json more dynamic, for instance by adding all name-value pairs with a specific prefix. Here is a link to the documentation: ...


2

I was just emailed this from my boss: Well, we named it lognull, but that was just our choice. I found the reason again. Syslog-ng wants to change the permissions on the file it uses for logging, including /dev/null. Lots of other things in the system (incl. things not running as root) depend on /dev/null being readable and writable. That's why you're ...


2

I think this should answer your question: http://bazsi.blogs.balabit.com/2008/10/syslog-ng-message-parsing/ The summary: syslog-ng can extract fields from your log messages, and then you can use these fields in template substitutions. As long as your are logging the virtual host name (%v) in your Apache logs, you should have all the information you ...


2

The program name field is set by the application sending the log message. If you want to override this for some reason, you can use the program_override() option in the syslog-ng source definition. I am not sure which syslog-ng versions support this option, it is surely available in 3.0 and later. HTH Robert


2

What about tunneling, i.e. using Stunnel? For every DMZ server to be monitored: Let the logserver start a tunnel to the DMZ server Configure the DMZ server's syslog so that it connects to the tunnel and use it as additional destination Note: this may work through firewall/NAT (as per your title) but not through proxy (as per your question content).


2

Based on some quick reading I think you want to use the syslog() driver, which si described in section 8.1.6 of the Syslog-ng Administrator's guide. http://www.balabit.com/support/documentation/?product=syslog-ng I hope this helps, if I find anything more, I'll let you know. I think the syslog() driver is meant to be used with the source declaration. ...


2

If you mean that you would like to rename the fields (which I think is what you are asking), then you can try something like this: value-pairs( pair("My_Date_Field" "${DATE}") exclude("DATE") ) You are going to have to do it for each one though, I can't think of any way to do it auto-magically.


2

Ok, after a lot of pain I finally got it working, here is the final config, I hope it helps someone. iptables :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :LOGNDROP - [0:0] :OUTPUT ACCEPT [63:18352] -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 -A INPUT -m state --state RELATED,ESTABLISHED -j ...


2

I have not hooked any Python scripts to syslog-ng, but with Perl scripts I have to turn off the output buffering before they work in real-time. In Perl-speak, that is $|=1. I am not much a Python guy, but I guess running your Python script with -u or setting up variable PYTHONUNBUFFERED might help.


2

If you are sending from one syslog-ng server to another, just add the keep_hostname(yes) option. If you are sending from syslog-ng to some other syslog daemon, you need to compile from source and use the enable source spoof option. If you just want names instead of IPs, then try use_dns(yes). Here's a short video on configuring syslog-ng.


2

You're sending the log lines twice, because of these lines in rsyslogd.conf: local7.info @log.remote.lan local7.err @log.remote.lan When you specify info, that means that info and all higher priorities will be sent, not only info. Since err has a higher priority than info, you can remove the second line, so the log will only be sent once.


2

That's the PRI. It is an 8bit number that indicates the severity and facility. More information is available HERE


2

Syslog-ng does use a lot of CPU resources, yet showing a consistent 95% with a single CPU seems high. I have a single CPU system w/ <1Gb memory running syslog-ng 2.1.4 for three firewalls (on debug) and 20+ Linux servers (on warn). Top shows the %CPU as 93-83%. The filters are very flexible yet do not have any optimization or logic checking; syslog-ng ...


2

As the information that a certain event should occur at least every six hours is specific to the application writing to the log, it would be best if it could monitor itself and write a log entry if the event does not happen as it should. If the application writing log information is developed locally I would recommend this solution. If that is not possible, ...



Only top voted, non community-wiki answers of a minimum length are eligible