Hot answers tagged

7

For syslog-ng it's slightly different than regular syslog: You need to add cron to the filter associated with /var/log/syslog. In /etc/syslog-ng/syslog-ng.conf, replace this: filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); }; with: filter f_syslog3 { not facility(cron, auth, authpriv, mail) and not filter(f_debug); }; and ...


5

I use Snare. Snare for Windows is a Windows NT, Windows 2000, Windows XP, and Windows 2003 compatible service that interacts with the underlying Windows Eventlog subsystem to facilitate remote, real-time transfer of event log information. Snare for Windows also support 64 bit versions of Windows (X64 and IA64). Snare for Windows Vista is a Windows ...


5

It sounds like you want to rewrite your logfiles in a specific format. The link has the details on how to tell syslog-ng to do that :)


4

You can do this with syslog-ng, and it's one of the most common ways to break up logs. Please refer to the syslog-ng manual for information, as well as the destination configured in this guy's sample config file (the big hint I'll give you is you want to generate either the log path or the filename using the hostname of the sending server as a component). ...


4

It's logrotate which takes care of rotating logs. logrotate -f forces the log rotation even if logrotate think it is not needed. After that you can tell syslog-ng to reopen its logfiles with killall -HUP syslog-ng (or, quite likely, your logrotate will do that for you in its post-rotate hooks).


4

Okay, that turned out to be a SELinux-related problem. Just for the record, /var/log/audit/audit.log can be examined to get SELinux-related events, auditd should be started to enable this log. There are two possible solutions: to disable SELinux (not recommended) or to create a custom SELinux policy which allows access to this file. Maybe the file just does ...


4

I do not like the instructions on the opensystems blog you pointed to, as it replaces the default service in SMF. This is bad as it is likely that a future system patch will revert your changes. Here's my take on it, from a default system state: Disable the system syslog: svcadm disable system-log Download and install (using pkgadd) syslog-ng from ...


4

There are two main approaches to this I've seen. Firstly many applications will have the ability to write to a syslog host natively. This is the best route to go. In other cases I'll use a basic script - something like shown below works. sudo tail /my/app/log | nc -w0 -u 192.168.1.1 514 EDIT - there is indeed a way to handle this within syslog-ng if ...


4

Yes, this is a known issue with some combinations of syslog-ng, glibc and kernel versions. It is not very well documented, but there are references in the balabit site. This is just one example. In Debian, set SYSLOGNG_OPTS="--no-caps" in /etc/default/syslog-ng to workaround this issue.


4

I use nxlog for this, which ends up sending Windows event logs, IIS logs, Exchange logs, and more to (in my case) a central nxlog server where it gets written to files and send to an ELK stack. Its free, native and multiplatform, so we use it on Windows and Linux. It can send over TLS too, and can send using JSON if you want. http://nxlog-ce.sourceforge.net/...


3

omit the <pattern> element of the ruleset, then syslog-ng should match the rules of this ruleset for messages without a PROGRAM field. Regards, Robert


3

Updating my answer after looking into this more. This seems to a limit with /usr/bin/logger, which is expected to conform with the syslog RFCs. http://www.faqs.org/rfcs/rfc3164.html says: The total length of the packet MUST be 1024 bytes or less. If you to send more then 1024 characters to syslog via the commandline (outside of Apache), you'll ...


3

I was just emailed this from my boss: Well, we named it lognull, but that was just our choice. I found the reason again. Syslog-ng wants to change the permissions on the file it uses for logging, including /dev/null. Lots of other things in the system (incl. things not running as root) depend on /dev/null being readable and writable. That's why you're ...


3

For the record, if you don't set a scope, then you don't need to exclude the DATE field, because it wouldn't be included anyway. With syslog-ng 3.4, there is another way to customize key names, which may or may not be useful. I wrote a small howto demonstrating and briefly explaining what one can do with value-pairs.


3

syslog-ng is very straight forward (but a lot wordier) once you understand the structure of its configuration file. In such a simple installation like yours all you need to know for now is that you have to configure sources, filters, and destinations. I am not sure what version of syslog-ng you are running but here's one for 3.0.x (which will work for more ...


3

Instead of using the symbolic name 'audit' you have to use the numeric code 13: filter f_audit { facility (13); };


3

Syslog-ng does use a lot of CPU resources, yet showing a consistent 95% with a single CPU seems high. I have a single CPU system w/ <1Gb memory running syslog-ng 2.1.4 for three firewalls (on debug) and 20+ Linux servers (on warn). Top shows the %CPU as 93-83%. The filters are very flexible yet do not have any optimization or logic checking; syslog-ng ...


3

Another option is preventing cron from logging anything except errors: change /etc/default/cron: # Or, to log standard messages, plus jobs with exit status != 0: # EXTRA_OPTS='-L 5' # # For quick reference, the currently available log levels are: # 0 no logging (errors are logged regardless) # 1 log start of jobs # 2 log end of ...


3

rsyslog's imfile input module can: Provide(s) the ability to convert any standard text file into a syslog message. A standard text file is a file consisting of printable characters with lines being delimited by LF. You can read the official documentation for more. I have never tried it, and it may not be terribly efficient, but it sounds like it can ...


3

rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ] rsyslogd: the last error occured in /etc/rsyslog.conf, line 68:"$InputFilePollingInterval 10" According to this document, it should be $InputFilePollInterval 10 instead of: $InputFilePollingInterval 10


3

You should use the $(format-json) template function instead of handcrafting the json payload. That will do the escaping for you. Not to mention that you can query the set of name-value pairs within a message and make the json more dynamic, for instance by adding all name-value pairs with a specific prefix. Here is a link to the documentation: http://www....


3

Problem was tcpwrappers which was obvious once I set up a test syslog-ng instance and ran it with debug output turned on. Adding the following clause to /etc/hosts.allow did the trick syslog-ng: 10.0.0.0/255.0.0.0 Also realised that we didn't handle syslog-ng's internal messages (which may well have told us what the problem was). Have now added the ...


3

From the syslog-ng administrators guide (v 2.0, which is old, but what you're using) When a log statement includes multiple filter statements, syslog-ng sends a message to the destination only if all filters are true for the message. In other words, the filters are connected with the logical AND operator. In the following example, no message arrives to ...


3

The right thing to use for this is TLS with machine client certificates. rsyslog is doing this since about 2008, and has great instructions: http://www.rsyslog.com/doc/v8-stable/tutorials/tls_cert_summary.html The process is extremely simple, as these things go: Set up a CA Issue certificates to all your computers that you want logs from Configure ...


2

I think this should answer your question: http://bazsi.blogs.balabit.com/2008/10/syslog-ng-message-parsing/ The summary: syslog-ng can extract fields from your log messages, and then you can use these fields in template substitutions. As long as your are logging the virtual host name (%v) in your Apache logs, you should have all the information you need....


2

The program name field is set by the application sending the log message. If you want to override this for some reason, you can use the program_override() option in the syslog-ng source definition. I am not sure which syslog-ng versions support this option, it is surely available in 3.0 and later. HTH Robert


2

What about tunneling, i.e. using Stunnel? For every DMZ server to be monitored: Let the logserver start a tunnel to the DMZ server Configure the DMZ server's syslog so that it connects to the tunnel and use it as additional destination Note: this may work through firewall/NAT (as per your title) but not through proxy (as per your question content).


2

Based on some quick reading I think you want to use the syslog() driver, which si described in section 8.1.6 of the Syslog-ng Administrator's guide. http://www.balabit.com/support/documentation/?product=syslog-ng I hope this helps, if I find anything more, I'll let you know. I think the syslog() driver is meant to be used with the source declaration. ...


2

Ok, after a lot of pain I finally got it working, here is the final config, I hope it helps someone. iptables :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :LOGNDROP - [0:0] :OUTPUT ACCEPT [63:18352] -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 -A INPUT -m state --state RELATED,ESTABLISHED -j ...


2

Your syslog-ng config appears fine to me but your iptables config isn't. The -j LOG line appears after a line that DROPs everything, hence it will never be reached. You should move the LOG line to directly before whatever event you want to log. If you want to log everything, put it first. If you want to log everything that isn't ACCEPTed, put it after ...



Only top voted, non community-wiki answers of a minimum length are eligible