Hot answers tagged

69

You can, as root, write to /dev/kmsg to print to the kernel message buffer: fixnum:~# echo Some message > /dev/kmsg fixnum:~# dmesg | tail -n1 [28078118.692242] Some message I've tested this on my server and an embedded Linux device, and it works on both, so I'm just going to assume it works pretty much everywhere.


30

Note : This is all regarding Linux and free software, as that's what I mostly use, but you should be fine with a syslog client on Windows to send the logs to a Linux syslog server. Logging to an SQL server: With only ~30 machines, you should be fine with pretty much any centralised syslog-alike and an SQL backend. I use syslog-ng and MySQL on Linux for ...


28

In the process of writing this question, I answered myself. So I'll answer myself "Jeopardy-style". This expands on the answer provided by Dennis Williamson. The following will send any Cron output to /usr/bin/logger (including stderr, which is converted to stdout using 2>&1), which will send to syslog, with a 'tag' of nsca_check_disk. Syslog handles ...


28

Overall, the available documentation for Logwatch lacks adequate explanation and is often far too vague. I pieced together some useful examples, and have reduced the Logwatch noise by over 95%. Here's what I have found. Keep in mind that you can find some Logwatch documentation at /usr/share/doc/logwatch-*/HOWTO-Customize-LogWatch, and it contains a few ...


27

dmesg displays what is in the kernel buffer, whereas logger is for syslogd. I think if you want to print things into the kernel buffer you will need to create a driver that uses the printk() kernel function. If you just want it in /var/log/messages, then with a "normal" setup I think what you have done with logger is already fine. The most basic example of ...


24

logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, logstash comes with a web interface for searching and drilling into all of your logs. http://code.google.com/p/logstash/ It's still rather early in development, but sound very promising and ...


21

You can send the output of cron to a separate log facility add the following to your /etc/syslog.conf file: # Log cron stuff cron.* /var/log/cron Remember to add /var/log/cron to your /etc/logrotate.d/syslog to ensure it gets rotated, eg # /etc/logrotate.d/syslog /var/log/messages /var/log/secure /var/log/...


18

Have you tried syslog-ng and stunnel? Install Stunnel Create certificate files for syslog-ng over Stunnel Configure Stunnel for Use With syslog-ng Install syslog-ng Configure syslog-ng DONE! NOTE: Stunnel (http://www.stunnel.org) is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix ...


16

This is a tricksy one, and it's actually a bug in rsyslog, specifically RepeatedMsgReduction On, and a change in behaviour with the version released with Trusty (compared to earlier versions) See http://bugzilla.adiscon.com/show_bug.cgi?id=527 for the gory details. In short, turn off RepeatedMsgReduction on Trusty. It's not helpful, and does dumb things.


15

Did you restart syslogd? You can also use lsof -f -p <pid-of-syslogd> to see what log files it has open. The syslog.conf looks right, you might want to post your apache configuration.


15

I figured the exact issue has been encountered by other Debian users (http://forums.debian.net/viewtopic.php?f=5&t=104049). To restore logging, one just needs to reinstall the syslog daemon (removed during upgrade): apt-get install inetutils-syslogd


14

A couple of things for you to try: Did you enable logging of debug messages in syslog? cp /etc/syslog.conf /etc/syslog.conf.original vi /etc/syslog.conf Add the following line: *.debug /var/log/debug.log Exit with :wq!. touch /var/log/debug.log service syslog restart You can enable debugging for all modules like so: touch /etc/pam_debug OR ...


13

Control repeat message filtering using $RepeatedMsgReduction in /etc/rsyslog.conf (it's on by default on Ubuntu systems): # Filter duplicated messages $RepeatedMsgReduction on More details: http://www.rsyslog.com/doc/rsconf1_repeatedmsgreduction.html


13

have a look at the logger command. e.g. logger -p auth.notice "Some message for the auth.log file"


13

You've already rejected "other people's bash scripts", but this is a pretty common solution -- some creative use of the logger command can follow a file and send its contents elsewhere. I personally wouldn't do this in a production environment though. A better option which requires less scripting hackery is using rsyslogd and the text file input module ...


13

these are 3 different kind of log managers : it enables your system to collect filter, and transmit/store logs. Syslog (daemon also named sysklogd) is the default LM in common Linux distributions. Light but not very flexible, you can redirect log flux sorted by facility and severity to files and over network (TCP, UDP). rsyslog is an "advanced" version of ...


12

Ok, The solution to my question was: change *.*;auth,authpriv.none -/var/log/syslog to *.*;cron,auth,authpriv.none -/var/log/syslog within /etc/syslog.conf and then restart syslog I also have cron being sent to /var/log/cron.log as suggested by Dave Cheney and stuck a logrotate on it. My fix with Daves suggestion is optimal for my situation ...


12

Short answer: VPN It may seem overkill, but it is the right answer and not that complicated to set up.


11

Based on Kyle's module above: #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/proc_fs.h> #include <asm/uaccess.h> static int pk_write(struct file *file, const char *buffer, unsigned long count, void *data) { char string[256]; count = count < 255 ? count : 255; if(...


11

Log the application name in your messages. Filter on the application name instead of facility. If your applications aren't generating syslog messages directly, you can apply an output filter (e.g., sed) to massage things to look the way you want. Take a look at the Rsyslog documentation on filter conditions to see how you might configure this behavior. ...


11

I've not used if like that (or syslogtag) but I have used :<blah>,<condition> ... (in particular :msg, contains,...) but try :syslogtag, isequal, "giomanager:" /var/log/giomanager.log & stop The & stop (Or, & ~ in rsyslog v6 and older (Such as on RHEL6)) causes the matched message to be discarded after logging otherwise it will be ...


11

Well, after almost a day of hair pulling, I finally understand a) how to do it and b) a misconception I have about sec. In reading the sec man page and it describes desc= as essentially showing the match. So in my mind, that meant it should show whatever was matched in pattern. Well, yes, that is true, in this case the match in that pattern is the; hostname,...


11

Basically, they are all the same, in the way they all permit to log data from different types of systems in a central repository. But they are three different project, each project trying to improve the previous one with more reliability and functionnalities. The Syslog project was the very first project. It started in 1980. It is the root project to ...


10

Yes, syslog is a standardised protocol, in RFC5424. However, it's not a trademark, so there's no reason why someone couldn't come up with something completely unrelated to the syslog protocol and call it WinSysLog (aiee! The camels!). You'll need to investigate whether it is compliant with the standard protocol.


10

setcap 'cap_net_bind_service=+ep' /path/to/syslogd Requires a not-ancient linux kernel (2.6.24 or later)


10

The most secure and correct method is to use the audispd syslog plugin and/or audisp-remote. To quickly get it working you can edit /etc/audisp/plugins.d/syslog.conf. RHEL includes this by default, though it is disabled. You need only change one line to enable it, active = yes. active = yes direction = out path = builtin_syslog type = builtin args = ...


10

If you just need to remove the old server.log and console.log every month you can also use logrotate which is most likely already running under RHEL. A config snippet like this will work in /etc/logrotate.d/*.conf or wherever the config files are located on your system. # rotate server.log and console.log every month # delete, not compress, old file /...


10

Someone is attempting to resolve those domains against your DNS server, and you clearly don't have recursion or query enabled for people outside of your network. I wouldn't be worried.. It happens when you put a DNS server public..


10

What you're seeing is a stack trace. It's an un-handled error from the kernel showing the path of execution when something goes so damn wrong that there's nothing else in place to do except log the problem and leave it for a human to figure out. The call at the head is usually the defining one: WARNING: at /build/buildd-linux-2.6_2.6.32-45-amd64-FcX7RM/...


9

Check out the rsyslog filter documentation. Here is an example from the docs on how to filter a message. The filter would need to be place in the configuration file before the section that defines the log where the annoying message is being delivered too. :msg, contains, "informational" ~ All messages containing the string "informational" are discarded....



Only top voted, non community-wiki answers of a minimum length are eligible