Tag Info

Hot answers tagged

34

You can, as root, write to /dev/kmsg to print to the kernel message buffer: fixnum:~# echo Some message > /dev/kmsg fixnum:~# dmesg | tail -n1 [28078118.692242] Some message I've tested this on my server and an embedded Linux device, and it works on both, so I'm just going to assume it works pretty much everywhere.


30

Note : This is all regarding Linux and free software, as that's what I mostly use, but you should be fine with a syslog client on Windows to send the logs to a Linux syslog server. Logging to an SQL server: With only ~30 machines, you should be fine with pretty much any centralised syslog-alike and an SQL backend. I use syslog-ng and MySQL on Linux for ...


23

logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, logstash comes with a web interface for searching and drilling into all of your logs. http://code.google.com/p/logstash/ It's still rather early in development, but sound very promising ...


19

Overall, the available documentation for Logwatch lacks adequate explanation and is often far too vague. I pieced together some useful examples, and have reduced the Logwatch noise by over 95%. Here's what I have found. Keep in mind that you can find some Logwatch documentation at /usr/share/doc/logwatch-*/HOWTO-Customize-LogWatch, and it contains a few ...


18

Have you tried syslog-ng and stunnel? Install Stunnel Create certificate files for syslog-ng over Stunnel Configure Stunnel for Use With syslog-ng Install syslog-ng Configure syslog-ng DONE! NOTE: Stunnel (http://www.stunnel.org) is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix ...


17

dmesg displays what is the kernel buffer, where is logger is for syslogd. I think if you want to print things into the kernel buffer you will need to create a driver that uses the printk() kernel function. If you just want it in /var/log/messages , than with a 'normal' setup I think what you have done with logger is already fine. The most basic example of ...


15

You can send the output of cron to a separate log facility add the following to your /etc/syslog.conf file: # Log cron stuff cron.* /var/log/cron Remember to add /var/log/cron to your /etc/logrotate.d/syslog to ensure it gets rotated, eg # /etc/logrotate.d/syslog /var/log/messages /var/log/secure ...


13

Did you restart syslogd? You can also use lsof -f -p <pid-of-syslogd> to see what log files it has open. The syslog.conf looks right, you might want to post your apache configuration.


11

Short answer: VPN It may seem overkill, but it is the right answer and not that complicated to set up.


10

Someone is attempting to resolve those domains against your DNS server, and you clearly don't have recursion or query enabled for people outside of your network. I wouldn't be worried.. It happens when you put a DNS server public..


10

What you're seeing is a stack trace. It's an un-handled error from the kernel showing the path of execution when something goes so damn wrong that there's nothing else in place to do except log the problem and leave it for a human to figure out. The call at the head is usually the defining one: WARNING: at ...


10

You've already rejected "other people's bash scripts", but this is a pretty common solution -- some creative use of the logger command can follow a file and send its contents elsewhere. I personally wouldn't do this in a production environment though. A better option which requires less scripting hackery is using rsyslogd and the text file input module ...


9

If you just need to remove the old server.log and console.log every month you can also use logrotate which is most likely already running under RHEL. A config snippet like this will work in /etc/logrotate.d/*.conf or wherever the config files are located on your system. # rotate server.log and console.log every month # delete, not compress, old file ...


9

I don't have a comparison matrix for the following in my mind, especially when it comes to comparison with splunk: These are some fully operational tools: Octopussy http://www.octopussy.pm Logreport http://www.logreport.org/ Snare: http://www.intersectalliance.com/projects/index.html Log surfer: http://www.crypt.gen.nz/logsurfer/ Log Analyser: ...


9

Log the application name in your messages. Filter on the application name instead of facility. If your applications aren't generating syslog messages directly, you can apply an output filter (e.g., sed) to massage things to look the way you want. Take a look at the Rsyslog documentation on filter conditions to see how you might configure this behavior. ...


9

Yes, syslog is a standardised protocol, in RFC5424. However, it's not a trademark, so there's no reason why someone couldn't come up with something completely unrelated to the syslog protocol and call it WinSysLog (aiee! The camels!). You'll need to investigate whether it is compliant with the standard protocol.


9

setcap 'cap_net_bind_service=+ep' /path/to/syslogd Requires a not-ancient linux kernel (2.6.24 or later)


9

No. For one, the handoff is asynchronous within the local operating system. syslog libraries and the local syslog daemon will either accept the message and fail to deliver it or fail-fast, but either way your app won't hang. Secondly the network protocol is (by default) udp so even if your application blocked until the packet got sent out, it would go ...


8

In the process of writing this question, I answered myself. So I'll answer myself "Jeopardy-style". This expands on the answer provided by Dennis Williamson. The following will send any Cron output to /usr/bin/logger (including stderr, which is converted to stdout using 2>&1), which will send to syslog, with a 'tag' of nsca_check_disk. Syslog handles ...


8

have a look at the logger command. e.g. logger -p auth.notice "Some message for the auth.log file"


8

I've got about 30 servers, and I just use straight up syslog to send all the logs to a single logging server. For backup, all of the machines are also configured to store their own logs locally for a few days, using logrotate to take care of the rotation and deletion of old logs. Each of my application servers runs a small perl script to send their logs to ...


8

Check out the rsyslog filter documentation. Here is an example from the docs on how to filter a message. The filter would need to be place in the configuration file before the section that defines the log where the annoying message is being delivered too. :msg, contains, "informational" ~ All messages containing the string "informational" are ...


8

A couple of things for you to try: Did you enable logging of debug messages in syslog? cp /etc/syslog.conf /etc/syslog.conf.original vi /etc/syslog.conf Add the following line: *.debug /var/log/debug.log Exit with :wq!. touch /var/log/debug.log service syslog restart You can enable debugging for all modules like so: touch /etc/pam_debug OR ...


8

Based on Kyle's module above: #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/proc_fs.h> #include <asm/uaccess.h> static int pk_write(struct file *file, const char *buffer, unsigned long count, void *data) { char string[256]; count = count < 255 ? count : 255; ...


7

If you are running the stock ksyslogd syslog server I don't know how to do this. But there are great instructions for doing it with rsyslog at their Wiki. ( http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log ) I will summarize: On the sending client (rsyslog.conf): # auditd audit.log $InputFileName /var/log/audit/audit.log ...


7

Most modern Syslog daemons (including rsyslog and syslog-ng) support high precision timestamping. If you're using one of these tools, you should have no difficulty configuring it. As to it's accuracy. . . it depends. First of all, it's going to be dependent on the hardware. Most modern hardware supports high precision time, but not all. Assuming the ...


7

You are using the wrong syntax, you have to use ";" as a delimiter. This worked for me: *.*;mail.none;mail.error;auth,authpriv.none -/var/log/syslog You need to restart rsyslog after the changes. Reloading isn't enough.


7

Have you tried Kiwi Syslog Server? I used it for quite a while before I started sending everything to a CentOS box... I'll confess to being a year out of date, but at the time the free version suited my needs.


7

Ok, The solution to my question was: change *.*;auth,authpriv.none -/var/log/syslog to *.*;cron,auth,authpriv.none -/var/log/syslog within /etc/syslog.conf and then restart syslog I also have cron being sent to /var/log/cron.log as suggested by Dave Cheney and stuck a logrotate on it. My fix with Daves suggestion is optimal for my situation ...


7

More aimed at *nix than windows, but octopussy does support windows, and seems to aim at the same kind of thing as splunk.



Only top voted, non community-wiki answers of a minimum length are eligible