Tag Info

Hot answers tagged

39

You can, as root, write to /dev/kmsg to print to the kernel message buffer: fixnum:~# echo Some message > /dev/kmsg fixnum:~# dmesg | tail -n1 [28078118.692242] Some message I've tested this on my server and an embedded Linux device, and it works on both, so I'm just going to assume it works pretty much everywhere.


30

Note : This is all regarding Linux and free software, as that's what I mostly use, but you should be fine with a syslog client on Windows to send the logs to a Linux syslog server. Logging to an SQL server: With only ~30 machines, you should be fine with pretty much any centralised syslog-alike and an SQL backend. I use syslog-ng and MySQL on Linux for ...


24

logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, logstash comes with a web interface for searching and drilling into all of your logs. http://code.google.com/p/logstash/ It's still rather early in development, but sound very promising ...


21

Overall, the available documentation for Logwatch lacks adequate explanation and is often far too vague. I pieced together some useful examples, and have reduced the Logwatch noise by over 95%. Here's what I have found. Keep in mind that you can find some Logwatch documentation at /usr/share/doc/logwatch-*/HOWTO-Customize-LogWatch, and it contains a few ...


18

Have you tried syslog-ng and stunnel? Install Stunnel Create certificate files for syslog-ng over Stunnel Configure Stunnel for Use With syslog-ng Install syslog-ng Configure syslog-ng DONE! NOTE: Stunnel (http://www.stunnel.org) is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix ...


18

dmesg displays what is the kernel buffer, where is logger is for syslogd. I think if you want to print things into the kernel buffer you will need to create a driver that uses the printk() kernel function. If you just want it in /var/log/messages , than with a 'normal' setup I think what you have done with logger is already fine. The most basic example of ...


16

You can send the output of cron to a separate log facility add the following to your /etc/syslog.conf file: # Log cron stuff cron.* /var/log/cron Remember to add /var/log/cron to your /etc/logrotate.d/syslog to ensure it gets rotated, eg # /etc/logrotate.d/syslog /var/log/messages /var/log/secure ...


14

In the process of writing this question, I answered myself. So I'll answer myself "Jeopardy-style". This expands on the answer provided by Dennis Williamson. The following will send any Cron output to /usr/bin/logger (including stderr, which is converted to stdout using 2>&1), which will send to syslog, with a 'tag' of nsca_check_disk. Syslog handles ...


13

Did you restart syslogd? You can also use lsof -f -p <pid-of-syslogd> to see what log files it has open. The syslog.conf looks right, you might want to post your apache configuration.


11

Short answer: VPN It may seem overkill, but it is the right answer and not that complicated to set up.


11

You've already rejected "other people's bash scripts", but this is a pretty common solution -- some creative use of the logger command can follow a file and send its contents elsewhere. I personally wouldn't do this in a production environment though. A better option which requires less scripting hackery is using rsyslogd and the text file input module ...


10

setcap 'cap_net_bind_service=+ep' /path/to/syslogd Requires a not-ancient linux kernel (2.6.24 or later)


10

Someone is attempting to resolve those domains against your DNS server, and you clearly don't have recursion or query enabled for people outside of your network. I wouldn't be worried.. It happens when you put a DNS server public..


10

A couple of things for you to try: Did you enable logging of debug messages in syslog? cp /etc/syslog.conf /etc/syslog.conf.original vi /etc/syslog.conf Add the following line: *.debug /var/log/debug.log Exit with :wq!. touch /var/log/debug.log service syslog restart You can enable debugging for all modules like so: touch /etc/pam_debug OR ...


10

Log the application name in your messages. Filter on the application name instead of facility. If your applications aren't generating syslog messages directly, you can apply an output filter (e.g., sed) to massage things to look the way you want. Take a look at the Rsyslog documentation on filter conditions to see how you might configure this behavior. ...


10

What you're seeing is a stack trace. It's an un-handled error from the kernel showing the path of execution when something goes so damn wrong that there's nothing else in place to do except log the problem and leave it for a human to figure out. The call at the head is usually the defining one: WARNING: at ...


10

Well, after almost a day of hair pulling, I finally understand a) how to do it and b) a misconception I have about sec. In reading the sec man page and it describes desc= as essentially showing the match. So in my mind, that meant it should show whatever was matched in pattern. Well, yes, that is true, in this case the match in that pattern is the; ...


9

Yes, syslog is a standardised protocol, in RFC5424. However, it's not a trademark, so there's no reason why someone couldn't come up with something completely unrelated to the syslog protocol and call it WinSysLog (aiee! The camels!). You'll need to investigate whether it is compliant with the standard protocol.


9

No. For one, the handoff is asynchronous within the local operating system. syslog libraries and the local syslog daemon will either accept the message and fail to deliver it or fail-fast, but either way your app won't hang. Secondly the network protocol is (by default) udp so even if your application blocked until the packet got sent out, it would go ...


9

If you just need to remove the old server.log and console.log every month you can also use logrotate which is most likely already running under RHEL. A config snippet like this will work in /etc/logrotate.d/*.conf or wherever the config files are located on your system. # rotate server.log and console.log every month # delete, not compress, old file ...


9

I don't have a comparison matrix for the following in my mind, especially when it comes to comparison with splunk: These are some fully operational tools: Octopussy http://www.octopussy.pm Logreport http://www.logreport.org/ Snare: http://www.intersectalliance.com/projects/index.html Log surfer: http://www.crypt.gen.nz/logsurfer/ Log Analyser: ...


8

Check out the rsyslog filter documentation. Here is an example from the docs on how to filter a message. The filter would need to be place in the configuration file before the section that defines the log where the annoying message is being delivered too. :msg, contains, "informational" ~ All messages containing the string "informational" are ...


8

I've got about 30 servers, and I just use straight up syslog to send all the logs to a single logging server. For backup, all of the machines are also configured to store their own logs locally for a few days, using logrotate to take care of the rotation and deletion of old logs. Each of my application servers runs a small perl script to send their logs to ...


8

Based on Kyle's module above: #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/proc_fs.h> #include <asm/uaccess.h> static int pk_write(struct file *file, const char *buffer, unsigned long count, void *data) { char string[256]; count = count < 255 ? count : 255; ...


8

Edit: 11/17/14 This answer may still work, but in 2014, using the Audisp plugin is the better answer. If you are running the stock ksyslogd syslog server I don't know how to do this. But there are great instructions for doing it with rsyslog at their Wiki. ( http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log ) I will summarize: On the ...


8

You are using the wrong syntax, you have to use ";" as a delimiter. This worked for me: *.*;mail.none;mail.error;auth,authpriv.none -/var/log/syslog You need to restart rsyslog after the changes. Reloading isn't enough.


8

I figured the exact issue has been encountered by other Debian users (http://forums.debian.net/viewtopic.php?f=5&t=104049). To restore logging, one just needs to reinstall the syslog daemon (removed during upgrade): apt-get install inetutils-syslogd


7

Have you tried Kiwi Syslog Server? I used it for quite a while before I started sending everything to a CentOS box... I'll confess to being a year out of date, but at the time the free version suited my needs.


7

Ok, The solution to my question was: change *.*;auth,authpriv.none -/var/log/syslog to *.*;cron,auth,authpriv.none -/var/log/syslog within /etc/syslog.conf and then restart syslog I also have cron being sent to /var/log/cron.log as suggested by Dave Cheney and stuck a logrotate on it. My fix with Daves suggestion is optimal for my situation ...


7

More aimed at *nix than windows, but octopussy does support windows, and seems to aim at the same kind of thing as splunk.



Only top voted, non community-wiki answers of a minimum length are eligible