Tag Info

Hot answers tagged

5

Debian uses rsyslog and you can check it is running pretty much exactly like checking apache is running /etc/init.d/rsyslog status [ ok ] rsyslogd is running. Or you could use the service command (which does pretty much the same thing) service rsyslog status [ ok ] rsyslogd is running.


3

Instead of using the symbolic name 'audit' you have to use the numeric code 13: filter f_audit { facility (13); };


3

syslog-ng is very straight forward (but a lot wordier) once you understand the structure of its configuration file. In such a simple installation like yours all you need to know for now is that you have to configure sources, filters, and destinations. I am not sure what version of syslog-ng you are running but here's one for 3.0.x (which will work for more ...


3

Try using syslog-ng. I ran into a number of problems with syslogd on openwrt. I suspect you are running into the similar problems. See my documentation on using syslog-ng with openwrt. My logging server is Ubuntu running rsyslogd. Alternatively, you should be able to do the required changes on the logging server using syslog-ng to rerwrite the log ...


3

RFC 3164 that Warner pointed you to describes the network format for UDP syslog messages, you can rely on this being what goes over the wire, but syslogd may write something slightly different to disk when it logs your messages. That said, you can usually rely on syslog entries resembling what's described in the RFC, roughly in the form: DATE HOSTNAME TAG: ...


3

It may be worthwhile to take a look at syslog-ng which does support TCP (and is a better solution overall). http://freshmeat.net/projects/syslog-ng/


2

This is a known problem with syslogd. Hostnames are not preserved across hosts. http://novosial.org/logging/syslogd-problems/ As suggested, try using syslog-ng.


2

The RFC should answer this question. To my knowledge: yes, that's usually the case.


2

`!-prog' specification will match any message but the ones from that program: !-dhcpd *.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console *.info;mail.none;authpriv.none /var/log/messages ...... !dhcpd *.* /var/log/dhcpd.log


2

You can use the pidof utility to check whether pretty much any program is running (if it gives out at least one pid, the program is running). If you are using syslog-ng, this would be pidof syslog-ng; if you are using syslogd, it would be pidof syslogd.


1

Re: where to place '-c5' -- CentOS uses /etc/sysconfig/rsyslog as the configuration file for rsyslog's startup arguments, so you need to add '-c5' as the first argument to the SYSLOGD_OPTIONS= line, i.e. SYSLOGD_OPTIONS="-c5" Sorry for not answering all other questions you raised. I think it would have been much better if you asked them as separate, ...


1

just fill in the ones i know D) yes, for all following ones, unless E) is invoked. E) is $ActionSendStreamDriverMode 0 before the next send.


1

It seems that your log messages are sent to /var/log/debug.log because of this line : *.=debug /var/log/debug.log You can either : Use another priority for your tests (eg notice instead of debug) Change the order so that your lines are before the one referring to debug.log


1

is bsdclient.domain.com and bsdserver.domain.com global DNS aware ? If not have you tried putting in an IP instead of DNS names. Please following this excellent handbook section from freebsd handbook


1

It sounds like you're being deluged in spam, either incoming (bad) or being relayed through your server (worse). First, take a look at the mail queue with either sudo postqueue -p or Server Admin -> Mail service -> Maintenance (tab at the bottom of the window) -> Mail Queue (tab at the top). If it shows lots of junk mail addressed to other domains, you're ...


1

For syslog no. There is another syslog implementation called rsyslog ... which supports another protocol named relp. This is exactly what you want for your case.


1

I believe tht the stock syslog daemon on Centos5 does not support this. Also note that port 514/tcp was reserved for 'shell' access, but I think that is deprecated going forward. Check out rsyslog, which has become the default syslog daemon in Ubuntu and RedHat 6 beta (and Centos 6). It can read your existing syslog.conf without any changes, and can also be ...



Only top voted, non community-wiki answers of a minimum length are eligible