Questions tagged [centralized-logging]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
30 views

Skype for Business Centralized Logging Issue

I am trying to use logging to troubleshoot an issue with federation between Skype for Business & Cisco Jabber. Said federation works fine for me but not for a couple of my co-workers. When I ...
0
votes
1answer
146 views

Kubernetes + CRI-O + Fluent-Bit

We like to use the EFK stack for centralised logging of containers running in Kubernetes with CRI-O. The recommended DaemonSet looks like this: kind: DaemonSet metadata: namespace: logging name: ...
0
votes
0answers
36 views

Clean old release files in Sentry

I'm self-hosting Sentry 8 and /var/lib/sentry/files grew to a significant size. I tried launching a script to go through each project's releases via the API, select those older than X days, and remove ...
0
votes
0answers
16 views

Facilty used by incoming syslog

I have been working with rsyslog over the past few weeks and familiarizing myself with it, but I am still a rookie on the subject. One of the use cases I have for it is to receive syslog messages from ...
1
vote
2answers
37 views

What are some good patterns for cleaning up noisy logging alerts

In addition to traditional logging from applications going into e.g. Elasticsearch, an organisation may have an alerting system "Sentry" that receives log messages/exception events sent by ...
2
votes
2answers
775 views

Windows Event Forwarding large scale with multiple domains

Let me start off explaining what I'm trying to do: We have an RMM tool installed on lots of Windows servers. It is able to send Windows Event Logs to a central store, but not in an efficient or ...
0
votes
0answers
171 views

Can I use netcat for centralized logging?

I have multiple Apache servers and I want to centralize their access logs. I wonder if I can use named pipes and netcat for that, however I am afraid that 2 things may happen: The central log will be ...
0
votes
1answer
1k views

Logrotate with `copytruncate` “data loss” - is it serious?

Manpage of logrotate claims that using copytruncate option leads to "a very small time slice between copying the file and truncating it, so some logging data might be lost". Is it actually ...
1
vote
2answers
4k views

syslog direct to AWS cloudwatch?

Is there a way to push POSIX syslog records directly to AWS cloudwatch? I know Cloudwatch can be rigged to look at the /var/log/messages files and similar. But is there a way -- a sylog.conf(5) ...
7
votes
2answers
4k views

What is the equivalent of 'sudo yum install -y awslogs' for apt-get?

According to aws documentation, this is the command to install the aws-log agent: sudo yum install -y awslogs However since I am using ubuntu, I have to use apt-get. But the aws-log package is not ...
0
votes
1answer
332 views

Can't get Freeradius2 to send logs to syslog-ng version 3.5

I have a Syslog-ng 3.5 and freeradius2 Ubuntu server 16.04 both running as virtual machines in a vmware esxi 5.5 HYpervisor. Well from a previous post I got sylog-ng to send logs from /var/log/...
0
votes
1answer
399 views

Sending sssd.log to syslog

How do I configure SSSD to send sssd.log logs to syslog? I would like to include the DEBUB SSSD logs as well. We would like to feed the sssd logs to Splunk. Our systems are already configured to send ...
0
votes
1answer
321 views

Cannot write IIS logs to Azure Files Share

I'd like to configure IIS (8.5) on an Azure VM to log to an Azure Files Share. I've proved access to the share by remoting onto the VM and persisting credentials using cmdkey and then navigating ...
0
votes
1answer
258 views

Searching Lync Centralized Logging Using Time

This is my first attempt to use the Centralized Logging Service to try to generate some logs for a problem a user is having, so perhaps I'm not doing something right. I'm using the commands below to ...
1
vote
0answers
190 views

Logwatch for multiple log 'root directories' on a central log server?

I have multiple clusters, each with a service machine that also collects all the logs (rsyslog and RELP). I started separating them to /data/logs/<hostname>/* so the messages, maillog and other ...
1
vote
1answer
2k views

Apache piped logging failing

I am trying to write a simple apache piped logging directive and I am getting a failure. I just want to grep out 200 response codes for centralizing my log files to ELK. This is the custom log format ...
3
votes
1answer
47 views

Handling log files across mulitple Windows Servers

I have an application that at any time could be running on 1 of 4 windows servers. Hence, if I am looking for a specific log item, it could be in any of the 4 log files. What I am looking to do is ...
2
votes
1answer
74 views

Ignoring Healthchecks With Graylog-Collector

I have a log file with a mix of health checks and actual hits in it. I'd like to collect all the logs except the /healthcheck hits. Can graylog-collector handle this for me? I've read through the ...
4
votes
1answer
3k views

AWS Cloudwatch Agent not picking up changes

I'm stumped. I have two log files being watched by the AWS CloudWatch agent. The first one, /var/log/nginx/access.log, works perfectly fine. The second, /var/log/otherserver/access.log, is not having ...
0
votes
1answer
65 views

syslog clipping for particular applications

I have a few particular applications that are causing a LOT of logs in my syslog server. I would like to keep all of their logging in /var/log/messages or somewhere on the server, but I am trying to ...
1
vote
0answers
2k views

How can I separate logs with rsyslog from a remote location for devices using the same IP?

I have a number of Yealink SIP phones at different locations that I am trying to centralize log collection for. I have set up a CentOS server at my main location with rsyslog. I am forwarding all ...
0
votes
1answer
69 views

Central Logging Options - need flat file as well as elastic search

I would like to have ephemeral ec2 instances push logs to a central flat-file store for archiving and manual perusing, as well has have that data pushed to elastic search. Is there a single agent ...