Questions tagged [syslog]
syslog is a standard for logging messages about the operation of a system.
675
questions
1
vote
1
answer
33
views
Fluent Bit as Syslog Server Alternative
We have an application deployed on AWS EKS cluster, which has a requirement of sending the application error messages to a syslog server.
Our default logs shipper is Fluent Bit, deployed as a ...
- 111
0
votes
0
answers
21
views
rsyslog separate log of sources of data
We have a rsyslog server running on Red Hat. Listening on UDP and TCP 514.
This simply forwards everything to a MS agent on the server which send the logs to Azure Log Analytics/Sentinel. The Azure ...
0
votes
0
answers
14
views
Rsyslog Client hello message showing Too many ciphers when used tls connection?
I have configured rsyslog over tls , My client hello message sending too many ciphers :
Tried using debian machines and Redhat 8 Machines both resulted in same way.
rsyslog version : 8.2404
gnutls - 3....
1
vote
2
answers
43
views
Upgraded to debian bookworm - How do I configure monit to check for text in syslog (systemd's journal)?
I have been using monit for some time. One of the checks I had was to make sure that my mail server wasn't being abused. I use milter-limit to limit the rate of sending - and it logs to syslog. Prior ...
- 113
0
votes
0
answers
36
views
How I can send logs through syslog due to another process state?
I'm trying to set up rsyslog to process messages from the audispd program using a custom script, check.sh. The script is supposed to check if a specific process is running, and if it is, discard the ...
- 1
0
votes
2
answers
29
views
How to detect smartd errors from logs
I want to monitor multiple servers, and want to know when a drive fails.
I have a script which monitors /var/log/syslog. What i want is a regex that matches only when a drive has a big problem. I do ...
- 221
0
votes
0
answers
51
views
Fortigate 40F syslog over TCP not working, but UDP works
Trying to send syslog over TCP from Fortigate 40F does not work, but it works over UDP.
The config for the syslogd settings are:
config log syslogd setting
set status enable
set server "...
- 1
0
votes
1
answer
56
views
script to print dhcpd.leases info to syslog/file
So i'm running dhcpd on a server and to my knowledge the logs from dhcpd are not adjustable, if they are i'm dying to know how...
Anyways, i need something to check the dhcpd.leases-file which is ...
- 11
0
votes
0
answers
65
views
how do I make powerdns-recursor log its match to its RPZ?
I have powerdns-recursor on hundreds of machines set up with a rpz zone loaded from a distant server.
Everything works fine. The rpz contains only malware domain to avoid, so on most machines I need ...
- 456
0
votes
1
answer
101
views
Is there a way to prevent log spamming with rsyslog?
I have AuditD running and one process like to constantly spawn children processes that do the same activity. Is there a way to have rsyslog not send in the same log message again? The hard part is the ...
- 3,941
1
vote
2
answers
247
views
syslog-ng adds a prefix to syslog messages
I have a squid proxy logging access logs to a file and syslog-ng reading those logs and based on squid's action it sets a severity - either info or notice - and forwards that as a syslog message to a ...
- 133
0
votes
0
answers
32
views
Rsyslog storing only certain type of events in a file
I am collecting TM Deepsecurity events on my syslog server. The TM manager sends logs to my syslog server on port 514. There are two types of events TM sends. Deep Security Agent & Deep ...
- 1
2
votes
2
answers
407
views
How to tell syslog-ng to ignore source files if they are absent
I'm trying to deploy a standard configuration file for syslog-ng on multiple linux servers. My infrastructure includes many services (apache, confluence, ...) with log file located at various places.
...
- 29
0
votes
0
answers
58
views
How to get syslogd and/or Apache2 to STOP logging DEBUG messages to console
When I SSH into one of my Linux boxes (Ubuntu 20.04.2), I periodically see messages appear on the console screen:
Message from syslogd@my-hostname at Jan 30 21:35:17 ...
apache2: [MY-APP] DEBUG - 2024-...
- 1
0
votes
1
answer
119
views
Microsoft Defender: extract Automatic log upload data
Is there a way to extract this automatic log upload table from defender:
my goal is to use this information to aid in responding to the System alert: Cloud Discovery automatic log upload error alert ...
- 101
9
votes
2
answers
30k
views
Where is some os logs in Debian 12
It seems that some of the system log files (/var/log/syslog, /var/log/auth.log, /var/log/kern.log, ...) have been removed in the latest version of Debian, Debian Bookworm. What should be done to ...
- 423
0
votes
1
answer
65
views
Sending ESXI audit logs to http endpoint?
Is it possible to send audit logs from ESXI's (or better yet, vCenter) to an http endpoint via API/webhook rather than a syslog server?
Couldnt find a direct answer or a tutorial online.
Thanks!
0
votes
0
answers
105
views
Enable $RepeatedMsgReduction only for specific log file
If this were the script for routing messages to log files in rsyslog.conf, is it possible to activate RepeatedMsgReduction only for app_log?
if ($syslogfacility-text == "auth") then {
...
- 1
0
votes
1
answer
399
views
Rsyslog not writing any logs from Cisco network devices - all other remote syslog works fine
tcpdump confirms valid syslog is coming in from multiple remote systems - servers and Cisco network equipment.
OS is Linux RHEL 8.8
The servers all come in fine and write to disk, and are shown as ...
0
votes
0
answers
30
views
syslog diff or comparison that reorders identical lines to ignore race conditions?
Sometimes when debugging intermittent boot problems, it would be advantageous compare two exerpts from syslog: One leading to a working system, and one leading to the symptom. However, diff is not ...
- 158
1
vote
1
answer
141
views
Is syslog over udp safe on a local network?
I have a device that doesn't support sending tls syslog traffic, and can only send udp syslog. I'm only sending logs over my local network, but I'm worried the non-tls data can be read by anyone on ...
- 141
0
votes
1
answer
2k
views
Issue Getting Rsyslog TLS Configuration Working
Overview
I have a server that receives Syslog data from external clients, and I do not have administrative access to these clients. The goal is to move the existing configuration to data in transit ...
- 1
0
votes
0
answers
159
views
Split logging on rsyslogd
My goal is to send all logs to one source remote and still log local but then send all the AuditD logs to its own source on port 20002. But for some reason, my auditd logs are still ending up with my ...
- 3,941
1
vote
1
answer
207
views
Postfix logging incomplete after changing myhostname
My postfix installation does not log most of the messages after changing myhostname. The myhostname is now different from the FQDN (and hostname) of the machine where it used to be the same. After ...
- 121
0
votes
1
answer
81
views
Ssh messages do not output to a pipe configured in syslog.conf
I have configured a pipe in syslog.conf for auth.* to capture the ssh syslog error and status messages. I have then a python script that processes this pipe's input and I check that we receive ...
- 3
0
votes
0
answers
195
views
Add mac address in rsyslog template
I am trying to add system/device mac address in syslog. No solution is working for me. Following command gives me mac address, just wanted to use in rsyslog template.
mac_addr=$(ifconfig en0 | awk '/...
1
vote
0
answers
317
views
LogStash and parsing OPNSenser logs
My logs are coming in as follows:
<134>May 24 14:39:32 edge.internal filterlog[2535]: 78,,,ffe6d10d1f27a42fc0edc3abb3a6d333,ovpnc1,match,pass,out,4,0x0,,63,61951,0,DF,6,tcp,60,10.8.0.2,20.44.17....
- 3,941
0
votes
1
answer
167
views
rSyslog stopped sending only SOME data
I have configured a remote logging from one of my servers to the central log server via rsyslog TCP/SSL
Everything worked fine until yesterday where most of the files just stop being transmitted while ...
- 119
0
votes
1
answer
2k
views
Understanding Samba VFS Operations for Full Audit
We have a TrueNAS System running TrueNAS-12.0-U8 for which we are required to log all successful and all failed file access attempts for a specific SMB share. The Samba version is 4.13.
Per guidance ...
- 843
1
vote
2
answers
293
views
syslog-ng filter log by frequency to destination file
I have a syslog-ng that receives too many logs and I am trying a way to 'sample' them using some filter.
I assume editing the /etc/syslog-ng/syslog-ng.conf with something like
log { source(s_udp514); ...
- 109
0
votes
1
answer
2k
views
Postfix logging to syslog even though it's excluded
Ubuntu 22.04 and postfix 3.6.4
Postfix config is set to use syslog_facility=mail, and I have modified /etc/rsyslog.d/50-default.conf to the following
*.*;mail,auth,authpriv.none -/var/log/syslog
...
- 156
0
votes
1
answer
356
views
Syslog-ng enable TCP framing
I'm trying to send file entries as messages via TCP, where syslog-ng is in a container and it is sending to another container. I've had two different attempts both with problematic behavior. The first ...
- 109
-1
votes
1
answer
2k
views
splunk syslogs Forwarder set up not working and paused data flow
I have set up the Universal Forwarder locally in my machine using this guide
https://splunk.paloaltonetworks.com/universal-forwarder.html
/opt/splunkforwarder/etc/system/local/inputs.conf
[monitor:///...
- 109
0
votes
0
answers
70
views
Unexpected ubuntu server down
I am using an Ubuntu Server 16.04LTS running ISP config that is hosted an VMware ESXi
I experienced an unexpected shutdown issue, and I'm trying to identify the source.
Upon checking the logs, I was ...
- 1
0
votes
0
answers
50
views
Crontab I have tried cronitor airplane nothing helps
my crontabs do not run, sys log gives me this, Jan 6 08:30:02 joe-sbc-flt1 CRON[102851]: (joe) CMD (/home/joe/scripts/watchit.sh) I have no idea what it means or what is wrong, can anyone help?
2
votes
0
answers
337
views
How to add to excludes alerts on smartmontool
I faced with problem and hope for your help.
Started getting notifications from smart on Debian 10 server:
Device: /dev/nvme1, Critical Warning (0x04): Reliability
Found that this alert causing ...
- 21
0
votes
1
answer
817
views
How do I get Docker to include the host hostname in syslog?
I have configured docker to use the syslog log driver. My daemon.json looks like this:
{
"log-driver": "syslog",
"log-opts": {
"syslog-address": "...
- 9
0
votes
1
answer
348
views
define custom fields for systemd-journald
The doc states, it may be possible to define new fields by applications.
What does it mean? Can one define arbitrary fields or are only those possible listed in the doc USER JOURNAL FIELDS?
If ...
- 146
0
votes
1
answer
2k
views
php-fpm access log to rsyslog
I am trying to find a solution for getting logs from php72 php-fpm yii2 application behind nginx on several numbers of servers:
at now application writes its logs to files on server disk, yii performs ...
2
votes
1
answer
7k
views
Where does Ubuntu log TCP connections?
When doing some network security checks (on which I am an amateur) for my office PC, I discovered a few unknown tcp6 connections (with netstat -nt):
Active Internet connections (w/o servers)
Proto ...
- 123
0
votes
1
answer
25
views
syslog access beginning of log line
I would like to filter the content of my logs generated by Syslog, I'm applying a filter based on $msg but it is not containing the beggining of the line:
2022-09-29T16:39:39Z SYS_SERVER_2 - - - - - A ...
- 103
0
votes
1
answer
2k
views
Combining multiple Property-Based Filters for Rsyslog
I was trying to set up a specific Rsyslog configuration file to catch all incoming kernel messages of a few types. For example, I want to dump all logs containing "example message 1" and &...
- 1
1
vote
0
answers
156
views
Postfix - some mails not sent to particular domain and syslog tagging issue
I have a problem with e-mails sent to a particular domain (alice.it).
Usually the mail is corrected sent and in my postfix log I have this:
06104180AF: to=<**********@alice.it>, relay=mx.tim.it[...
- 11
0
votes
1
answer
966
views
rsyslog ruleset for encrypted logging
I've setup managed to setup rsyslog to accept TLS traffic from a clients server. When I configured the certificate and the port originally, it all worked fine. The problem is it is dumping the logs ...
1
vote
2
answers
910
views
Why would you want to change the log_msg_size from syslog-ng's default of 64k?
Per the syslog-ng admin guide, the log_msg_size defaults to 64k (65536 bytes)
However, I have seen some sample syslog-ng config files (like this one) that drop this to <18k (18192 bytes)
Why would ...
- 19k
1
vote
1
answer
220
views
Configuring rsyslog to route messages to different log files based on content
Can rsyslog be configured to route log messages to different log files/locations based on the content of the log message? If so, how and could I see a simple example?
- 143
0
votes
1
answer
1k
views
Sending rsyslog messages to remote file system
I have an Ubuntu server that will be running rsyslog and many "client" devices and applications sending logs to it (via various syslog clients).
I know that rsyslog logs everything to /var/...
- 143
2
votes
1
answer
5k
views
Different postfix logfile format when logging to separate file (maillog_file)
In order to separate the mail logs from the general system logs, I added this line to /etc/postfix/main.cf
maillog_file = /var/log/postfix.log
As expected, a file /var/log/postfix.log is created, and ...
- 930
1
vote
1
answer
2k
views
Why some companies like cisco follow different syslog messaging format rather than rfc 3164 (BSD syslog) and rfc 5424 (IETF syslog)?
According to my understanding the popular syslog formats are:
RFC 3124 (BSD syslog):
Format: < priority >timestamp hostname application: message
Example: <133>Feb 25 14:09:07 webserver ...
- 15
1
vote
1
answer
4k
views
why is faillog, tallylog and lastlog so big?
I got a notice from a backup system (rsnapshot) today that it's storage volume was full. A closer look reveals some older snapshots where faillog, tallylog and lastlog are bigger than the actual ...
- 341