Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [syslog]

syslog is a standard for logging messages about the operation of a system.

1
vote
0answers
11 views

Send mail when ClamAV detects a threat using systemd

Most of the guides for ClamAV discuss integration with syslog, and it is possible to configure syslog to send a message on certain logs. But, my system is running systemd, with no active syslog....
0
votes
1answer
26 views

Logger with UDP support on Alpine

I am trying to figure which package (if any) I need to install on an Alpine docker image in order for the logger command to support the --udp flag. By default, the logger command in alpine only ...
0
votes
1answer
53 views

Debian stuck without any records in syslog

I am having problem with dedicated server I am hosting on Hetzner. I had similar problem few years before with other dedicated one and I am worried if this thing is my fault or someone other's. It ...
1
vote
0answers
51 views

journald forwarding to syslog seems to be lagged

I'm seeing an issue on a Ubuntu 16.04 box where the copying/forwarding of journal messages to /var/log/syslog seems to be delayed: theuser@host:/etc/systemd$ sudo journalctl -n 1 && sudo tail ...
0
votes
0answers
25 views

Where to find logs from Postgres 11.1 on FreeBSD 11.2?

Having built Postgres 11.1 on my FreeBSD 11.2 machine, where might I find the logs output from Postgres. Specifically, when attempting to start Postgres for the first time, I get an error message ...
1
vote
0answers
49 views

Rsyslog messages not making it to local logfile

I've been tasked with setting up longer/better log retention for our postgres servers, but after configuring postgres to ship logs to syslog via local0 I've found that they never actually hit the ...
-1
votes
1answer
40 views

syslog-ng | How to separate Logs from different Applications from one Client without to use different Ports ???

I have some Samba-Domain-Controllers and one central Syslog-Server. All of them running the latest syslog-ng and SUSE Leap15. Every Log from Samba, Winbind and Bind/Named should go to the central ...
0
votes
0answers
74 views

How to log all Bash (busybox/ash) commands by all users on a server?

How can we locally log all Bash commands run, along with user and time stamp? I am looking for a way to customize Ash sessions with my own sets of aliases and whatnots. What is the Ash equivalent of ...
-1
votes
0answers
38 views

syslog-ng: automatically generate a string to the destination log file

There is a way to automatically generate a fixed/dynamic string to the destination log file on syslog-ng startup? My syslog-ng runs inside a docker and writes to the same file always (using docker ...
0
votes
0answers
13 views

Sending User Login Events to a Syslog Server - eDirectory\iManager

I'm working with an eDirectory implementation and I'm trying to send login events to a syslog server. This is pretty trivial to do with Windows security event auditing. I've found some documentation ...
1
vote
0answers
38 views

Logging of MySQL Queries and Forwarding to Syslog/Event log

I was to able to enable Error log, General Query log, Slow Query Log and Binary Log and was able to forward the logs to Syslog. I have few questions about logging. 1) The error log is automatically ...
0
votes
1answer
44 views

postgres log workflow : filter the log events with specific working hours

To analyze postgres logs, our workflow is: postgres logs via syslog rsyslog writes to one text file at midnight we stop postgres pgbadger reads and parses the daily logfile (about 2 Gbyte) We want ...
0
votes
0answers
68 views

log cloud foundry syslog to s3 using the syslog protocol

I want to send my syslog entries to an S3 bucket. Security restrictions have meant that this is the only ways that I can do this. With cloud foundry, you can create a user provided server where I ...
0
votes
0answers
16 views

Syslog log aggregations

I have the following architecture: n Firewall servers sending syslog events to a syslog server I ship the logs from the syslog server (currently via Logstash) to a central logging location Since ...
0
votes
1answer
37 views

Rsyslog eats up storage

I have set up rsyslog to grab various logs on my ubuntu 16.4 instance, but for some reason it eats up my storage until I have no free storage left. So far I couldnt find out what the issue is, also ...
0
votes
0answers
39 views

rsyslog - queues with expiration time

I've configured rsyslog with Disk Assisted options to forward logs to Logstash server. Last night, the status of network of Logstash became unstable. Consequently, bunch of backlog files that contain ...
0
votes
0answers
30 views

Wifi appliance not sending syslog

I am struggling a bit with my new syslog server which is not receiving log from my wifi appliance. My wifi appliance is an aerohive, there is almost nothing about configuring syslog on it on internet, ...
0
votes
1answer
46 views

Centos7 Stop bloated logging

I have a server with the OS Centos 7 and looking at log file(s) such as the messages log file ("/var/log/messages") I can see it is primarily filled with entries like the following: Aug 29 12:46:01 ...
0
votes
1answer
16 views

Daily Log Rotation - retaining original

I'm working on Ubuntu 14.04 hosting a graylog server. In the /var/log/upstart/ directory, I have a plaintext log of all the messages that come in - it's set to rotate every 3GB. However, the problem I ...
0
votes
1answer
90 views

CRON messages being delayed for arbitrary long time in syslog

I found in a few servers's syslog that some of the CRON related messages are written in a wrong time, like the following: Aug 21 06:26:01 hty-controller CRON[30159]: (root) CMD ( python /.../...
1
vote
1answer
74 views

Identifying who is logging to my device

I have a machine that aggregates syslog data from many devices, I keep all the devices that I want to have logging to my device in /etc/hosts so that they all have names that I understand. If a ...
0
votes
1answer
84 views

MySQL 8 - Error log into Syslog

i'am trying to switch /var/log/mysql/error.log into syslog in MySQL 8. Reason is compatibility with our monitoring for parse, maybe not that clean, but it does the job. I had no problem with this on ...
0
votes
0answers
47 views

forward original syslog message

I would like to forward from a log collector many syslog message to another log collector and maintain the original syslog message. When I forward maybe the first log collector add a data and source ...
0
votes
0answers
54 views

How to forward syslog from Palo Alto VM-series firewall in AWS

I'm attempting to get syslog events from a Palo Alto VM-series firewall in AWS, to a SIEM syslog server that also resides in AWS. It seems that Palo Alto has a partnership with splunk so they are ...
0
votes
0answers
11 views

Forward TerminalServices-LocalSessionManager log with op5 syslog forwarder

Using the op5 syslog forwarder, how can one forward the following log: Applications and Services Logs -> Microsoft -> Windows -> TerminalServices-LocalSessionManager One cannot select it in ...
0
votes
3answers
1k views

rotate logs with logrotate and move old files

Logrotate don't move file to oldlogs folder and exit abnormally with code 1. I tried to launch manually it with -d option but no errors are showed. This is my configuration: /var/log/myfolder/*.log { ...
0
votes
1answer
112 views

systemd unit alias (symlink) missing for syslog-ng / syslog

I am having issues with an Ubuntu 16.04.4 machine running systemd and syslog-ng (3.5.6-2.1), where messages logged to syslog by a process (let's call it X) were not received by syslog-ng. Digging into ...
0
votes
0answers
121 views

rsyslogd action suspended using omfwd

We're trying to upload an Apache log to a syslog server, however the upload doesn't happen and in /var/log/syslog we see: Jun 20 02:16:21 caes8 rsyslogd-2007: action 'action 10' suspended, next ...
1
vote
1answer
531 views

Redirect Auditd.log data to rsyslog in RHEL-7

I would like to redirect the auditd log data into rsyslog instead of audit.log file. I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to ...
1
vote
1answer
155 views

Rsyslog pass log to script?

I have been trying to pass captured log to a perl script, however I can not seem to find the right way. Do you have any suggestions for correct way of sending captured log to a script for further ...
1
vote
0answers
248 views

How to get logging to work in PureFTPd in an Alpine Docker container?

I am building upon gists/pure-ftpd to create FTP server instances in a Docker container. Here is my server start command, which I am hacking on: # Args explained at http://debianhelp.co.uk/pureftp....
0
votes
0answers
193 views

How to get the Compute Engine logs to end up in the structured jsonPayload instead of the textPayload?

I'm running an API on a Linux VM as a Compute Instance in the Google Cloud. The API is being run with systemd, and it's logging to syslog. I run the StackDriver logging agent to transfer the logs to ...
0
votes
2answers
162 views

linux redhat + how to resolve the issue about Invalid response packet from host

we have thousand of the following message in /var/log/messages we also have strange issue that machine restart each of couple dayes what need to do in order to avoid these messages? Apr 25 00:08:31 ...
0
votes
1answer
376 views

Retrieve pfSense/freeBSD logs with elk

I am attempting to centralize logs from different systems. I installed the Elastick Stack (Elasticsearch, Logstash, Kibana) and WAZUH OSSEC on one server (named elk). I have installed the OSSEC ...
6
votes
2answers
4k views

Is it still allowed to have log files under the new GDPR? [closed]

Is it still allowed to have server access log files under the new GDPR? Because of the gathering of IP addresses is not allowed, I can imagine that system operators are in violation of the law in ...
4
votes
1answer
2k views

Send NGINX logs to Graylog

I'm trying to collect nginx error and access logs with graylog, I think everything is correctly configured, but Graylog receive nothing from NGINX (Graylog & NGINX are in docker containers and ...
0
votes
1answer
392 views

Rsyslog creating duplicate entries when forwarding application logs

I'm trying to add a new application log forward to a host which is already setup to send it's logs to a remote syslog server. I'm following the directions here: http://www.rsyslog.com/doc/v7-stable/...
0
votes
0answers
182 views

What should be done after updating rsyslog configuration on Centos 7?

I mostly have the default /etc/rsyslog.conf except I have an include to this file: $EscapeControlCharactersOnReceive off *.info;auth,authpriv.none /var/log/some_other_log_file I ...
0
votes
1answer
72 views

Advice on deploying services like NTP, DNS, Radius etc for a small NOC

network engineer here. I recently deployed a small office network and was asked to help out with deployment of some of the services. I have two ESXi servers on my hands and I need to deploy NTP, ...
0
votes
0answers
23 views

Prevent unauthorized rsyslog connections when doing log aggregation

I'm using syslog to collect logs from several machines and feed them to a machine learning tool. I have set up TLS encryption following the advice, but I've noticed that other hosts are connecting ...
1
vote
1answer
6k views

Create separated syslog file for each host with rsyslog

I have a syslog server (running rsyslog on RHEL 7.4) that consolidates all the syslogs from my network devices. It's listening on port TCP/514. I want to redirect the logs of each device to a ...
0
votes
0answers
110 views

SYSLOG traffic is not visible on wireshark

At my workplace I am facing this issue. we have dual homed network. taken MPLS links from two providers. We are trying to send syslogs to the syslog server which is in US. I am trying to send these ...
1
vote
1answer
43 views

Can a Syslog server recognize a client OS?

I recently set up a central syslog server. Logs are organized in files, in folder named after the client machines (using DNS), and scanned with logcheck. Some of the client machines have more than ...
-1
votes
2answers
484 views

Don't see syslog get logged anywhere on server

I want to export syslog from an IP phone to a remote syslog server. I have set everything up, I can see the syslog packets getting to the server when doing a tcpdump, but I don't see the syslog in a ...
1
vote
2answers
2k views

How to test network connectivity on specific UDP port between 2 linux hosts

I am looking for a method to test network connectivity on specific port between 2 linux hosts. Let's say for an example: I am sending syslog events from server A to server B on port 514. however, ...
0
votes
1answer
476 views

Using HAProxy for syslog traffic at scale

I have an environment that generates a frankly ludicrous amount of Syslog traffic - this is mostly due to a culture of leaving debug-level logging on in production applications (and changing this ...
0
votes
1answer
1k views

syslog-ng logs sent to multiple destination

I'm getting remote nginx syslogs going to both /var/log/nginx and /var/log/splunk on my syslog-ng server. How do I only get it to go to /var/log/nginx? #/etc/syslog-ng/syslog-ng.conf source s_sys { ...
0
votes
1answer
171 views

Piping to systemd-cat or logger doesn't work in a cron job

I'm running a database backup script via cron, and would like to send the program's output to the system log (so it gets sent to Stackdriver Logging). I've been trying to run the following: /opt/...
0
votes
1answer
70 views

What is status=24/XPU in syslog?

A service failed on my server with this message: systemd[1]: my.service: Main process exited, code=killed, status=24/XCPU What does it mean? I couldn't find anything related to this status. Ubuntu ...
1
vote
5answers
2k views

reliable export of journalctl logs

I search a way for a reliable export of journalctl logs. I could use the --since=... option, but this is a bit fuzzy. In my case a script would call journalctl --output=json every ten minutes. I ...