Questions tagged [syslog]
syslog is a standard for logging messages about the operation of a system.
660
questions
0
votes
0
answers
23
views
syslog diff or comparison that reorders identical lines to ignore race conditions?
Sometimes when debugging intermittent boot problems, it would be advantageous compare two exerpts from syslog: One leading to a working system, and one leading to the symptom. However, diff is not ...
- 158
1
vote
1
answer
31
views
Is syslog over udp safe on a local network?
I have a device that doesn't support sending tls syslog traffic, and can only send udp syslog. I'm only sending logs over my local network, but I'm worried the non-tls data can be read by anyone on ...
- 21
0
votes
0
answers
174
views
Issue Getting Rsyslog TLS Configuration Working
Overview
I have a server that receives Syslog data from external clients, and I do not have administrative access to these clients. The goal is to move the existing configuration to data in transit ...
- 1
0
votes
0
answers
39
views
Split logging on rsyslogd
My goal is to send all logs to one source remote and still log local but then send all the AuditD logs to its own source on port 20002. But for some reason, my auditd logs are still ending up with my ...
- 3,931
1
vote
1
answer
55
views
Postfix logging incomplete after changing myhostname
My postfix installation does not log most of the messages after changing myhostname. The myhostname is now different from the FQDN (and hostname) of the machine where it used to be the same. After ...
- 121
0
votes
1
answer
38
views
Ssh messages do not output to a pipe configured in syslog.conf
I have configured a pipe in syslog.conf for auth.* to capture the ssh syslog error and status messages. I have then a python script that processes this pipe's input and I check that we receive ...
- 3
0
votes
0
answers
95
views
Add mac address in rsyslog template
I am trying to add system/device mac address in syslog. No solution is working for me. Following command gives me mac address, just wanted to use in rsyslog template.
mac_addr=$(ifconfig en0 | awk '/...
1
vote
0
answers
117
views
LogStash and parsing OPNSenser logs
My logs are coming in as follows:
<134>May 24 14:39:32 edge.internal filterlog[2535]: 78,,,ffe6d10d1f27a42fc0edc3abb3a6d333,ovpnc1,match,pass,out,4,0x0,,63,61951,0,DF,6,tcp,60,10.8.0.2,20.44.17....
- 3,931
0
votes
0
answers
56
views
Disable Cisco Router syslog messages
I am trying to disable syslog messages from showing in my cisco 1kv tty. The conundrum is terminal monitor has a single command to set the logging level #logging terminal <severity>, and if I ...
- 15
0
votes
1
answer
54
views
rSyslog stopped sending only SOME data
I have configured a remote logging from one of my servers to the central log server via rsyslog TCP/SSL
Everything worked fine until yesterday where most of the files just stop being transmitted while ...
- 109
0
votes
1
answer
534
views
Understanding Samba VFS Operations for Full Audit
We have a TrueNAS System running TrueNAS-12.0-U8 for which we are required to log all successful and all failed file access attempts for a specific SMB share. The Samba version is 4.13.
Per guidance ...
- 843
1
vote
2
answers
181
views
syslog-ng filter log by frequency to destination file
I have a syslog-ng that receives too many logs and I am trying a way to 'sample' them using some filter.
I assume editing the /etc/syslog-ng/syslog-ng.conf with something like
log { source(s_udp514); ...
- 109
0
votes
1
answer
504
views
Postfix logging to syslog even though it's excluded
Ubuntu 22.04 and postfix 3.6.4
Postfix config is set to use syslog_facility=mail, and I have modified /etc/rsyslog.d/50-default.conf to the following
*.*;mail,auth,authpriv.none -/var/log/syslog
...
- 156
0
votes
1
answer
126
views
Syslog-ng enable TCP framing
I'm trying to send file entries as messages via TCP, where syslog-ng is in a container and it is sending to another container. I've had two different attempts both with problematic behavior. The first ...
- 109
-1
votes
1
answer
716
views
splunk syslogs Forwarder set up not working and paused data flow
I have set up the Universal Forwarder locally in my machine using this guide
https://splunk.paloaltonetworks.com/universal-forwarder.html
/opt/splunkforwarder/etc/system/local/inputs.conf
[monitor:///...
- 109
0
votes
0
answers
43
views
Unexpected ubuntu server down
I am using an Ubuntu Server 16.04LTS running ISP config that is hosted an VMware ESXi
I experienced an unexpected shutdown issue, and I'm trying to identify the source.
Upon checking the logs, I was ...
- 1
0
votes
0
answers
40
views
Crontab I have tried cronitor airplane nothing helps
my crontabs do not run, sys log gives me this, Jan 6 08:30:02 joe-sbc-flt1 CRON[102851]: (joe) CMD (/home/joe/scripts/watchit.sh) I have no idea what it means or what is wrong, can anyone help?
1
vote
0
answers
153
views
How to add to excludes alerts on smartmontool
I faced with problem and hope for your help.
Started getting notifications from smart on Debian 10 server:
Device: /dev/nvme1, Critical Warning (0x04): Reliability
Found that this alert causing ...
- 11
0
votes
1
answer
292
views
How do I get Docker to include the host hostname in syslog?
I have configured docker to use the syslog log driver. My daemon.json looks like this:
{
"log-driver": "syslog",
"log-opts": {
"syslog-address": "...
- 9
0
votes
1
answer
146
views
define custom fields for systemd-journald
The doc states, it may be possible to define new fields by applications.
What does it mean? Can one define arbitrary fields or are only those possible listed in the doc USER JOURNAL FIELDS?
If ...
- 136
0
votes
0
answers
115
views
How to generate McAfee ePO logs?
I'm configuring rsyslog to parse, store and forward the logs generated by McAfee ePO
How can I trigger some real logs to be generated manually so that I don't have to wait (it can take a while) to see ...
- 101
0
votes
0
answers
788
views
php-fpm access log to rsyslog
I am trying to find a solution for getting logs from php72 php-fpm yii2 application behind nginx on several numbers of servers:
at now application writes its logs to files on server disk, yii performs ...
1
vote
1
answer
2k
views
Where does Ubuntu log TCP connections?
When doing some network security checks (on which I am an amateur) for my office PC, I discovered a few unknown tcp6 connections (with netstat -nt):
Active Internet connections (w/o servers)
Proto ...
- 113
0
votes
0
answers
754
views
Promtail - syslog configuration only logs localhost for hostname and IP
I have a number of boxes that run docker containers. To keep a record of all the logs, we have 1 instance of logspout on every box that grabs all container logs on that box, and routes it to a syslog-...
0
votes
1
answer
17
views
syslog access beginning of log line
I would like to filter the content of my logs generated by Syslog, I'm applying a filter based on $msg but it is not containing the beggining of the line:
2022-09-29T16:39:39Z SYS_SERVER_2 - - - - - A ...
- 103
0
votes
1
answer
841
views
Combining multiple Property-Based Filters for Rsyslog
I was trying to set up a specific Rsyslog configuration file to catch all incoming kernel messages of a few types. For example, I want to dump all logs containing "example message 1" and &...
- 1
1
vote
0
answers
62
views
Postfix - some mails not sent to particular domain and syslog tagging issue
I have a problem with e-mails sent to a particular domain (alice.it).
Usually the mail is corrected sent and in my postfix log I have this:
06104180AF: to=<**********@alice.it>, relay=mx.tim.it[...
- 11
0
votes
1
answer
533
views
rsyslog ruleset for encrypted logging
I've setup managed to setup rsyslog to accept TLS traffic from a clients server. When I configured the certificate and the port originally, it all worked fine. The problem is it is dumping the logs ...
1
vote
1
answer
451
views
Why would you want to change the log_msg_size from syslog-ng's default of 64k?
Per the syslog-ng admin guide, the log_msg_size defaults to 64k (65536 bytes)
However, I have seen some sample syslog-ng config files (like this one) that drop this to <18k (18192 bytes)
Why would ...
- 18.4k
1
vote
1
answer
72
views
Configuring rsyslog to route messages to different log files based on content
Can rsyslog be configured to route log messages to different log files/locations based on the content of the log message? If so, how and could I see a simple example?
- 143
0
votes
1
answer
145
views
Sending rsyslog messages to remote file system
I have an Ubuntu server that will be running rsyslog and many "client" devices and applications sending logs to it (via various syslog clients).
I know that rsyslog logs everything to /var/...
- 143
2
votes
1
answer
3k
views
Different postfix logfile format when logging to separate file (maillog_file)
In order to separate the mail logs from the general system logs, I added this line to /etc/postfix/main.cf
maillog_file = /var/log/postfix.log
As expected, a file /var/log/postfix.log is created, and ...
- 900
1
vote
1
answer
951
views
Why some companies like cisco follow different syslog messaging format rather than rfc 3164 (BSD syslog) and rfc 5424 (IETF syslog)?
According to my understanding the popular syslog formats are:
RFC 3124 (BSD syslog):
Format: < priority >timestamp hostname application: message
Example: <133>Feb 25 14:09:07 webserver ...
- 15
1
vote
1
answer
3k
views
why is faillog, tallylog and lastlog so big?
I got a notice from a backup system (rsnapshot) today that it's storage volume was full. A closer look reveals some older snapshots where faillog, tallylog and lastlog are bigger than the actual ...
- 319
0
votes
1
answer
211
views
does remote logging stops local logging
I'm using a Graylog server to centralize logs from network equipment and servers and I'm wondering if the Syslog service on the switches, windows machines, and other equipment, that service still ...
- 5
1
vote
0
answers
83
views
Rsyslog not sending to server when filesystem fails
I have on my servers an rsyslog client, that supposed to send logs to rsyslog server.
Recently there was an issue on one of the servers where the filesystem went into read-only. This caused local logs ...
- 237
0
votes
0
answers
810
views
syslog-ng duplicate log message
Not duplicate of this question because that one uses rsyslog on client whereas I use syslog-ng on both sides.
I have a syslog-ng instance on both the client and the server and for whatever reason the ...
1
vote
0
answers
36
views
What does a series of ^@ in the syslog mean?
Our server did not react to pings anymore since around 23:49 yesterday until we restarted it at 7:09 am today. These are the last things we saw in the syslog:
The machine runs on Ubuntu 20.04 with ...
- 706
0
votes
1
answer
3k
views
syslog-ng: how to configure sending RFC5424 messages with octet-counting framing
Please don't bother reading this question. syslog-ng is already set up to send RFC5424 messages with octet-counting framing by default. I was confused by the behaviour of another component. This ...
- 383
0
votes
2
answers
422
views
systemd, journal receiving raw log
one common paradigm on all other syslog implementations (rsyslog, syslog-ng, readlog, etc) is to exchange log entries via UDP514 in plain text format.
How do I enable systemd-journal-remote to receive ...
- 280
2
votes
1
answer
487
views
Can i prevent a non-root user using logger to make fake entries (e.g. sshd) in the syslog?
i just played with logger an non-root user, but it looks like everyone is able to create fake entries in the syslog using the "-t" parameter.
Is this expected to work this way?
I could flood ...
- 41
1
vote
0
answers
49
views
Relate session and NAT logs in near real-time [closed]
I have a user activity logger and querying system for an ISP with very high log events rate (5k-10K /second). It needs to relate both Radius/Session and NAT Syslogs based on a common InternalIP field. ...
- 11
0
votes
1
answer
480
views
Graylog fails to parse nginx access_log: JsonParseException: Unexpected character ('<' (code 60))
I've followed https://github.com/ronlut/graylog-content-pack-nginx-docker and Send NGINX logs to Graylog to try to get nginx logs into a graylog 4.1.5 server. Graylog is not displaying messages ...
- 1
2
votes
0
answers
273
views
Huge CPU usage when enable rsyslog TLS
We currently using rsyslog for gathering logs from ~1M IoT devices, we used to use plain-text UDP syslog and our server handling those just fine with minimal system load, but now because we need to ...
- 503
2
votes
1
answer
1k
views
Getting Syslog to log to both syslog and custom log file
In syslog (Raspbian rsyslog swVersion="8.1901.0"),
I am trying to match / filter a system msg containing a specific string BOTH to /var/log/syslog (default) AND to a custom separate log file,...
- 23
0
votes
1
answer
782
views
Limit number of available archives in syslog rotation
I have the following configuration for my /etc/logrotate.d/rsyslog file. In it, i explicitly declared the number of days it will rotate to 4 and the size of the rotation archive file as 100k for /var/...
0
votes
0
answers
99
views
How to reduce repeat log in debian 10?
In similar quesiton,I know echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created ...
- 945
0
votes
0
answers
104
views
Rsyslog unable to receive syslogs from two or more switches , error in rsyslog configuration file
I am trying to send syslogs from routers/switches in a production environment to a linux server which has Rsyslog installed on it. Its working fine as long as rsyslog config file is set to receive ...
- 1
1
vote
0
answers
688
views
Syslog-ng service error on restart - syslog forward to Qradar
Hopefully my qeustion is in the right place.
I am currently trying to forward syslogs from an Ubuntu machine to a Qradar machine.
They're on the same network and i already managed to get Rsyslog to ...
0
votes
1
answer
1k
views
Why are cron jobs not being logged by rsyslog on Debian 10 buster?
(I figured this out, it was multiple problems...I'm leaving this as is and explain the process I took to resolve in my answer to this question)
I'm working on a simple Ruby script that runs as a cron ...
- 697