Questions tagged [syslog]

syslog is a standard for logging messages about the operation of a system.

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

How to test filters in syslog-ng?

I would like to send to a telegram bot any successful ssh connections so I wrote this: filter f_ssh { facility(auth) and match("sshd" value("Accepted.+?ssh2")); }; And later: log { source(src); ...
0
votes
0answers
12 views

Pfsense forward logs to remote syslog server via tcp

Guys I have a client machine setup and I used kiwi syslog server to receive log from pfsense by default pfsense sends logs to udp port 514. How should I configure pfsense to send logs in TCP port(So ...
0
votes
1answer
18 views

docker logging container not reading docker logs

new to docker.... so got a few containers running and i want to run a logging container to collect all the logs up and send them to Rapid7. the rapid7 container is working as its sending stats to ...
-3
votes
1answer
41 views

How to hack proof my syslog-ng server

I recently built a Ubuntu syslog-ng server that is behind a firewall. I have opened TCP ports 514, 515, and 516. I have noticed that hackers are writing to my syslog-ng server, they are from China. ...
1
vote
1answer
25 views

remote logging using syslogd - Ubuntu 18.04.2 LTS - just will not send

so, playing with centralized logging and i just cannot get syslogd to send the messages to a remote syslog server. background: syslog server is setup and working, tested with other devices sending ...
0
votes
0answers
20 views

/var/log/messages not sending to the rsyslog central logging server

Everything else is being logged to the central rsyslog server but not the /var/log/messages of the rsyslog client. server: learn -> 192.168.1.100 client: server101 -> 192.168.1.200 From the rsyslog ...
0
votes
0answers
56 views

How to restart rsyslog on alpine?

In my alpine 3.1..5 linux docker container, I installed rsyslog as: # apk add --no-cache rsyslog I am running rsyslogd as: # rm -f /var/run/rsyslogd.pid # rsyslogd How do I restart rsyslogd ...
0
votes
1answer
35 views

how to send log from post-auth with Freeradius?

I want to send message to remote syslog in post-auth section. Simple string with "'%{User-Name}', '%{reply:Packet-Type}', '%{Calling-Station-Id}'" How do it with FreeRADIUS 3 ? Or.. How to split ...
0
votes
1answer
55 views

Azure : How to process Azure Log events from Event hub and filter based on criteria

How to process Azure Log events from Event hub and filter based on criteria. We are trying to filter specific critical or security related Diagnostic and Activity logs before feeding into our Onprem ...
0
votes
1answer
110 views

HAProxy logging TCP traffic in syslog

i'm trying to configure my HAProxy to log more information than just saying "proxy backend_xx started" and it looks like i am failing to understand how it works. my HAProxy is a pure TCP LB (just ...
0
votes
1answer
93 views

Seprate json part of incoming log with syslog-ng by config

I'm receiving my log without any parse: source s_network { network( transport(tcp) port(601) flags(no-parse)); }; My saved log have two part: reciver information json part of log ( like ...
2
votes
1answer
54 views

F5 Load Balancer and SIEM

I am looking for information on whether F5 can forward syslog info to a SIEM such as arclight or Qradar. I have heard that you can only send unencrypted traffic on port 80 but you cant forward ...
0
votes
0answers
16 views

Syslog debug help : 4G connection drop Airtel

My 4G device is on an automobile that travels around 500 kms in a night. The network disconnects sometimes. And this is the log I see in the Syslog. Can someone help me understand what is going on? ...
0
votes
1answer
43 views

Log a message from Windows to a Syslog server (Wireguard)

I would like to know when a Wireguard client set a tunnel up. So is it possible to do something like : PostUp=command_which_creates_a_syslog_event Because I don't see any other way to log when a ...
0
votes
0answers
38 views

OpenSSH Server: Directive 'SyslogFacility' is not allowed within a Match block

I want a specific matched User to have its 'ssh/scp' activities logged in an alternative facility. The current default is AUTH, but I'd like to log stuff for user 'dummy' to syslog Facility 'LOCAL2'. ...
0
votes
2answers
321 views

/var/log/messages Not Created Although restart rsyslog.service

I use centos7 and /var/log/messages has not worked for a while although I restarted rsyslog.service. Its size was always 0. I then deleted the messages file, and restarted rsyslog again but it was ...
0
votes
0answers
54 views

Logrotate configuration for Syslog-ng failing to remove files

I have a requirement to purge syslog-ng files for our firewalls every 2 days. Logrotate is running using the following config: /var/log/syslog-ng/<firewallType>/<firewallName>/*.log { ...
0
votes
1answer
108 views

Linux RHEL cluster

I'm trying to setup a PCS cluster on two nodes running Red-hat, and did successfully, I want to setup syslog server (rsyslog) in Active/Passive mode. I created the cluster and added the resources, I ...
0
votes
0answers
107 views

How to troubleshoot a log flooding issue with a monitoring agent?

I have email flooding issue with OMS agent installation a monitoring agent in Azure Log Analytics. Once the agent is installed on servers, there's huge amount of emails being sent regarding agent ...
0
votes
0answers
45 views

HP5900 switch (comware) and logging heartbeats to syslog

i've configured syslog logging on all our HP5900 switches. logs are sent to a remote logger (syslog-NG) however, even if i configured the log level to debugging, it looks like we only receive logs ...
0
votes
0answers
53 views

Ubuntu 18.04 reboots every 4 weeks

Can anyone explain why my Ubuntu 18.04 server has rebooted every 28 days for last few months? I do not have unattended-upgrades configured to do so. I do have Canonical LivePatch, but this seems like ...
0
votes
1answer
117 views

remove 3/min-limit of UFW logging (the clean way)?

since I'm not satisfied with th iptables ansible module (not stateful) I'm trying my way with UFW. Problem is, that UFW limits logging to 3/min which might be enough for nonentusiasts. so my ...
0
votes
0answers
14 views

How to configure OpenLDAP to log password expiration

ALL, Is there a way to configure OpenLDAP so that when someone logs in with the password that expired the line will be written to the syslog indicating such an event? TIA!!
0
votes
1answer
166 views

Rsyslog not logging Windows Events

I am trying to configure sending Windows Events to rsyslog server, but rsyslog ignores them. $EscapeControlCharactersOnReceive off template(name="OnlyMsg" type="string" string="%msg:::drop-last-lf%\...
1
vote
0answers
27 views

Redirect Console Output ,Terminal (macOS, CentOS) / Cmd (Windows) to Remote Syslog or Server Logs

I have One workstation running multiple instances of Java applications by Console/Terminal for Testing, and I develop an application for Listening Logs, TCP like (http://esus.com/using-java-util-...
1
vote
0answers
20 views

How to split logs into monthly, daily and hourly folders when bringing in syslog events?

I am bringing in log files via rsyslog and my config looks like the following: root@rhel:/etc/rsyslog.d# head mail_prod_logs.conf if $fromhost-ip=="10.10.10.10" and $programname=="AMP_Logs" then -/...
1
vote
2answers
55 views

Supress 3Ware warnings in syslog

I'm trying to suppress the following warnings in my syslog: Oct 13 04:43:33 Winston kernel: 3w-sas: scsi1: ERROR: (0x03:0x0101): Invalid command opcode:opcode=0x85. Oct 13 04:43:33 Winston kernel: md:...
3
votes
2answers
3k views

Journalctl and syslog: How does it actually work? [closed]

I'm having a hard time understanding how logging works on linux. Since the inclusion of systemd, it seems a bit easier, but I still have a couple of concepts that still can't fully understand. Given ...
0
votes
0answers
499 views

Rsyslog does not set read and write permission for group and everyone

Rsyslog ignores read and write permission set with fileCreateMode for group and everyone. I have set up a service to run my node application as such: ... [Service] WorkingDirectory=/opt/demo/app ...
0
votes
0answers
138 views

Syslog and modsecurity logging

I need to send syslog from e.g. /var/log/modsecurity.log. The main question is how to send logs from modsecurity as one item/event, e.g.: --id(2646as12)--A data --id(2646as12)--B data --id(2646as12)...
1
vote
1answer
114 views

syslog-ng configuration works in debug mode, but not without

I am trying to run syslog-ng as an OCF resource in an HA cluster. I am encountering some terribly strange behavior - when I start a single instance in debug mode, the filters match and it forwards ...
0
votes
0answers
91 views

Using a Mac as an unbound server. Syslog trouble

I am rebuilding a new macOS Server based on what is left of it in macOS Mojave and macports. I am attempting to run unbound DNS caching resolver on my macOS Mojave. This works. I can also log from ...
0
votes
1answer
304 views

Log category RPZ to syslog in BIND 9

I am running a chrooted BIND 9.11 server on FreeBSD 11.2 that has a RPZ configured. It is currently logging RPZ hits in a file, but I would like to (also) send them to syslog. I can see other log ...
1
vote
0answers
46 views

Change logging priority of UFW

As far as I can tell (through journalctl -p 4) UFW logs all blocked connections as warnings. I'd really like to be able to use that log level for things I actually might want to respond to. Is there ...
0
votes
0answers
68 views

How can one install both syslog-ng and rsyslog on ubuntu 16.04

I need to run both rsyslog (the corporate standard) and syslog-ng on another port because some application rely on its pattern matching. The standard packages seem to be set up so that you can ...
0
votes
1answer
33 views

Redhat 8 rsyslog TLS collector taking over old log collector. Can I reuse certificate?

I am building a redhat 8 rsyslog log collector to replace an old log collector and am required to set it up with TLS. I am using the same public IP address and was hoping to reuse the same purchased ...
1
vote
0answers
323 views

How to apply grok to logs from syslog in telegraf?

In my current setup I am using Telegraf to ingest nginx logs from syslog and spit them out into influxdb. This works great. Telegraf has support for grok log parsing. As far as I can tell it can be ...
1
vote
1answer
280 views

Rsyslog not able to read imfile from perforce directory

I am facing an issue in an Ubuntu server where Rsyslog is not able to read any file from the Perforce logs directory. I tested that Rsyslog configuration for the imfile module is working properly ...
0
votes
1answer
105 views

Parsing or Reformatting Logs before feeding them to Splunk or Elastic Search

I have very complex log messages, that I want to reduce to the most important fields in order to save quota. The log messages are multiline and there is a lot of redundant information in them. A ...
1
vote
1answer
454 views

Writing MongoDB logs to a remote logging server

I am trying to forward MongoDB logs from several remote servers to a central logging server. To do this, I changed my mongod.conf files to use syslog like so: systemLog: destination: syslog ...
1
vote
2answers
504 views

syslog-ng execute script on syslog pattern

I have a simple requirement. I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script. ...
0
votes
0answers
781 views

peer didn't accept DH group MODP_2048, it requested MODP_1024

hope somebody can help me, I am trying to set up a VPN between Google CLoud VPN and Palo Alto. Any help will be appreciated. Here is my log: D remote host is behind NAT D authentication of '35.xxx....
-1
votes
1answer
274 views

After installing sysstat on an AWS EC2 instance: kernel: ena: Feature 27 isn't supported

After installing and enabling sysstat on an AWS EC2 instance I get the following log entries everytime sysstat is run (from the cronjob in /etc/cron.d/sysstat) in my /var/log/syslog file on Debian: ...
2
votes
0answers
786 views

Using linux environment variable in rsyslog template

I'm trying to add an environment variable to my rsyslog template. I tried using 'getenv()' function without any luck, I always get an empty string in return. I'm attaching an example of my rsyslog ...
0
votes
1answer
306 views

Grok filter for Cisco ASA

How can i get port from cisco ASA syslog using grok pattern. I have tried some methods and its not working . We are using graylog for collecting log data. Eg Log : %ASA-6-301014: Teardown TCP ...
1
vote
1answer
38 views

logrotate doesn't seems to work as expected

Below is my log rotation configuration for /var/log/messages. /var/log/messages { rotate 4 size 100M missingok notifempty compress delaycompress sharedscripts ...
0
votes
0answers
1k views

Syslog not logging

My syslog setup has been happily running for years, and suddenly I cannot log anything at all. With the default configuration I test logging by running a PHP script: php -r "syslog(LOG_NOTICE,'Test ...
1
vote
1answer
122 views

IPMI device flooding /var/log/messages

I've a CentOS 7.6 server being flooded by the IPMI device with a lot of errors on a specific sensor: ipmievd: Unknown sensor ff ipmievd: Get SEL Entry 1fe command failed: Requested sensor, data, or ...
1
vote
0answers
736 views

docker Unix syslog delivery error

I faced at syslog related error when executing the program with the docker. docker run -d -e SERVER_ADDR=127.0.0.1 --name go-agent1 go-agent:1.0 Docker logs: 2019/03/15 01:59:08 Unix syslog ...
1
vote
1answer
298 views

Filter docker messages from syslog

Looks like docker is writing duplicate messages to syslog. For instance Mar 6 23:53:45 ip-xx-xxx-xxx-xx docker[45287]: 2019/03/06 23:53:45 GET 200 xx.xxx.xxx.xxx /cas/...

1
2 3 4 5
12