Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [syslog]

syslog is a standard for logging messages about the operation of a system.

0
votes
0answers
36 views

How to log all Bash (busybox/ash) commands by all users on a server?

How can we locally log all Bash commands run, along with user and time stamp? I am looking for a way to customize Ash sessions with my own sets of aliases and whatnots. What is the Ash equivalent of ...
0
votes
0answers
11 views

syslog-ng: automatically generate a string to the destination log file

There is a way to automatically generate a fixed/dynamic string to the destination log file on syslog-ng startup? My syslog-ng runs inside a docker and writes to the same file always (using docker ...
0
votes
0answers
10 views

Sending User Login Events to a Syslog Server - eDirectory\iManager

I'm working with an eDirectory implementation and I'm trying to send login events to a syslog server. This is pretty trivial to do with Windows security event auditing. I've found some documentation ...
1
vote
0answers
28 views

Logging of MySQL Queries and Forwarding to Syslog/Event log

I was to able to enable Error log, General Query log, Slow Query Log and Binary Log and was able to forward the logs to Syslog. I have few questions about logging. 1) The error log is automatically ...
0
votes
0answers
12 views

FreeBSD printing logmsg in cycle

my mistake probably overload system. I configured syslog client (maybe server too). After boot on console in cycle printing "logmsg: pri 2, flags 17, from Device". How I must solve this problem? ...
0
votes
1answer
36 views

postgres log workflow : filter the log events with specific working hours

To analyze postgres logs, our workflow is: postgres logs via syslog rsyslog writes to one text file at midnight we stop postgres pgbadger reads and parses the daily logfile (about 2 Gbyte) We want ...
0
votes
0answers
34 views

log cloud foundry syslog to s3 using the syslog protocol

I want to send my syslog entries to an S3 bucket. Security restrictions have meant that this is the only ways that I can do this. With cloud foundry, you can create a user provided server where I ...
0
votes
0answers
16 views

Syslog log aggregations

I have the following architecture: n Firewall servers sending syslog events to a syslog server I ship the logs from the syslog server (currently via Logstash) to a central logging location Since ...
0
votes
1answer
27 views

Rsyslog eats up storage

I have set up rsyslog to grab various logs on my ubuntu 16.4 instance, but for some reason it eats up my storage until I have no free storage left. So far I couldnt find out what the issue is, also ...
0
votes
0answers
39 views

rsyslog - queues with expiration time

I've configured rsyslog with Disk Assisted options to forward logs to Logstash server. Last night, the status of network of Logstash became unstable. Consequently, bunch of backlog files that contain ...
0
votes
0answers
28 views

Wifi appliance not sending syslog

I am struggling a bit with my new syslog server which is not receiving log from my wifi appliance. My wifi appliance is an aerohive, there is almost nothing about configuring syslog on it on internet, ...
0
votes
1answer
41 views

Centos7 Stop bloated logging

I have a server with the OS Centos 7 and looking at log file(s) such as the messages log file ("/var/log/messages") I can see it is primarily filled with entries like the following: Aug 29 12:46:01 ...
0
votes
1answer
16 views

Daily Log Rotation - retaining original

I'm working on Ubuntu 14.04 hosting a graylog server. In the /var/log/upstart/ directory, I have a plaintext log of all the messages that come in - it's set to rotate every 3GB. However, the problem I ...
0
votes
0answers
71 views

CRON messages being delayed for arbitrary long time in syslog

I found in a few servers's syslog that some of the CRON related messages are written in a wrong time, like the following: Aug 21 06:26:01 hty-controller CRON[30159]: (root) CMD ( python /.../...
1
vote
1answer
74 views

Identifying who is logging to my device

I have a machine that aggregates syslog data from many devices, I keep all the devices that I want to have logging to my device in /etc/hosts so that they all have names that I understand. If a ...
0
votes
1answer
70 views

MySQL 8 - Error log into Syslog

i'am trying to switch /var/log/mysql/error.log into syslog in MySQL 8. Reason is compatibility with our monitoring for parse, maybe not that clean, but it does the job. I had no problem with this on ...
0
votes
0answers
41 views

forward original syslog message

I would like to forward from a log collector many syslog message to another log collector and maintain the original syslog message. When I forward maybe the first log collector add a data and source ...
0
votes
0answers
46 views

How to forward syslog from Palo Alto VM-series firewall in AWS

I'm attempting to get syslog events from a Palo Alto VM-series firewall in AWS, to a SIEM syslog server that also resides in AWS. It seems that Palo Alto has a partnership with splunk so they are ...
0
votes
0answers
11 views

Forward TerminalServices-LocalSessionManager log with op5 syslog forwarder

Using the op5 syslog forwarder, how can one forward the following log: Applications and Services Logs -> Microsoft -> Windows -> TerminalServices-LocalSessionManager One cannot select it in ...
0
votes
3answers
635 views

rotate logs with logrotate and move old files

Logrotate don't move file to oldlogs folder and exit abnormally with code 1. I tried to launch manually it with -d option but no errors are showed. This is my configuration: /var/log/myfolder/*.log { ...
0
votes
1answer
81 views

systemd unit alias (symlink) missing for syslog-ng / syslog

I am having issues with an Ubuntu 16.04.4 machine running systemd and syslog-ng (3.5.6-2.1), where messages logged to syslog by a process (let's call it X) were not received by syslog-ng. Digging into ...
0
votes
0answers
87 views

rsyslogd action suspended using omfwd

We're trying to upload an Apache log to a syslog server, however the upload doesn't happen and in /var/log/syslog we see: Jun 20 02:16:21 caes8 rsyslogd-2007: action 'action 10' suspended, next ...
1
vote
1answer
381 views

Redirect Auditd.log data to rsyslog in RHEL-7

I would like to redirect the auditd log data into rsyslog instead of audit.log file. I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to ...
1
vote
1answer
95 views

Rsyslog pass log to script?

I have been trying to pass captured log to a perl script, however I can not seem to find the right way. Do you have any suggestions for correct way of sending captured log to a script for further ...
1
vote
0answers
208 views

How to get logging to work in PureFTPd in an Alpine Docker container?

I am building upon gists/pure-ftpd to create FTP server instances in a Docker container. Here is my server start command, which I am hacking on: # Args explained at http://debianhelp.co.uk/pureftp....
0
votes
0answers
152 views

How to get the Compute Engine logs to end up in the structured jsonPayload instead of the textPayload?

I'm running an API on a Linux VM as a Compute Instance in the Google Cloud. The API is being run with systemd, and it's logging to syslog. I run the StackDriver logging agent to transfer the logs to ...
0
votes
2answers
139 views

linux redhat + how to resolve the issue about Invalid response packet from host

we have thousand of the following message in /var/log/messages we also have strange issue that machine restart each of couple dayes what need to do in order to avoid these messages? Apr 25 00:08:31 ...
0
votes
1answer
282 views

Retrieve pfSense/freeBSD logs with elk

I am attempting to centralize logs from different systems. I installed the Elastick Stack (Elasticsearch, Logstash, Kibana) and WAZUH OSSEC on one server (named elk). I have installed the OSSEC ...
5
votes
2answers
3k views

Is it still allowed to have log files under the new GDPR? [closed]

Is it still allowed to have server access log files under the new GDPR? Because of the gathering of IP addresses is not allowed, I can imagine that system operators are in violation of the law in ...
3
votes
1answer
2k views

Send NGINX logs to Graylog

I'm trying to collect nginx error and access logs with graylog, I think everything is correctly configured, but Graylog receive nothing from NGINX (Graylog & NGINX are in docker containers and ...
0
votes
1answer
287 views

Rsyslog creating duplicate entries when forwarding application logs

I'm trying to add a new application log forward to a host which is already setup to send it's logs to a remote syslog server. I'm following the directions here: http://www.rsyslog.com/doc/v7-stable/...
0
votes
0answers
160 views

What should be done after updating rsyslog configuration on Centos 7?

I mostly have the default /etc/rsyslog.conf except I have an include to this file: $EscapeControlCharactersOnReceive off *.info;auth,authpriv.none /var/log/some_other_log_file I ...
0
votes
1answer
71 views

Advice on deploying services like NTP, DNS, Radius etc for a small NOC

network engineer here. I recently deployed a small office network and was asked to help out with deployment of some of the services. I have two ESXi servers on my hands and I need to deploy NTP, ...
0
votes
0answers
18 views

Prevent unauthorized rsyslog connections when doing log aggregation

I'm using syslog to collect logs from several machines and feed them to a machine learning tool. I have set up TLS encryption following the advice, but I've noticed that other hosts are connecting ...
1
vote
1answer
4k views

Create separated syslog file for each host with rsyslog

I have a syslog server (running rsyslog on RHEL 7.4) that consolidates all the syslogs from my network devices. It's listening on port TCP/514. I want to redirect the logs of each device to a ...
0
votes
0answers
98 views

SYSLOG traffic is not visible on wireshark

At my workplace I am facing this issue. we have dual homed network. taken MPLS links from two providers. We are trying to send syslogs to the syslog server which is in US. I am trying to send these ...
1
vote
1answer
43 views

Can a Syslog server recognize a client OS?

I recently set up a central syslog server. Logs are organized in files, in folder named after the client machines (using DNS), and scanned with logcheck. Some of the client machines have more than ...
-1
votes
2answers
423 views

Don't see syslog get logged anywhere on server

I want to export syslog from an IP phone to a remote syslog server. I have set everything up, I can see the syslog packets getting to the server when doing a tcpdump, but I don't see the syslog in a ...
1
vote
2answers
1k views

How to test network connectivity on specific UDP port between 2 linux hosts

I am looking for a method to test network connectivity on specific port between 2 linux hosts. Let's say for an example: I am sending syslog events from server A to server B on port 514. however, ...
0
votes
1answer
399 views

Using HAProxy for syslog traffic at scale

I have an environment that generates a frankly ludicrous amount of Syslog traffic - this is mostly due to a culture of leaving debug-level logging on in production applications (and changing this ...
0
votes
1answer
1k views

syslog-ng logs sent to multiple destination

I'm getting remote nginx syslogs going to both /var/log/nginx and /var/log/splunk on my syslog-ng server. How do I only get it to go to /var/log/nginx? #/etc/syslog-ng/syslog-ng.conf source s_sys { ...
0
votes
1answer
157 views

Piping to systemd-cat or logger doesn't work in a cron job

I'm running a database backup script via cron, and would like to send the program's output to the system log (so it gets sent to Stackdriver Logging). I've been trying to run the following: /opt/...
0
votes
1answer
63 views

What is status=24/XPU in syslog?

A service failed on my server with this message: systemd[1]: my.service: Main process exited, code=killed, status=24/XCPU What does it mean? I couldn't find anything related to this status. Ubuntu ...
1
vote
5answers
2k views

reliable export of journalctl logs

I search a way for a reliable export of journalctl logs. I could use the --since=... option, but this is a bit fuzzy. In my case a script would call journalctl --output=json every ten minutes. I ...
0
votes
1answer
304 views

How to stop syslog or auditd/ audisp from adding host information to forwarded log files? [duplicate]

I have forwarded the auditd log files to central log server but the log received at the central log server have extra information added to it which I dont want. Note (auditd and syslog are on same ...
2
votes
2answers
3k views

How to forward windows log using Nxlog to rsyslog server(linux)?

Im using nxlog version 3.0 on WinServ2012 R2 Standard, i can forward the event logs under Eventviewer --> windows logs --> application, system, security. But Im not able to forward other log that is ...
1
vote
1answer
50 views

Strange error message in syslog

My server was blocked during the weekend, from exactly this Saturday at 00:00 CET, for unknown reasons, and the last syslog message is a bit weird: Nov 18 23:58:58 ns kernel: [16705160.366491] [UFW ...
0
votes
0answers
100 views

How to use capture group in rsyslog?

For now, I want to analyze logs from python's lib logging, and I want to filter logs by logger's name which is an attribute of logger. I think I can use regex to extract logger's name from msg or ...
0
votes
1answer
836 views

How can I have fail2ban log to an external syslog server?

I'm running an Ubuntu 16.04 web server (running Webmin). I also have Graylog running on a separate server on my LAN. I'd like to have fail2ban log itself to /var/log/fail2ban.log as well as my ...
-1
votes
1answer
35 views

syslog for netstat to get no. of connection from each IP range

I have a server which keeps on receiving request from two other servers from different IP ranges. I need to know how can I setup a cronjob which keeps on checking number of connection made by each ...