Questions tagged [syslog]

syslog is a standard for logging messages about the operation of a system.

Filter by
Sorted by
Tagged with
0 votes
1 answer
45 views

Why some companies like cisco follow different syslog messaging format rather than rfc 3164 (BSD syslog) and rfc 5424 (IETF syslog)?

According to my understanding the popular syslog formats are: RFC 3124 (BSD syslog): Format: < priority >timestamp hostname application: message Example: <133>Feb 25 14:09:07 webserver ...
user avatar
  • 5
0 votes
1 answer
128 views

why is faillog, tallylog and lastlog so big?

I got a notice from a backup system (rsnapshot) today that it's storage volume was full. A closer look reveals some older snapshots where faillog, tallylog and lastlog are bigger than the actual ...
user avatar
  • 171
0 votes
0 answers
21 views

Kiwi syslog server not displaying logs

I'm using kiwi syslog server, by checking the syslog.txt file I've seen an error saying (10061) the requested connection has been refused by the remote host. I have validated all the configurations ...
user avatar
0 votes
1 answer
25 views

does remote logging stops local logging

I'm using a Graylog server to centralize logs from network equipment and servers and I'm wondering if the Syslog service on the switches, windows machines, and other equipment, that service still ...
user avatar
1 vote
0 answers
19 views

Rsyslog not sending to server when filesystem fails

I have on my servers an rsyslog client, that supposed to send logs to rsyslog server. Recently there was an issue on one of the servers where the filesystem went into read-only. This caused local logs ...
user avatar
0 votes
0 answers
17 views

How to get mimedefang's md_syslog to log?

I'm trying to debug a mimedefang filter I've written, and I can't seem to get md_syslog to actually log anything. This is with mimedefang 2.85 on Amazon Linux 2. Somehow logging seems to be working ...
user avatar
0 votes
0 answers
138 views

syslog-ng duplicate log message

Not duplicate of this question because that one uses rsyslog on client whereas I use syslog-ng on both sides. I have a syslog-ng instance on both the client and the server and for whatever reason the ...
user avatar
1 vote
0 answers
28 views

What does a series of ^@ in the syslog mean?

Our server did not react to pings anymore since around 23:49 yesterday until we restarted it at 7:09 am today. These are the last things we saw in the syslog: The machine runs on Ubuntu 20.04 with ...
user avatar
  • 456
0 votes
0 answers
67 views

How writing a syslog in file without writing them in /var/log/messages

I would like to write logs from network switches in a special file. Here is my code: cat /etc/rsyslog.d/test.conf $template syslog,"/var/log/clients/%fromhost%.log" *.* ?syslog It work ! ...
user avatar
0 votes
1 answer
538 views

syslog-ng: how to configure sending RFC5424 messages with octet-counting framing

Please don't bother reading this question. syslog-ng is already set up to send RFC5424 messages with octet-counting framing by default. I was confused by the behaviour of another component. This ...
user avatar
  • 353
0 votes
1 answer
163 views

systemd, journal receiving raw log

one common paradigm on all other syslog implementations (rsyslog, syslog-ng, readlog, etc) is to exchange log entries via UDP514 in plain text format. How do I enable systemd-journal-remote to receive ...
user avatar
  • 203
0 votes
0 answers
81 views

rsyslog is not logging any messages

I am currently trying to test out a syslog server running on an RHEL AWS instance. The only edits I have made to the config file are uncommenting these sections for TCP/UDP port 514 as well as ...
user avatar
2 votes
1 answer
84 views

Can i prevent a non-root user using logger to make fake entries (e.g. sshd) in the syslog?

i just played with logger an non-root user, but it looks like everyone is able to create fake entries in the syslog using the "-t" parameter. Is this expected to work this way? I could flood ...
user avatar
1 vote
0 answers
40 views

Relate session and NAT logs in near real-time [closed]

I have a user activity logger and querying system for an ISP with very high log events rate (5k-10K /second). It needs to relate both Radius/Session and NAT Syslogs based on a common InternalIP field. ...
user avatar
0 votes
1 answer
105 views

Graylog fails to parse nginx access_log: JsonParseException: Unexpected character ('<' (code 60))

I've followed https://github.com/ronlut/graylog-content-pack-nginx-docker and Send NGINX logs to Graylog to try to get nginx logs into a graylog 4.1.5 server. Graylog is not displaying messages ...
user avatar
  • 1
0 votes
0 answers
22 views

In log rotation configuration file. I have to append the boot count

I have to append the boot count in log rotation file in this format: boot-0000001-syslog_1.log boot-0000001-syslog_2.log This is ...
user avatar
2 votes
0 answers
124 views

Huge CPU usage when enable rsyslog TLS

We currently using rsyslog for gathering logs from ~1M IoT devices, we used to use plain-text UDP syslog and our server handling those just fine with minimal system load, but now because we need to ...
user avatar
  • 493
2 votes
1 answer
285 views

Getting Syslog to log to both syslog and custom log file

In syslog (Raspbian rsyslog swVersion="8.1901.0"), I am trying to match / filter a system msg containing a specific string BOTH to /var/log/syslog (default) AND to a custom separate log file,...
user avatar
0 votes
1 answer
86 views

Limit number of available archives in syslog rotation

I have the following configuration for my /etc/logrotate.d/rsyslog file. In it, i explicitly declared the number of days it will rotate to 4 and the size of the rotation archive file as 100k for /var/...
user avatar
0 votes
0 answers
156 views

rsyslogd stores remote logs to duplicate location

i configured rsyslog to store remote logs coming in under a custom directory: /var/log/fleet. The Logs created in the hostname and programm derived directories are created where intended, but the ...
user avatar
0 votes
0 answers
37 views

How to reduce repeat log in debian 10?

In similar quesiton,I know echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created ...
user avatar
  • 825
0 votes
0 answers
27 views

Rsyslog unable to receive syslogs from two or more switches , error in rsyslog configuration file

I am trying to send syslogs from routers/switches in a production environment to a linux server which has Rsyslog installed on it. Its working fine as long as rsyslog config file is set to receive ...
user avatar
0 votes
0 answers
91 views

Please explain the ASA capture to identify re-transmissions

I have recently started troubleshooting an issue and client is suspecting re-transmissions based on the below capture, I am not sure why the data packets are repeating over and over for multiple times ...
user avatar
  • 1
0 votes
0 answers
62 views

How to clear last 5 ipmi sel logs when sel memory is full?

I'm running ipmievd to send sel logs to syslog. But ipmievd will not collect and send log to syslog when sel memory is full. Hence i would like to delete the last 5 sel logs instead of deleting ...
user avatar
1 vote
0 answers
222 views

Syslog-ng service error on restart - syslog forward to Qradar

Hopefully my qeustion is in the right place. I am currently trying to forward syslogs from an Ubuntu machine to a Qradar machine. They're on the same network and i already managed to get Rsyslog to ...
user avatar
0 votes
1 answer
598 views

Why are cron jobs not being logged by rsyslog on Debian 10 buster?

(I figured this out, it was multiple problems...I'm leaving this as is and explain the process I took to resolve in my answer to this question) I'm working on a simple Ruby script that runs as a cron ...
user avatar
1 vote
0 answers
43 views

Rsyslog Filter in Ruleset

I want to create a central rsyslog server, and I want to create a file per type of log received. I need a filter that will look for specific strings in the incoming messages and then place them in the ...
user avatar
0 votes
1 answer
644 views

Log systemd service stderr to different file using rsyslog

I have the following config in a systemd service: StandardOutput=syslog StandardError=syslog SyslogIdentifier=udocit And this rsyslog conf file: if $programname == 'udocit' and $syslogseverity > 5 ...
user avatar
0 votes
1 answer
465 views

VMWare ESXi remote syslog format

I've followed the documentation, host can connect to remote log port using nc, but no logs are received. As a remote syslog I'm using Loki and Promtail which only supports RFC 5424. Does ESXi ship ...
user avatar
0 votes
1 answer
125 views

rsyslog tag based forwarding

I'm looking to do a tag based forwarding instead of using local1. local1 is used for other things so I don't want it to get mixed up. How can I do this? Here's my config forwarding nginx logs under /...
user avatar
0 votes
1 answer
715 views

Exclude remote syslog client logs from /var/log/syslog on host machine

Background: I have a lil Raspberry Pi server running the latest Raspbian OS running a number of network appliances to help manage a complex IOT LAN for a client. I have been using rsyslog to write ...
user avatar
2 votes
1 answer
569 views

Syslog-NG Error processing log message using IETF format

we've just changed our logging application on our AS/400 partitions and are now using a product called PowerTech SIEM agent for IBM I The tool used to format messages using the old syslog convention ...
user avatar
  • 474
0 votes
1 answer
256 views

UFW Weird ICMP log record - Pinging is blocked

In the log records below I have replace my eth MAC address with ETH_MAC_ADDRESS the IP of my server with MY_SERVER_IP and other IPs with STRANGE_IP plus a number to distingue. Jan 29 15:11:48 cld ...
user avatar
  • 113
1 vote
0 answers
34 views

Cannot perform command as a different User - even from root user

I have pm2 node modules installed in a user called otheruser. I need to run the program from root user. If I normally logged to otheruser and perform any action its working fine. otheruser@bubble-...
user avatar
1 vote
1 answer
776 views

running syslog-ng in verbose mode

EDIT1: syslog-ng launch command : /usr/sbin/syslog-ng -u syslog -g syslog -R /tmp/syslog-ng.persist -F commands used: syslog-ng-ctl verbose --set=on and syslog-ng-ctl verbose I am trying to run syslog-...
user avatar
  • 13
2 votes
1 answer
170 views

rsyslog unexpected end of file on log files with OMFileZipLevel

OS: Centos7 rsyslog: 8.24.0 I have various hosts sending logs to my centralised rsyslog server. I use OMFileZipLevel option in my config file to compress my logs and then zcat anytime i wish to view ...
user avatar
  • 1,595
1 vote
0 answers
423 views

nginx logging to unix socket fails with protocol error

debian stable, nginx version: nginx/1.14.2 I get the following error message (error.log) : connect() failed (91: Protocol wrong type for socket) configuration file : access_log syslog:server=unix:/var/...
user avatar
  • 13
2 votes
0 answers
104 views

Recommendations for high-volume request logs from containers

We have a service that uses raw AWS EC2 instances to field requests. Response times are in the 2-3 ms range. That response time is important to the health and success of the service. Part of the ...
user avatar
1 vote
1 answer
247 views

Unable to get rsyslog to save only msg without timestamp

When I have the default settings, my logs are like this: 2020-12-01T18:34:06+02:00 10.132.90.194 {"wfd_successful_hits_sec": "0", "sql_hits_sec_max": "0", "...
user avatar
1 vote
1 answer
1k views

Rsyslog forward using original source IP over TLS

I'm trying to forward all syslog messages over TLS from our enviroment to an external syslog server (dest.syslog.example.com) using rsyslog. Unfortunately the source IP is changed to that of the relay ...
user avatar
1 vote
1 answer
795 views

"EOF occurred while idle" when using network directive in syslog-ng

I want to forward logs from a local machine to a distant server. Thanks to an SSH tunnel, the distant server is reachable through localhost:5514. I wrote the following conf: # Filters filter f_local0 {...
user avatar
  • 155
0 votes
1 answer
75 views

CentOS 8 syslog entrys for xrdp & mariadb

I recently took a look into my syslog /var/log/messages and noticed two repeating entries that I don't understand: The log is full (and I mean full) of: xrdp[959]: [INFO ] Socket 12: AF_INET ...
user avatar
0 votes
1 answer
1k views

rsyslog filter not working

I am on debian 10 and I'm trying to do a very simple thing with rsyslog : I would like to redirect all logs from a particuliar docker container into a log file. I set a tag to my docker container, and ...
user avatar
0 votes
1 answer
222 views

duplicate packet to another local host(SIEM)

We have a Central Syslog server that we use to collect all logs from our hosts and recently got a SIEM that we also want to collect the logs. We would like the Central Syslog server to duplicate the ...
user avatar
0 votes
1 answer
14 views

Save incoming log with suffix to its logfile-suffix.log using syslog-ng

I've been searching on the internet for answers relating to syslog-ng and how I can configure syslog-ng to save incoming log files with a specific suffix to a file and also carry over the suffix ...
user avatar
  • 156
0 votes
1 answer
126 views

Custom service filling up syslog

We have a custom service we start via systemd. File is stored at /etc/systemd/system/custom.service. That's all great but we just had a situation where the disk ran full. I guess systemd catches all ...
user avatar
2 votes
2 answers
5k views

Fail2ban won't ban postfix/smtps/smtpd

I've got an Ubuntu 20.04 server that's receiving hundreds of SMTP AUTH requests on my postfix server every day from the same IP. I have fail2ban installed, but ironically, it is failing to ban the IP. ...
user avatar
0 votes
1 answer
888 views

rsyslog, is there a way to see the facility codes of messages recieved?

I have a cisco ftd sending logs tagged with local3(19) however I am still seeing some messages ending up in my users.log instead of where i have them configured to be sent. Is that where they would ...
user avatar
0 votes
0 answers
120 views

Syslog servers - what is "normal" throughput? (Windows vs Linux)

Working in an almost Windows only company - and need to set up a syslog server recieving messages from our proxy, firewall and VPN-applicances. For now we have decided to use Kiwi Syslog server, but ...
user avatar
  • 213
0 votes
1 answer
386 views

Unable to log with HAProxy

I've been following the instructions found here, https://www.haproxy.com/blog/introduction-to-haproxy-logging/, to setup our logging. As documented, I made an rsyslog config file, haprorxy_log.conf, ...
user avatar
  • 77

1
2 3 4 5
13