Questions tagged [syslog-ng]
The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.
195
questions
-1
votes
1
answer
118
views
Sending rotated files with syslog-ng
Hello I am currently sending the suricata logs from a probe to a Syslog-ng server(172.16.238.15):
@version: 3.25
options {
keep-timestamp (no);
chain_hostnames (off);
keep_hostname (no);
};...
- 49
1
vote
1
answer
114
views
syslog-ng: Timezone change and $HOUR macro
Here's a log line from an appliance coming in as UTC:
<166>2023-06-13T16:03:44Z ..................
We store this as in files, in Europe/London timezone:
destination d_all {
file("/srv/...
1
vote
2
answers
181
views
syslog-ng filter log by frequency to destination file
I have a syslog-ng that receives too many logs and I am trying a way to 'sample' them using some filter.
I assume editing the /etc/syslog-ng/syslog-ng.conf with something like
log { source(s_udp514); ...
- 109
0
votes
1
answer
126
views
Syslog-ng enable TCP framing
I'm trying to send file entries as messages via TCP, where syslog-ng is in a container and it is sending to another container. I've had two different attempts both with problematic behavior. The first ...
- 109
1
vote
1
answer
308
views
Find process that makes outbound HTTP calls, trying auditd with syslog-ng
Some of application (it's unknown) makes sporadic nonregular rare short outbound HTTP(S) requests to a known host/port/url (this is a WAF honeypot, host/url/port is known) using HTTPS protocol.
...
- 846
0
votes
0
answers
157
views
How can i send the logs with syslog-ng from my pfSense to a Ubuntu Server?
I wanted to send the logs from my pfSense to a Ubuntu Server with syslog-ng. I have searched how to do this but have not found a good solution. I have tried it several times, but so far it has not ...
- 1
0
votes
0
answers
754
views
Promtail - syslog configuration only logs localhost for hostname and IP
I have a number of boxes that run docker containers. To keep a record of all the logs, we have 1 instance of logspout on every box that grabs all container logs on that box, and routes it to a syslog-...
1
vote
1
answer
451
views
Why would you want to change the log_msg_size from syslog-ng's default of 64k?
Per the syslog-ng admin guide, the log_msg_size defaults to 64k (65536 bytes)
However, I have seen some sample syslog-ng config files (like this one) that drop this to <18k (18192 bytes)
Why would ...
- 18.4k
0
votes
1
answer
863
views
Traefik don't keep real ip
I have a problem with Traefik, I want to log from a server with syslog-ng (docker). I have logs but I have reverse_proxy name and I want source IP not the name of traefik. I wish to keep source IP ...
- 1
1
vote
1
answer
116
views
syslog-ng freezes when reloading config changes in log msg size
I'm having a weird case of syslog-ng freezing on some reloads and under some conditions.
syslog-ng version is ubuntu 20.04's default 3.25.1. It has to be something related to log_msg_size as this ...
- 1,229
0
votes
0
answers
810
views
syslog-ng duplicate log message
Not duplicate of this question because that one uses rsyslog on client whereas I use syslog-ng on both sides.
I have a syslog-ng instance on both the client and the server and for whatever reason the ...
0
votes
1
answer
3k
views
syslog-ng: how to configure sending RFC5424 messages with octet-counting framing
Please don't bother reading this question. syslog-ng is already set up to send RFC5424 messages with octet-counting framing by default. I was confused by the behaviour of another component. This ...
- 383
0
votes
1
answer
640
views
syslog-ng / telegraf : EOF occurred when idle - incompatible?
This is a follow-on question from this previous question, created because I found out more information and it's cleaner to pose this as a new question.
I'm using syslog-ng OSE v3.31.2 to receive ...
- 383
0
votes
2
answers
868
views
syslog-ng: How to reduce high latency when forwarding logs to a syslog tcp consumer?
UPDATE 2: I've answered this via my new question at the link below. The root cause is behaviour by telegraf where by default it disconnects the TCP connection 5 seconds after the last received message....
- 383
0
votes
0
answers
337
views
RSyslogd is sending multiples CEF messages in the same Syslog message
There is a Python script sending multiple events to a remote host with Rsyslogd:
CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=767000670128771115
CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=...
- 174
2
votes
1
answer
1k
views
Syslog-NG Error processing log message using IETF format
we've just changed our logging application on our AS/400 partitions and are now using a product called PowerTech SIEM agent for IBM I
The tool used to format messages using the old syslog convention ...
- 524
1
vote
1
answer
3k
views
running syslog-ng in verbose mode
EDIT1: syslog-ng launch command :
/usr/sbin/syslog-ng -u syslog -g syslog -R /tmp/syslog-ng.persist -F
commands used:
syslog-ng-ctl verbose --set=on and syslog-ng-ctl verbose
I am trying to run syslog-...
- 23
1
vote
1
answer
2k
views
"EOF occurred while idle" when using network directive in syslog-ng
I want to forward logs from a local machine to a distant server. Thanks to an SSH tunnel, the distant server is reachable through localhost:5514. I wrote the following conf:
# Filters
filter f_local0 {...
- 174
0
votes
1
answer
33
views
Save incoming log with suffix to its logfile-suffix.log using syslog-ng
I've been searching on the internet for answers relating to syslog-ng and how I can configure syslog-ng to save incoming log files with a specific suffix to a file and also carry over the suffix ...
- 156
0
votes
1
answer
374
views
using syslog-ng to parse snmptrapd - not keeping up
(centos 7.x)
I have syslog-ng setup to parse snmptrapd messages so I can format them for later digestion. The issue is that syslog-ng only outputs the n-1 message. IE if there are 10 lines in ...
- 2,369
0
votes
1
answer
324
views
How can I set up syslog-ng to send only invalid JSON logs to a destination
I've set up syslog-ng 3.25.1 to read log messages from a file, parse them as JSON, and forward them to an ElasticSearch cluster.
This works well when the messages are formatted correctly as JSON, ...
- 111
0
votes
1
answer
988
views
syslog-ng set loglevel/priority to warning or more to be less verbose
How to run/configure syslog-ng to log only above the security loglevel/priority WARNING?
I would like to discard NOTICES like:
Destination timeout has elapsed, closing connection; fd='36'
From the ...
- 568
-3
votes
1
answer
208
views
How to hack proof my syslog-ng server
I recently built a Ubuntu syslog-ng server that is behind a firewall. I have opened TCP ports 514, 515, and 516. I have noticed that hackers are writing to my syslog-ng server, they are from China. ...
- 303
0
votes
1
answer
473
views
Seprate json part of incoming log with syslog-ng by config
I'm receiving my log without any parse:
source s_network {
network( transport(tcp) port(601) flags(no-parse));
};
My saved log have two part:
reciver information
json part of log ( like ...
- 3
0
votes
1
answer
1k
views
Set a Macro before sending log over network with syslog-ng
I have created a syslog server and client. I want to set client serial number in SOURCE macro in all logs being sent to server so that on server side I can retrieve the macro and can create the log ...
0
votes
1
answer
217
views
How to set-up Syslog-NG with MonitorWare schema?
we are setting up a centralized logging server which receives logs from many devices and servers and stored them into a database.
The syslog on the central server is syslog-ng. It is chosen because ...
- 11.3k
1
vote
1
answer
783
views
syslog-ng configuration works in debug mode, but not without
I am trying to run syslog-ng as an OCF resource in an HA cluster. I am encountering some terribly strange behavior - when I start a single instance in debug mode, the filters match and it forwards ...
- 31
0
votes
1
answer
884
views
Disable process id showing in Syslog-ng logs
I configured syslog-ng (version 3.21.1) on a CentOS7 server and found that logs are in following format.
Aug 26 12:59:28 xyz74hd.com radiusd[20142]: 92djvd4654654164nadskj795234dc Reason: pldap: ...
- 5
1
vote
1
answer
476
views
syslog-ng freezes/doesnt log when it encounters log messages with older time stamp
we are seeing issue with syslog-ng 3.8.1 dropping logs with older timestamp. Our system has an issue in persisting hardware clock after a reboot however, it might be an issue even with ntp jitter as ...
1
vote
2
answers
2k
views
syslog-ng execute script on syslog pattern
I have a simple requirement.
I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script.
...
1
vote
1
answer
543
views
Syslog-ng: Hostnames with slashes
We have a problem where we have a device type logging with hostnames like slot1/devicename. Unfortunately, when the logs are written to disk, only the slot1 is written; since we have a number of ...
- 141
0
votes
2
answers
13k
views
syslog-ng.conf listen for remote servers
I'm configuring /etc/syslog-ng/syslog-ng.conf on version 3.5.6-2 to listen to remote hosts on port 514 by changing the configuration like
#source s_src {
# system();
# internal();
#};
# If you ...
- 179
-1
votes
2
answers
1k
views
Extract values from MESSAGE in Syslog-NG
I receive syslog messages as follows:
[[email protected] net_id="325" station="431"
fault="16384"] [NotificationHandler] NMS error: STCRC/NOTTS Net: Enas
Station: CED Elmas serial-...
- 1
1
vote
2
answers
1k
views
How can I extract tag from syslog message, and us it as path variable?
I have severals servers logging to the central syslog server, which collect the logs using syslog-ng.
I send logs with a tag using the logger command :
$ logger -n 01.02.03.04 "Hello from $HOST at $(...
- 123
0
votes
1
answer
355
views
using mysql to send a database of log messages to syslog-ng?
I want to create a database of my proxy-server log messages and then modify and change them then finally send them to syslog-ng!!
Is it possible?
- 3
1
vote
1
answer
576
views
rsyslog/syslog-ng pattern to log ssh and related sftp session for an user
I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename:
I have this:
Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port ...
- 547
-1
votes
1
answer
2k
views
syslog-ng | How to separate Logs from different Applications from one Client without to use different Ports ???
I have some Samba-Domain-Controllers and one central Syslog-Server. All of them running the latest syslog-ng and SUSE Leap15. Every Log from Samba, Winbind and Bind/Named should go to the central ...
- 9
1
vote
1
answer
1k
views
Splitting a syslog-ng message
I want to save the source IP address from an sshd log entry into a mysql database from within syslog-ng. Currently, I have a filter defined which matches on a substring of the desired log entry.
I ...
- 3,714
0
votes
0
answers
91
views
Wifi appliance not sending syslog
I am struggling a bit with my new syslog server which is not receiving log from my wifi appliance.
My wifi appliance is an aerohive, there is almost nothing about configuring syslog on it on internet, ...
1
vote
1
answer
105
views
Identifying who is logging to my device
I have a machine that aggregates syslog data from many devices, I keep all the devices that I want to have logging to my device in /etc/hosts so that they all have names that I understand. If a ...
- 2,188
1
vote
1
answer
697
views
syslog-ng, create logging sequence with file creation
I have been assigned to configure syslog-ng on a linux device to perform in a certain way.
I am fairly new to working with syslog-ng, so please have that in consideration when replying.
Following ...
- 11
1
vote
1
answer
583
views
Syslog-ng loggen behavior
Here's the situation:
I have syslog-ng version 3.15. I've noticed that when using TLS and non-TLS transmission, the logs are different.
I have noticed that, when sending logs using the loggen -i (...
0
votes
1
answer
751
views
systemd unit alias (symlink) missing for syslog-ng / syslog
I am having issues with an Ubuntu 16.04.4 machine running systemd and syslog-ng (3.5.6-2.1), where messages logged to syslog by a process (let's call it X) were not received by syslog-ng. Digging into ...
- 1
1
vote
1
answer
273
views
AMQPS To Syslog
Currently I'm using basic API gets to pull down logs from a cloud security vendor but it's not a very clean process. I would like to transition over to the event streaming (AMQPS) service they provide....
- 1,393
1
vote
0
answers
1k
views
Syslog-ng not triggering Python script
I am currently trying to setup a Syslog application to trigger a certain python script when a certain message is found however I'm having trouble calling the python script. Below is the current config ...
- 11
1
vote
1
answer
5k
views
syslog-ng logs sent to multiple destination
I'm getting remote nginx syslogs going to both /var/log/nginx and /var/log/splunk on my syslog-ng server. How do I only get it to go to /var/log/nginx?
#/etc/syslog-ng/syslog-ng.conf
source s_sys {
...
- 243
1
vote
1
answer
344
views
Filtering dpkg logs in syslog-ng
I am new to syslog-ng, and I am setting a syslog-ng, where I am receiving logs of syslog, auth.log and dpkg.log. Although I was able to get the logs for syslog and auth.log, but I am unable to write ...
- 121
1
vote
0
answers
446
views
syslog-ng not recognizing "python" as a parser keyword
( Yes, I've seen syslog-ng does not recognize "python" keyword . However, 1) the mentioned solution doesn't help me because I checked and mod-python is loaded, and 2) it applies to file ...
- 1,347
1
vote
2
answers
10k
views
how to transfer log file to another linux server for processing
Is there an reliable way to transfer logs from one server to another?
Currently i'm using cron script to transfer file with scp to another server every 5 minutes.
*/5 * * * * root
scp ~/...
- 33
1
vote
0
answers
726
views
Get json output file for cisco router logs with syslog ng
Have cisco router logs as following
Sep 18 20:55:30 2405:XXX:204:XXX:172:22:XXX:25 93596: 093382: Sep 18 20:53:17.848 IST: %TCP-6-BADAUTH: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to ...
- 11