Questions tagged [syslog-ng]

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

Syslog-ng - Today's date in source file

Is it possible to somehow automatically switch the source filename to today's date in in syslog-ng? Or is there another solution for it? I have a file with today's date, for example source-file.2021-...
0
votes
0answers
11 views

Importing a log file into InfluxDB?

I have a copy of a syslog file generated on an offline server that has entries like this: 2021-03-17T22:28:48.688Z,1616020128.688 [Supervisor](DEBUG): Initializing supervisor. 2021-03-17T22:28:48.692Z,...
1
vote
0answers
91 views

Syslog-NG Error processing log message using IETF format

we've just changed our logging application on our AS/400 partitions and are now using a product called PowerTech SIEM agent for IBM I The tool used to format messages using the old syslog convention ...
0
votes
0answers
22 views

memory leaks in syslog-ng

I have a multi-machine configuration where i run syslog-ng on each machine. One machine(master) collects the logs from other machines(slaves) on some xxx port. Q1) If i dont run syslog-ng on master ...
1
vote
1answer
151 views

running syslog-ng in verbose mode

EDIT1: syslog-ng launch command : /usr/sbin/syslog-ng -u syslog -g syslog -R /tmp/syslog-ng.persist -F commands used: syslog-ng-ctl verbose --set=on and syslog-ng-ctl verbose I am trying to run syslog-...
0
votes
0answers
12 views

syslog-ng (3.26) fails when started from systemd

I can start syslog-ng from the command line without issues (apart form a warning to stderr) but when I try and start it from systemd it starts up (it prints the warning message to the logs) and then ...
0
votes
0answers
19 views

How to confug syslog-ng when remote server to be know later

Is it possible to configure syslog-ng to store logs locally until my app gets information about remote syslog server and restarts syslog-ng client with updated remote syslog server configuration? ...
1
vote
1answer
240 views

“EOF occurred while idle” when using network directive in syslog-ng

I want to forward logs from a local machine to a distant server. Thanks to an SSH tunnel, the distant server is reachable through localhost:5514. I wrote the following conf: # Filters filter f_local0 {...
0
votes
0answers
56 views

single destination for multiple filters with unique index

Description of the problem I am currently using rsyslog to forward logs to a syslog-ng server, this is my current configuration: $DefaultNetstreamDriver gtls $DefaultNetstreamDriverCAFile /etc/ssl/...
0
votes
0answers
58 views

How do I send multiple log files to graylog server?

Trying to figure out how to send local multiple logs files to remote server using syslog-ng. Following Local file logs: /var/log/2020/09/access/2020-09-01-access.log /var/log/2020/09/account/2020-09-...
0
votes
1answer
9 views

Save incoming log with suffix to its logfile-suffix.log using syslog-ng

I've been searching on the internet for answers relating to syslog-ng and how I can configure syslog-ng to save incoming log files with a specific suffix to a file and also carry over the suffix ...
0
votes
1answer
105 views

using syslog-ng to parse snmptrapd - not keeping up

(centos 7.x) I have syslog-ng setup to parse snmptrapd messages so I can format them for later digestion. The issue is that syslog-ng only outputs the n-1 message. IE if there are 10 lines in ...
0
votes
1answer
57 views

How can I set up syslog-ng to send only invalid JSON logs to a destination

I've set up syslog-ng 3.25.1 to read log messages from a file, parse them as JSON, and forward them to an ElasticSearch cluster. This works well when the messages are formatted correctly as JSON, ...
0
votes
1answer
220 views

syslog-ng set loglevel/priority to warning or more to be less verbose

How to run/configure syslog-ng to log only above the security loglevel/priority WARNING? I would like to discard NOTICES like: Destination timeout has elapsed, closing connection; fd='36' From the ...
0
votes
0answers
123 views

How to test filters in syslog-ng?

I would like to send to a telegram bot any successful ssh connections so I wrote this: filter f_ssh { facility(auth) and match("sshd" value("Accepted.+?ssh2")); }; And later: log { source(src); ...
-3
votes
1answer
73 views

How to hack proof my syslog-ng server

I recently built a Ubuntu syslog-ng server that is behind a firewall. I have opened TCP ports 514, 515, and 516. I have noticed that hackers are writing to my syslog-ng server, they are from China. ...
0
votes
1answer
182 views

Seprate json part of incoming log with syslog-ng by config

I'm receiving my log without any parse: source s_network { network( transport(tcp) port(601) flags(no-parse)); }; My saved log have two part: reciver information json part of log ( like ...
0
votes
1answer
497 views

Set a Macro before sending log over network with syslog-ng

I have created a syslog server and client. I want to set client serial number in SOURCE macro in all logs being sent to server so that on server side I can retrieve the macro and can create the log ...
0
votes
1answer
102 views

How to set-up Syslog-NG with MonitorWare schema?

we are setting up a centralized logging server which receives logs from many devices and servers and stored them into a database. The syslog on the central server is syslog-ng. It is chosen because ...
1
vote
1answer
267 views

syslog-ng configuration works in debug mode, but not without

I am trying to run syslog-ng as an OCF resource in an HA cluster. I am encountering some terribly strange behavior - when I start a single instance in debug mode, the filters match and it forwards ...
0
votes
1answer
239 views

Disable process id showing in Syslog-ng logs

I configured syslog-ng (version 3.21.1) on a CentOS7 server and found that logs are in following format. Aug 26 12:59:28 xyz74hd.com radiusd[20142]: 92djvd4654654164nadskj795234dc Reason: pldap: ...
0
votes
1answer
217 views

syslog-ng freezes/doesnt log when it encounters log messages with older time stamp

we are seeing issue with syslog-ng 3.8.1 dropping logs with older timestamp. Our system has an issue in persisting hardware clock after a reboot however, it might be an issue even with ntp jitter as ...
1
vote
2answers
894 views

syslog-ng execute script on syslog pattern

I have a simple requirement. I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script. ...
1
vote
1answer
279 views

Syslog-ng: Hostnames with slashes

We have a problem where we have a device type logging with hostnames like slot1/devicename. Unfortunately, when the logs are written to disk, only the slot1 is written; since we have a number of ...
0
votes
2answers
5k views

syslog-ng.conf listen for remote servers

I'm configuring /etc/syslog-ng/syslog-ng.conf on version 3.5.6-2 to listen to remote hosts on port 514 by changing the configuration like #source s_src { # system(); # internal(); #}; # If you ...
-1
votes
2answers
723 views

Extract values from MESSAGE in Syslog-NG

I receive syslog messages as follows: [nms321@uhp.1.3.6.1.4.1.8000.10 net_id="325" station="431" fault="16384"] [NotificationHandler] NMS error: STCRC/NOTTS Net: Enas Station: CED Elmas serial-...
1
vote
2answers
554 views

How can I extract tag from syslog message, and us it as path variable?

I have severals servers logging to the central syslog server, which collect the logs using syslog-ng. I send logs with a tag using the logger command : $ logger -n 01.02.03.04 "Hello from $HOST at $(...
0
votes
1answer
227 views

using mysql to send a database of log messages to syslog-ng?

I want to create a database of my proxy-server log messages and then modify and change them then finally send them to syslog-ng!! Is it possible?
1
vote
1answer
294 views

rsyslog/syslog-ng pattern to log ssh and related sftp session for an user

I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename: I have this: Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port ...
-1
votes
1answer
731 views

syslog-ng | How to separate Logs from different Applications from one Client without to use different Ports ???

I have some Samba-Domain-Controllers and one central Syslog-Server. All of them running the latest syslog-ng and SUSE Leap15. Every Log from Samba, Winbind and Bind/Named should go to the central ...
0
votes
1answer
687 views

Splitting a syslog-ng message

I want to save the source IP address from an sshd log entry into a mysql database from within syslog-ng. Currently, I have a filter defined which matches on a substring of the desired log entry. I ...
0
votes
0answers
65 views

Wifi appliance not sending syslog

I am struggling a bit with my new syslog server which is not receiving log from my wifi appliance. My wifi appliance is an aerohive, there is almost nothing about configuring syslog on it on internet, ...
1
vote
1answer
82 views

Identifying who is logging to my device

I have a machine that aggregates syslog data from many devices, I keep all the devices that I want to have logging to my device in /etc/hosts so that they all have names that I understand. If a ...
0
votes
1answer
213 views

syslog-ng, create logging sequence with file creation

I have been assigned to configure syslog-ng on a linux device to perform in a certain way. I am fairly new to working with syslog-ng, so please have that in consideration when replying. Following ...
1
vote
1answer
397 views

Syslog-ng loggen behavior

Here's the situation: I have syslog-ng version 3.15. I've noticed that when using TLS and non-TLS transmission, the logs are different. I have noticed that, when sending logs using the loggen -i (...
0
votes
1answer
428 views

systemd unit alias (symlink) missing for syslog-ng / syslog

I am having issues with an Ubuntu 16.04.4 machine running systemd and syslog-ng (3.5.6-2.1), where messages logged to syslog by a process (let's call it X) were not received by syslog-ng. Digging into ...
1
vote
1answer
191 views

AMQPS To Syslog

Currently I'm using basic API gets to pull down logs from a cloud security vendor but it's not a very clean process. I would like to transition over to the event streaming (AMQPS) service they provide....
1
vote
0answers
717 views

Syslog-ng not triggering Python script

I am currently trying to setup a Syslog application to trigger a certain python script when a certain message is found however I'm having trouble calling the python script. Below is the current config ...
1
vote
1answer
4k views

syslog-ng logs sent to multiple destination

I'm getting remote nginx syslogs going to both /var/log/nginx and /var/log/splunk on my syslog-ng server. How do I only get it to go to /var/log/nginx? #/etc/syslog-ng/syslog-ng.conf source s_sys { ...
1
vote
1answer
234 views

Filtering dpkg logs in syslog-ng

I am new to syslog-ng, and I am setting a syslog-ng, where I am receiving logs of syslog, auth.log and dpkg.log. Although I was able to get the logs for syslog and auth.log, but I am unable to write ...
1
vote
0answers
321 views

syslog-ng not recognizing “python” as a parser keyword

( Yes, I've seen syslog-ng does not recognize "python" keyword . However, 1) the mentioned solution doesn't help me because I checked and mod-python is loaded, and 2) it applies to file ...
1
vote
2answers
6k views

how to transfer log file to another linux server for processing

Is there an reliable way to transfer logs from one server to another? Currently i'm using cron script to transfer file with scp to another server every 5 minutes. */5 * * * * root scp ~/...
1
vote
0answers
551 views

Get json output file for cisco router logs with syslog ng

Have cisco router logs as following Sep 18 20:55:30 2405:XXX:204:XXX:172:22:XXX:25 93596: 093382: Sep 18 20:53:17.848 IST: %TCP-6-BADAUTH: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to ...
0
votes
1answer
794 views

syslog-ng parses $MSG oddly

I am working on migrating a large syslog farm from syslog-ng 2.0.9 to 3.8.1. I have incoming datagrams that look like this: <14>Aug 14 21:28:49 pa01.foo.com 1,2017/08/14 21:28:49,009401031978,...
0
votes
1answer
728 views

Tagging/modifying syslog-ng messages from different sources using same IP

Greetings. First of all, thanks for take your time and read this question; apologies by my poor English. I’m really n00b about syslog-ng, but I did the job and reading syslog-ng-ose-admin-guide.pdf ...
3
votes
1answer
2k views

How can I compare ${HOST} and ${HOST_FROM} (or why ${HOST} != ${HOST})?

I have a setup which can be summarized as follow: service --> syslog-ng relay --> syslog-ng server On the syslog-ng server, I would have the log organized as follow: /var/log/ ----> syslog-...
1
vote
0answers
291 views

Syslog-ng - 6 day old log file touched when writing to today's log file

Nearly every time syslog-ng writes to the current log file, it touches the log file from 6 days prior. It is not writing any data into the old log files, just updating their last modified timestamp. ...
0
votes
1answer
678 views

syslog-ng 3.2.5 server stops receiving data, possibly related to logrotate

I asked this question in Unix & Linux but I think it actually fits better here. Currently, I use the following logrotate.d configuration /var/log/messages { daily compress rotate ...
0
votes
0answers
140 views

How to get data from a port and forward it to other syslog-ng Servers using nginx?

I am sending data to 9516 port on nginx server . From this server I want to forward it to two syslog-ng servers using roundrobin method. I have below nginx.conf file, with this I am able to load ...
2
votes
1answer
12k views

logrotate configuration on linux to rotate syslog-ng log files correctly

I am having some trouble trying to configure log rotation for some syslog-ng local log files I'm trying to keep. for some reason, the size is not respected and logs are filling my filesystem quickly. ...