2022 Developer Survey is open! Take survey.

Questions tagged [syslog-ng]

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

Filter by
Sorted by
Tagged with
0 votes
0 answers
27 views

Traefik don't keep real ip

I have a problem with Traefik, I want to log from a server with syslog-ng (docker). I have logs but I have reverse_proxy name and I want source IP not the name of traefik. I wish to keep source IP ...
user avatar
  • 1
0 votes
0 answers
65 views

syslog-ng - set a value or macro based on value of another macro

I have a patterndb config that is parsing pfsense filterlog messages to extract the various fields to send to Azure Sentinel in CEF format, it is largely working fine I need to set the Severity field ...
user avatar
0 votes
1 answer
27 views

syslog-ng freezes when reloading config changes in log msg size

I'm having a weird case of syslog-ng freezing on some reloads and under some conditions. syslog-ng version is ubuntu 20.04's default 3.25.1. It has to be something related to log_msg_size as this ...
user avatar
  • 1,159
0 votes
0 answers
141 views

syslog-ng duplicate log message

Not duplicate of this question because that one uses rsyslog on client whereas I use syslog-ng on both sides. I have a syslog-ng instance on both the client and the server and for whatever reason the ...
user avatar
0 votes
1 answer
546 views

syslog-ng: how to configure sending RFC5424 messages with octet-counting framing

Please don't bother reading this question. syslog-ng is already set up to send RFC5424 messages with octet-counting framing by default. I was confused by the behaviour of another component. This ...
user avatar
  • 353
0 votes
1 answer
174 views

syslog-ng / telegraf : EOF occurred when idle - incompatible?

This is a follow-on question from this previous question, created because I found out more information and it's cleaner to pose this as a new question. I'm using syslog-ng OSE v3.31.2 to receive ...
user avatar
  • 353
0 votes
2 answers
164 views

syslog-ng: How to reduce high latency when forwarding logs to a syslog tcp consumer?

UPDATE 2: I've answered this via my new question at the link below. The root cause is behaviour by telegraf where by default it disconnects the TCP connection 5 seconds after the last received message....
user avatar
  • 353
0 votes
0 answers
46 views

How to get all dates in syslog-ng to appear in ISO format

I'm using a recent syslog-ng version 3.19, and I'm keen on getting all the timestamps in all future messages to use ISO 8601 format. YYYY-MM-DD etc. I see from the help on the syslog documentation ...
user avatar
  • 101
0 votes
0 answers
80 views

RSyslogd is sending multiples CEF messages in the same Syslog message

There is a Python script sending multiple events to a remote host with Rsyslogd: CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=767000670128771115 CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=...
user avatar
2 votes
1 answer
570 views

Syslog-NG Error processing log message using IETF format

we've just changed our logging application on our AS/400 partitions and are now using a product called PowerTech SIEM agent for IBM I The tool used to format messages using the old syslog convention ...
user avatar
  • 474
1 vote
1 answer
790 views

running syslog-ng in verbose mode

EDIT1: syslog-ng launch command : /usr/sbin/syslog-ng -u syslog -g syslog -R /tmp/syslog-ng.persist -F commands used: syslog-ng-ctl verbose --set=on and syslog-ng-ctl verbose I am trying to run syslog-...
user avatar
  • 13
1 vote
1 answer
799 views

"EOF occurred while idle" when using network directive in syslog-ng

I want to forward logs from a local machine to a distant server. Thanks to an SSH tunnel, the distant server is reachable through localhost:5514. I wrote the following conf: # Filters filter f_local0 {...
user avatar
  • 155
0 votes
1 answer
14 views

Save incoming log with suffix to its logfile-suffix.log using syslog-ng

I've been searching on the internet for answers relating to syslog-ng and how I can configure syslog-ng to save incoming log files with a specific suffix to a file and also carry over the suffix ...
user avatar
  • 156
0 votes
1 answer
245 views

using syslog-ng to parse snmptrapd - not keeping up

(centos 7.x) I have syslog-ng setup to parse snmptrapd messages so I can format them for later digestion. The issue is that syslog-ng only outputs the n-1 message. IE if there are 10 lines in ...
user avatar
  • 2,297
0 votes
1 answer
189 views

How can I set up syslog-ng to send only invalid JSON logs to a destination

I've set up syslog-ng 3.25.1 to read log messages from a file, parse them as JSON, and forward them to an ElasticSearch cluster. This works well when the messages are formatted correctly as JSON, ...
user avatar
  • 111
0 votes
1 answer
417 views

syslog-ng set loglevel/priority to warning or more to be less verbose

How to run/configure syslog-ng to log only above the security loglevel/priority WARNING? I would like to discard NOTICES like: Destination timeout has elapsed, closing connection; fd='36' From the ...
user avatar
  • 548
-3 votes
1 answer
131 views

How to hack proof my syslog-ng server

I recently built a Ubuntu syslog-ng server that is behind a firewall. I have opened TCP ports 514, 515, and 516. I have noticed that hackers are writing to my syslog-ng server, they are from China. ...
user avatar
  • 263
0 votes
1 answer
289 views

Seprate json part of incoming log with syslog-ng by config

I'm receiving my log without any parse: source s_network { network( transport(tcp) port(601) flags(no-parse)); }; My saved log have two part: reciver information json part of log ( like ...
user avatar
  • 3
0 votes
1 answer
773 views

Set a Macro before sending log over network with syslog-ng

I have created a syslog server and client. I want to set client serial number in SOURCE macro in all logs being sent to server so that on server side I can retrieve the macro and can create the log ...
user avatar
0 votes
1 answer
151 views

How to set-up Syslog-NG with MonitorWare schema?

we are setting up a centralized logging server which receives logs from many devices and servers and stored them into a database. The syslog on the central server is syslog-ng. It is chosen because ...
user avatar
1 vote
1 answer
512 views

syslog-ng configuration works in debug mode, but not without

I am trying to run syslog-ng as an OCF resource in an HA cluster. I am encountering some terribly strange behavior - when I start a single instance in debug mode, the filters match and it forwards ...
user avatar
  • 31
0 votes
1 answer
504 views

Disable process id showing in Syslog-ng logs

I configured syslog-ng (version 3.21.1) on a CentOS7 server and found that logs are in following format. Aug 26 12:59:28 xyz74hd.com radiusd[20142]: 92djvd4654654164nadskj795234dc Reason: pldap: ...
user avatar
  • 5
0 votes
1 answer
299 views

syslog-ng freezes/doesnt log when it encounters log messages with older time stamp

we are seeing issue with syslog-ng 3.8.1 dropping logs with older timestamp. Our system has an issue in persisting hardware clock after a reboot however, it might be an issue even with ntp jitter as ...
user avatar
1 vote
2 answers
1k views

syslog-ng execute script on syslog pattern

I have a simple requirement. I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script. ...
user avatar
1 vote
1 answer
393 views

Syslog-ng: Hostnames with slashes

We have a problem where we have a device type logging with hostnames like slot1/devicename. Unfortunately, when the logs are written to disk, only the slot1 is written; since we have a number of ...
user avatar
  • 141
0 votes
2 answers
9k views

syslog-ng.conf listen for remote servers

I'm configuring /etc/syslog-ng/syslog-ng.conf on version 3.5.6-2 to listen to remote hosts on port 514 by changing the configuration like #source s_src { # system(); # internal(); #}; # If you ...
user avatar
-1 votes
2 answers
998 views

Extract values from MESSAGE in Syslog-NG

I receive syslog messages as follows: [nms321@uhp.1.3.6.1.4.1.8000.10 net_id="325" station="431" fault="16384"] [NotificationHandler] NMS error: STCRC/NOTTS Net: Enas Station: CED Elmas serial-...
user avatar
  • 1
1 vote
2 answers
779 views

How can I extract tag from syslog message, and us it as path variable?

I have severals servers logging to the central syslog server, which collect the logs using syslog-ng. I send logs with a tag using the logger command : $ logger -n 01.02.03.04 "Hello from $HOST at $(...
user avatar
  • 123
0 votes
1 answer
279 views

using mysql to send a database of log messages to syslog-ng?

I want to create a database of my proxy-server log messages and then modify and change them then finally send them to syslog-ng!! Is it possible?
user avatar
1 vote
1 answer
432 views

rsyslog/syslog-ng pattern to log ssh and related sftp session for an user

I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename: I have this: Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port ...
user avatar
  • 487
-1 votes
1 answer
1k views

syslog-ng | How to separate Logs from different Applications from one Client without to use different Ports ???

I have some Samba-Domain-Controllers and one central Syslog-Server. All of them running the latest syslog-ng and SUSE Leap15. Every Log from Samba, Winbind and Bind/Named should go to the central ...
user avatar
  • 9
0 votes
1 answer
949 views

Splitting a syslog-ng message

I want to save the source IP address from an sshd log entry into a mysql database from within syslog-ng. Currently, I have a filter defined which matches on a substring of the desired log entry. I ...
user avatar
  • 3,434
0 votes
0 answers
76 views

Wifi appliance not sending syslog

I am struggling a bit with my new syslog server which is not receiving log from my wifi appliance. My wifi appliance is an aerohive, there is almost nothing about configuring syslog on it on internet, ...
user avatar
1 vote
1 answer
84 views

Identifying who is logging to my device

I have a machine that aggregates syslog data from many devices, I keep all the devices that I want to have logging to my device in /etc/hosts so that they all have names that I understand. If a ...
user avatar
  • 2,408
0 votes
1 answer
340 views

syslog-ng, create logging sequence with file creation

I have been assigned to configure syslog-ng on a linux device to perform in a certain way. I am fairly new to working with syslog-ng, so please have that in consideration when replying. Following ...
user avatar
1 vote
1 answer
476 views

Syslog-ng loggen behavior

Here's the situation: I have syslog-ng version 3.15. I've noticed that when using TLS and non-TLS transmission, the logs are different. I have noticed that, when sending logs using the loggen -i (...
user avatar
0 votes
1 answer
530 views

systemd unit alias (symlink) missing for syslog-ng / syslog

I am having issues with an Ubuntu 16.04.4 machine running systemd and syslog-ng (3.5.6-2.1), where messages logged to syslog by a process (let's call it X) were not received by syslog-ng. Digging into ...
user avatar
  • 1
1 vote
1 answer
234 views

AMQPS To Syslog

Currently I'm using basic API gets to pull down logs from a cloud security vendor but it's not a very clean process. I would like to transition over to the event streaming (AMQPS) service they provide....
user avatar
  • 1,363
1 vote
0 answers
854 views

Syslog-ng not triggering Python script

I am currently trying to setup a Syslog application to trigger a certain python script when a certain message is found however I'm having trouble calling the python script. Below is the current config ...
user avatar
  • 11
1 vote
1 answer
4k views

syslog-ng logs sent to multiple destination

I'm getting remote nginx syslogs going to both /var/log/nginx and /var/log/splunk on my syslog-ng server. How do I only get it to go to /var/log/nginx? #/etc/syslog-ng/syslog-ng.conf source s_sys { ...
user avatar
  • 203
1 vote
1 answer
279 views

Filtering dpkg logs in syslog-ng

I am new to syslog-ng, and I am setting a syslog-ng, where I am receiving logs of syslog, auth.log and dpkg.log. Although I was able to get the logs for syslog and auth.log, but I am unable to write ...
user avatar
  • 121
1 vote
0 answers
359 views

syslog-ng not recognizing "python" as a parser keyword

( Yes, I've seen syslog-ng does not recognize "python" keyword . However, 1) the mentioned solution doesn't help me because I checked and mod-python is loaded, and 2) it applies to file ...
user avatar
  • 1,287
1 vote
2 answers
8k views

how to transfer log file to another linux server for processing

Is there an reliable way to transfer logs from one server to another? Currently i'm using cron script to transfer file with scp to another server every 5 minutes. */5 * * * * root scp ~/...
user avatar
  • 33
1 vote
0 answers
616 views

Get json output file for cisco router logs with syslog ng

Have cisco router logs as following Sep 18 20:55:30 2405:XXX:204:XXX:172:22:XXX:25 93596: 093382: Sep 18 20:53:17.848 IST: %TCP-6-BADAUTH: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to ...
user avatar
0 votes
1 answer
993 views

syslog-ng parses $MSG oddly

I am working on migrating a large syslog farm from syslog-ng 2.0.9 to 3.8.1. I have incoming datagrams that look like this: <14>Aug 14 21:28:49 pa01.foo.com 1,2017/08/14 21:28:49,009401031978,...
user avatar
0 votes
1 answer
843 views

Tagging/modifying syslog-ng messages from different sources using same IP

Greetings. First of all, thanks for take your time and read this question; apologies by my poor English. I’m really n00b about syslog-ng, but I did the job and reading syslog-ng-ose-admin-guide.pdf ...
user avatar
  • 3
3 votes
1 answer
2k views

How can I compare ${HOST} and ${HOST_FROM} (or why ${HOST} != ${HOST})?

I have a setup which can be summarized as follow: service --> syslog-ng relay --> syslog-ng server On the syslog-ng server, I would have the log organized as follow: /var/log/ ----> syslog-...
user avatar
1 vote
0 answers
331 views

Syslog-ng - 6 day old log file touched when writing to today's log file

Nearly every time syslog-ng writes to the current log file, it touches the log file from 6 days prior. It is not writing any data into the old log files, just updating their last modified timestamp. ...
user avatar
0 votes
1 answer
794 views

syslog-ng 3.2.5 server stops receiving data, possibly related to logrotate

I asked this question in Unix & Linux but I think it actually fits better here. Currently, I use the following logrotate.d configuration /var/log/messages { daily compress rotate ...
user avatar
  • 1
0 votes
0 answers
185 views

How to get data from a port and forward it to other syslog-ng Servers using nginx?

I am sending data to 9516 port on nginx server . From this server I want to forward it to two syslog-ng servers using roundrobin method. I have below nginx.conf file, with this I am able to load ...
user avatar