Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [syslog-ng]

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

0
votes
1answer
49 views

using mysql to send a database of log messages to syslog-ng?

I want to create a database of my proxy-server log messages and then modify and change them then finally send them to syslog-ng!! Is it possible?
1
vote
1answer
47 views

rsyslog/syslog-ng pattern to log ssh and related sftp session for an user

I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename: I have this: Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port ...
-1
votes
1answer
61 views

syslog-ng | How to separate Logs from different Applications from one Client without to use different Ports ???

I have some Samba-Domain-Controllers and one central Syslog-Server. All of them running the latest syslog-ng and SUSE Leap15. Every Log from Samba, Winbind and Bind/Named should go to the central ...
0
votes
1answer
81 views

Splitting a syslog-ng message

I want to save the source IP address from an sshd log entry into a mysql database from within syslog-ng. Currently, I have a filter defined which matches on a substring of the desired log entry. I ...
0
votes
0answers
30 views

Wifi appliance not sending syslog

I am struggling a bit with my new syslog server which is not receiving log from my wifi appliance. My wifi appliance is an aerohive, there is almost nothing about configuring syslog on it on internet, ...
1
vote
1answer
74 views

Identifying who is logging to my device

I have a machine that aggregates syslog data from many devices, I keep all the devices that I want to have logging to my device in /etc/hosts so that they all have names that I understand. If a ...
0
votes
1answer
38 views

syslog-ng, create logging sequence with file creation

I have been assigned to configure syslog-ng on a linux device to perform in a certain way. I am fairly new to working with syslog-ng, so please have that in consideration when replying. Following ...
0
votes
1answer
126 views

Syslog-ng loggen behavior

Here's the situation: I have syslog-ng version 3.15. I've noticed that when using TLS and non-TLS transmission, the logs are different. I have noticed that, when sending logs using the loggen -i (...
0
votes
1answer
136 views

systemd unit alias (symlink) missing for syslog-ng / syslog

I am having issues with an Ubuntu 16.04.4 machine running systemd and syslog-ng (3.5.6-2.1), where messages logged to syslog by a process (let's call it X) were not received by syslog-ng. Digging into ...
1
vote
1answer
62 views

AMQPS To Syslog

Currently I'm using basic API gets to pull down logs from a cloud security vendor but it's not a very clean process. I would like to transition over to the event streaming (AMQPS) service they provide....
1
vote
0answers
305 views

Syslog-ng not triggering Python script

I am currently trying to setup a Syslog application to trigger a certain python script when a certain message is found however I'm having trouble calling the python script. Below is the current config ...
0
votes
1answer
2k views

syslog-ng logs sent to multiple destination

I'm getting remote nginx syslogs going to both /var/log/nginx and /var/log/splunk on my syslog-ng server. How do I only get it to go to /var/log/nginx? #/etc/syslog-ng/syslog-ng.conf source s_sys { ...
1
vote
1answer
133 views

Filtering dpkg logs in syslog-ng

I am new to syslog-ng, and I am setting a syslog-ng, where I am receiving logs of syslog, auth.log and dpkg.log. Although I was able to get the logs for syslog and auth.log, but I am unable to write ...
0
votes
0answers
161 views

syslog-ng not recognizing “python” as a parser keyword

( Yes, I've seen syslog-ng does not recognize "python" keyword . However, 1) the mentioned solution doesn't help me because I checked and mod-python is loaded, and 2) it applies to file ...
-1
votes
2answers
2k views

how to transfer log file to another linux server for processing

Is there an reliable way to transfer logs from one server to another? Currently i'm using cron script to transfer file with scp to another server every 5 minutes. */5 * * * * root scp ~/...
1
vote
0answers
271 views

Get json output file for cisco router logs with syslog ng

Have cisco router logs as following Sep 18 20:55:30 2405:XXX:204:XXX:172:22:XXX:25 93596: 093382: Sep 18 20:53:17.848 IST: %TCP-6-BADAUTH: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to ...
0
votes
1answer
294 views

syslog-ng parses $MSG oddly

I am working on migrating a large syslog farm from syslog-ng 2.0.9 to 3.8.1. I have incoming datagrams that look like this: <14>Aug 14 21:28:49 pa01.foo.com 1,2017/08/14 21:28:49,009401031978,...
0
votes
1answer
412 views

Tagging/modifying syslog-ng messages from different sources using same IP

Greetings. First of all, thanks for take your time and read this question; apologies by my poor English. I’m really n00b about syslog-ng, but I did the job and reading syslog-ng-ose-admin-guide.pdf ...
3
votes
1answer
938 views

How can I compare ${HOST} and ${HOST_FROM} (or why ${HOST} != ${HOST})?

I have a setup which can be summarized as follow: service --> syslog-ng relay --> syslog-ng server On the syslog-ng server, I would have the log organized as follow: /var/log/ ----> syslog-...
1
vote
0answers
179 views

Syslog-ng - 6 day old log file touched when writing to today's log file

Nearly every time syslog-ng writes to the current log file, it touches the log file from 6 days prior. It is not writing any data into the old log files, just updating their last modified timestamp. ...
0
votes
1answer
335 views

syslog-ng 3.2.5 server stops receiving data, possibly related to logrotate

I asked this question in Unix & Linux but I think it actually fits better here. Currently, I use the following logrotate.d configuration /var/log/messages { daily compress rotate ...
0
votes
0answers
104 views

How to get data from a port and forward it to other syslog-ng Servers using nginx?

I am sending data to 9516 port on nginx server . From this server I want to forward it to two syslog-ng servers using roundrobin method. I have below nginx.conf file, with this I am able to load ...
0
votes
1answer
6k views

logrotate configuration on linux to rotate syslog-ng log files correctly

I am having some trouble trying to configure log rotation for some syslog-ng local log files I'm trying to keep. for some reason, the size is not respected and logs are filling my filesystem quickly. ...
1
vote
1answer
1k views

Syslog-ng Time Format & Time Zone

I'm currently using a fairly old version of syslog-ng, 2.1.4, and yes I know I need to update it as soon as possible, but for now I need help on modifying the date/time format and time zone. ...
0
votes
1answer
213 views

Syslog-NG is spooling messages

I am currently using Balabit's Syslog-NG to concentrate my IT logs and convey them in a remote server, via a TCP connection, which can allow one listening port only. Thing is, my log volume is really ...
0
votes
1answer
238 views

Can't get Freeradius2 to send logs to syslog-ng version 3.5

I have a Syslog-ng 3.5 and freeradius2 Ubuntu server 16.04 both running as virtual machines in a vmware esxi 5.5 HYpervisor. Well from a previous post I got sylog-ng to send logs from /var/log/...
0
votes
1answer
755 views

Freeradius not redirecting logs to syslog-ng

Good Afternoon. I have a problem with a Freeradius 2 server in UBuntu 16.04 Is installed from a template in a vmware 5.5 Hypervisor ans since lacks of HHD space, logs start collapsing the system, the ...
0
votes
2answers
500 views

unable to filter badly-formatted messages in syslog-ng

I am contacting you regarding an issue I have with syslog-NG. some of our devices (mainly HP switches and SANs) are sending syslog messages that do not respect the syslog RFC 5424 it seems. to give ...
1
vote
2answers
286 views

Upgrade the os of a syslog-ng or rsyslog server

I run a RHEL server with rsyslog to collect my network logs, and by receiving a security bulletin alert I have to upgrade this server. What is the strategy to upgrade this machine, knowing that many ...
1
vote
1answer
363 views

Ignoring forwarder IP in syslog-ng

We are getting syslog-ng feeds from a forwarder that we don't control. The issue is that they are using an older version (RHEL 6), and while they have keep_hostnames set to 'yes' (chain_hostnames to '...
0
votes
2answers
609 views

Can I use syslog-ng to mirror all log files on a remote server without specifying every file?

Can I use syslog-ng to mirror all log files onto a remote server without specifying every file? Both are running syslog-ng OSE version 3.5.2. The file("/var/log/*") setting seems promising, but it ...
0
votes
1answer
268 views

With syslog-ng how can I reset an environment variable without losing log messages?

On this system, imagine that there is a program that detects whether or not it is day or night and sets and environment variable DAY. My environment variable DAY is picked up and used in this working ...
0
votes
1answer
299 views

Match the SourceName set in nxlog in syslog-ng

This one is driving me a bit crazy. How do I route a message from nxlog received by syslog-ng based on the program name? It should be self explanatory but it isn't working correctly. The messages are ...
0
votes
1answer
779 views

Extracting values from csv-parser in syslog-ng

I've got a syslog feed in csv format being ingested by syslog-ng using the csv-parser and written to disk. As I understand it, using the csv-parser is supposed to give syslog-ng context into the data ...
0
votes
1answer
2k views

Avoid logging in /var/log/syslog only using /etc/syslog-ng/conf.d/

How to tell syslog to send custom app's logs to a separate file and NOT into /var/log/syslog WITHOUT changing /etc/syslog-ng/syslog-ng.conf ? I have a custom application that sends messages to syslog'...
1
vote
0answers
315 views

Kafka module missing on syslog-ng.

I'm trying to install syslog-ng and its kafka module. I'm using docker debian:latest for this if that matters. After running 'apt-get install syslog-ng' the syslog-ng can't reach the kafka module ...
0
votes
1answer
60 views

Syslog-NG version compatibility

I have 3 servers configured to run syslog-ng. We'll call the servers web, jump, and client. Web is CentOS 6 Jump and Client are CentOS 7 Jump is an OpenVPN server Client is an OpenVPN client Web is ...
0
votes
1answer
346 views

syslog-ng does not recognize “python” keyword

I'm trying to use Syslog-ng so that it forwards the messages to a python destination. However, I keep getting a "Error parsing destination, destination plugin python not found ..." message. I am ...
-1
votes
2answers
313 views

rsyslog execute action on multiple events

I would like to have an application to be executed when an event reaches multiple times in a row in the log, eg: Oct 17 13:09:24 mail clamav-milter[30942]: x x x Happens 4 times but also this ...
3
votes
2answers
5k views

Install syslog-ng on RHEL 7

I'm very surprised at how much trouble this is giving me. I have a RHEL 7 machine I'm trying to install syslog-ng on. I added the EPEL repository, I get the following output: # yum install syslog-ng....
0
votes
1answer
93 views

syslog-ng complaining about plugin 'tfjson'

I keep getting this error from cron every night. I can't figure out what syslog-ng is looking for. I've installed syslog-ng-mod-json module through apt, however the problem persists whenever syslog-ng ...
0
votes
1answer
278 views

syslog-ng: filtering uncategorized messages

I set up a configuration where messages are classified and written into corresponding files (destinations). I'm wondering -- is it possible to log to a file messages that are not grabbed by specific ...
0
votes
1answer
361 views

Configure rsyslog client to send different log filename to a syslog-ng server

I have multiple servers with rsyslog configured to write logs to a remote syslog-ng server configured like this: # Log anything of level info or higher. # Don't log private authentication messages! *....
0
votes
1answer
288 views

cygwin64 on Windows server, syslog data prints out all in one line

I am trying to automatically format syslog data from cygwin64 to print out with line breaks at the end of each line, so I can do some parsing later on. However, I don't see any configs that could ...
-1
votes
1answer
1k views

syslog-ng logs storing with hostname year date

I have syslog-ng on Ubuntu 12.4 to store mikrotik router logs. At a moment its working fine and log gets stored in a file i set. Howto add store logs in a file/folder according to source IP so that ...
0
votes
0answers
3k views

Syslog-ng "Error binding socket; addr='AF_INET($CLIENT)', error ='Cannot assign requested address (99)' Error initializing message pipeline;

I'm pretty new to syslog-ng, however after doing some research, found that it would be a good fit for the current project I am working on. Essentially all that I need to do is send syslog messages ...
1
vote
1answer
791 views

syslog-ng doesn't parse messages

I'm trying to set up syslog-ng to properly parse RFC5424-compilant messages, thus far, with little success. According to the syslog-ng documentation, The syslog-ng OSE application can automatically ...
0
votes
1answer
88 views

Reading syslog-ng logs being sent to a remote server

I have a Docker container which is sending syslog logs to logentries.com. This is working fine, but for times when logentries is down or delayed, I want a way to read logs generated in realtime inside ...
1
vote
1answer
1k views

syslog-ng working as foreground process but not as daemon

I'm working to implement syslog-ng OSE in my environment. Eventually I'd like to setup a central logging server, but in order to get my feet wet, I'm starting with a simple configuration. I've ...
0
votes
2answers
697 views

Referencing journald fields when forwarding messages to syslog-ng

How can I change my syslog-ng template so that when the log originates from a systemd service / unit, the log message will include the unit's name? Using ${PROGRAM} just shows the name of the ...