Questions tagged [syslog-ng]

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

How to test filters in syslog-ng?

I would like to send to a telegram bot any successful ssh connections so I wrote this: filter f_ssh { facility(auth) and match("sshd" value("Accepted.+?ssh2")); }; And later: log { source(src); ...
-3
votes
1answer
42 views

How to hack proof my syslog-ng server

I recently built a Ubuntu syslog-ng server that is behind a firewall. I have opened TCP ports 514, 515, and 516. I have noticed that hackers are writing to my syslog-ng server, they are from China. ...
0
votes
1answer
93 views

Seprate json part of incoming log with syslog-ng by config

I'm receiving my log without any parse: source s_network { network( transport(tcp) port(601) flags(no-parse)); }; My saved log have two part: reciver information json part of log ( like ...
0
votes
0answers
26 views

Monitoring service on redhat server by snmp

I have a server dedicated to running syslog-ng and service crash sometimes (I don’t know why for now). I would like to find a way to monitor this service or sending a trap when syslog-ng crashes. ...
0
votes
0answers
69 views

syslog-ng-patterndb - how tu use easly

Im new to syslog-ng and i try something new for me. I try the syslog-ng-patterndn but i dont know how to use. I generate with pdbtool generate /my/path/of/my/log i create a xml with this and after i ...
0
votes
1answer
233 views

Set a Macro before sending log over network with syslog-ng

I have created a syslog server and client. I want to set client serial number in SOURCE macro in all logs being sent to server so that on server side I can retrieve the macro and can create the log ...
0
votes
1answer
33 views

How to set-up Syslog-NG with MonitorWare schema?

we are setting up a centralized logging server which receives logs from many devices and servers and stored them into a database. The syslog on the central server is syslog-ng. It is chosen because ...
0
votes
0answers
313 views

syslog-ng - How to include both source IP and hostname (rDNS) in log message?

I would like my messages to be modified by syslog-ng to include both the IP address of the source host and the value of the reverse DNS lookup (of the host). I believe the answer to this question ...
1
vote
1answer
114 views

syslog-ng configuration works in debug mode, but not without

I am trying to run syslog-ng as an OCF resource in an HA cluster. I am encountering some terribly strange behavior - when I start a single instance in debug mode, the filters match and it forwards ...
0
votes
1answer
77 views

Disable process id showing in Syslog-ng logs

I configured syslog-ng (version 3.21.1) on a CentOS7 server and found that logs are in following format. Aug 26 12:59:28 xyz74hd.com radiusd[20142]: 92djvd4654654164nadskj795234dc Reason: pldap: ...
0
votes
1answer
125 views

syslog-ng freezes/doesnt log when it encounters log messages with older time stamp

we are seeing issue with syslog-ng 3.8.1 dropping logs with older timestamp. Our system has an issue in persisting hardware clock after a reboot however, it might be an issue even with ntp jitter as ...
1
vote
2answers
504 views

syslog-ng execute script on syslog pattern

I have a simple requirement. I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script. ...
1
vote
1answer
174 views

Syslog-ng: Hostnames with slashes

We have a problem where we have a device type logging with hostnames like slot1/devicename. Unfortunately, when the logs are written to disk, only the slot1 is written; since we have a number of ...
0
votes
2answers
2k views

syslog-ng.conf listen for remote servers

I'm configuring /etc/syslog-ng/syslog-ng.conf on version 3.5.6-2 to listen to remote hosts on port 514 by changing the configuration like #source s_src { # system(); # internal(); #}; # If you ...
-1
votes
2answers
506 views

Extract values from MESSAGE in Syslog-NG

I receive syslog messages as follows: [nms321@uhp.1.3.6.1.4.1.8000.10 net_id="325" station="431" fault="16384"] [NotificationHandler] NMS error: STCRC/NOTTS Net: Enas Station: CED Elmas serial-...
1
vote
2answers
430 views

How can I extract tag from syslog message, and us it as path variable?

I have severals servers logging to the central syslog server, which collect the logs using syslog-ng. I send logs with a tag using the logger command : $ logger -n 01.02.03.04 "Hello from $HOST at $(...
0
votes
1answer
158 views

using mysql to send a database of log messages to syslog-ng?

I want to create a database of my proxy-server log messages and then modify and change them then finally send them to syslog-ng!! Is it possible?
1
vote
1answer
210 views

rsyslog/syslog-ng pattern to log ssh and related sftp session for an user

I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename: I have this: Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port ...
-1
votes
1answer
589 views

syslog-ng | How to separate Logs from different Applications from one Client without to use different Ports ???

I have some Samba-Domain-Controllers and one central Syslog-Server. All of them running the latest syslog-ng and SUSE Leap15. Every Log from Samba, Winbind and Bind/Named should go to the central ...
0
votes
1answer
508 views

Splitting a syslog-ng message

I want to save the source IP address from an sshd log entry into a mysql database from within syslog-ng. Currently, I have a filter defined which matches on a substring of the desired log entry. I ...
0
votes
0answers
57 views

Wifi appliance not sending syslog

I am struggling a bit with my new syslog server which is not receiving log from my wifi appliance. My wifi appliance is an aerohive, there is almost nothing about configuring syslog on it on internet, ...
1
vote
1answer
82 views

Identifying who is logging to my device

I have a machine that aggregates syslog data from many devices, I keep all the devices that I want to have logging to my device in /etc/hosts so that they all have names that I understand. If a ...
0
votes
1answer
154 views

syslog-ng, create logging sequence with file creation

I have been assigned to configure syslog-ng on a linux device to perform in a certain way. I am fairly new to working with syslog-ng, so please have that in consideration when replying. Following ...
0
votes
1answer
310 views

Syslog-ng loggen behavior

Here's the situation: I have syslog-ng version 3.15. I've noticed that when using TLS and non-TLS transmission, the logs are different. I have noticed that, when sending logs using the loggen -i (...
0
votes
1answer
334 views

systemd unit alias (symlink) missing for syslog-ng / syslog

I am having issues with an Ubuntu 16.04.4 machine running systemd and syslog-ng (3.5.6-2.1), where messages logged to syslog by a process (let's call it X) were not received by syslog-ng. Digging into ...
1
vote
1answer
146 views

AMQPS To Syslog

Currently I'm using basic API gets to pull down logs from a cloud security vendor but it's not a very clean process. I would like to transition over to the event streaming (AMQPS) service they provide....
1
vote
0answers
569 views

Syslog-ng not triggering Python script

I am currently trying to setup a Syslog application to trigger a certain python script when a certain message is found however I'm having trouble calling the python script. Below is the current config ...
1
vote
1answer
3k views

syslog-ng logs sent to multiple destination

I'm getting remote nginx syslogs going to both /var/log/nginx and /var/log/splunk on my syslog-ng server. How do I only get it to go to /var/log/nginx? #/etc/syslog-ng/syslog-ng.conf source s_sys { ...
1
vote
1answer
201 views

Filtering dpkg logs in syslog-ng

I am new to syslog-ng, and I am setting a syslog-ng, where I am receiving logs of syslog, auth.log and dpkg.log. Although I was able to get the logs for syslog and auth.log, but I am unable to write ...
1
vote
0answers
270 views

syslog-ng not recognizing “python” as a parser keyword

( Yes, I've seen syslog-ng does not recognize "python" keyword . However, 1) the mentioned solution doesn't help me because I checked and mod-python is loaded, and 2) it applies to file ...
0
votes
2answers
5k views

how to transfer log file to another linux server for processing

Is there an reliable way to transfer logs from one server to another? Currently i'm using cron script to transfer file with scp to another server every 5 minutes. */5 * * * * root scp ~/...
1
vote
0answers
479 views

Get json output file for cisco router logs with syslog ng

Have cisco router logs as following Sep 18 20:55:30 2405:XXX:204:XXX:172:22:XXX:25 93596: 093382: Sep 18 20:53:17.848 IST: %TCP-6-BADAUTH: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to ...
0
votes
1answer
686 views

syslog-ng parses $MSG oddly

I am working on migrating a large syslog farm from syslog-ng 2.0.9 to 3.8.1. I have incoming datagrams that look like this: <14>Aug 14 21:28:49 pa01.foo.com 1,2017/08/14 21:28:49,009401031978,...
0
votes
1answer
663 views

Tagging/modifying syslog-ng messages from different sources using same IP

Greetings. First of all, thanks for take your time and read this question; apologies by my poor English. I’m really n00b about syslog-ng, but I did the job and reading syslog-ng-ose-admin-guide.pdf ...
3
votes
1answer
2k views

How can I compare ${HOST} and ${HOST_FROM} (or why ${HOST} != ${HOST})?

I have a setup which can be summarized as follow: service --> syslog-ng relay --> syslog-ng server On the syslog-ng server, I would have the log organized as follow: /var/log/ ----> syslog-...
1
vote
0answers
259 views

Syslog-ng - 6 day old log file touched when writing to today's log file

Nearly every time syslog-ng writes to the current log file, it touches the log file from 6 days prior. It is not writing any data into the old log files, just updating their last modified timestamp. ...
0
votes
1answer
548 views

syslog-ng 3.2.5 server stops receiving data, possibly related to logrotate

I asked this question in Unix & Linux but I think it actually fits better here. Currently, I use the following logrotate.d configuration /var/log/messages { daily compress rotate ...
0
votes
0answers
125 views

How to get data from a port and forward it to other syslog-ng Servers using nginx?

I am sending data to 9516 port on nginx server . From this server I want to forward it to two syslog-ng servers using roundrobin method. I have below nginx.conf file, with this I am able to load ...
1
vote
1answer
10k views

logrotate configuration on linux to rotate syslog-ng log files correctly

I am having some trouble trying to configure log rotation for some syslog-ng local log files I'm trying to keep. for some reason, the size is not respected and logs are filling my filesystem quickly. ...
1
vote
1answer
2k views

Syslog-ng Time Format & Time Zone

I'm currently using a fairly old version of syslog-ng, 2.1.4, and yes I know I need to update it as soon as possible, but for now I need help on modifying the date/time format and time zone. ...
0
votes
1answer
342 views

Syslog-NG is spooling messages

I am currently using Balabit's Syslog-NG to concentrate my IT logs and convey them in a remote server, via a TCP connection, which can allow one listening port only. Thing is, my log volume is really ...
0
votes
1answer
356 views

Can't get Freeradius2 to send logs to syslog-ng version 3.5

I have a Syslog-ng 3.5 and freeradius2 Ubuntu server 16.04 both running as virtual machines in a vmware esxi 5.5 HYpervisor. Well from a previous post I got sylog-ng to send logs from /var/log/...
0
votes
1answer
1k views

Freeradius not redirecting logs to syslog-ng

Good Afternoon. I have a problem with a Freeradius 2 server in UBuntu 16.04 Is installed from a template in a vmware 5.5 Hypervisor ans since lacks of HHD space, logs start collapsing the system, the ...
0
votes
2answers
752 views

unable to filter badly-formatted messages in syslog-ng

I am contacting you regarding an issue I have with syslog-NG. some of our devices (mainly HP switches and SANs) are sending syslog messages that do not respect the syslog RFC 5424 it seems. to give ...
1
vote
2answers
519 views

Upgrade the os of a syslog-ng or rsyslog server

I run a RHEL server with rsyslog to collect my network logs, and by receiving a security bulletin alert I have to upgrade this server. What is the strategy to upgrade this machine, knowing that many ...
1
vote
1answer
687 views

Ignoring forwarder IP in syslog-ng

We are getting syslog-ng feeds from a forwarder that we don't control. The issue is that they are using an older version (RHEL 6), and while they have keep_hostnames set to 'yes' (chain_hostnames to '...
0
votes
2answers
1k views

Can I use syslog-ng to mirror all log files on a remote server without specifying every file?

Can I use syslog-ng to mirror all log files onto a remote server without specifying every file? Both are running syslog-ng OSE version 3.5.2. The file("/var/log/*") setting seems promising, but it ...
0
votes
1answer
386 views

With syslog-ng how can I reset an environment variable without losing log messages?

On this system, imagine that there is a program that detects whether or not it is day or night and sets and environment variable DAY. My environment variable DAY is picked up and used in this working ...
0
votes
1answer
464 views

Match the SourceName set in nxlog in syslog-ng

This one is driving me a bit crazy. How do I route a message from nxlog received by syslog-ng based on the program name? It should be self explanatory but it isn't working correctly. The messages are ...
0
votes
1answer
1k views

Extracting values from csv-parser in syslog-ng

I've got a syslog feed in csv format being ingested by syslog-ng using the csv-parser and written to disk. As I understand it, using the csv-parser is supposed to give syslog-ng context into the data ...