Hot answers tagged

106

You can, as root, write to /dev/kmsg to print to the kernel message buffer: fixnum:~# echo Some message > /dev/kmsg fixnum:~# dmesg | tail -n1 [28078118.692242] Some message I've tested this on my server and an embedded Linux device, and it works on both, so I'm just going to assume it works pretty much everywhere.


67

In the process of writing this question, I answered myself. So I'll answer myself "Jeopardy-style". This expands on the answer provided by Dennis Williamson. The following will send any Cron output to /usr/bin/logger (including stderr, which is converted to stdout using 2>&1), which will send to syslog, with a 'tag' of nsca_check_disk. Syslog handles ...


48

Basically, they are all the same, in the way they all permit the logging of data from different types of systems in a central repository. But they are three different project, each project trying to improve the previous one with more reliability and functionalities. The Syslog project was the very first project. It started in 1980. It is the root project ...


39

Overall, the available documentation for Logwatch lacks adequate explanation and is often far too vague. I pieced together some useful examples, and have reduced the Logwatch noise by over 95%. Here's what I have found. Keep in mind that you can find some Logwatch documentation at /usr/share/doc/logwatch-*/HOWTO-Customize-LogWatch, and it contains a few ...


31

these are 3 different kind of log managers : it enables your system to collect filter, and transmit/store logs. Syslog (daemon also named sysklogd) is the default LM in common Linux distributions. Light but not very flexible, you can redirect log flux sorted by facility and severity to files and over network (TCP, UDP). rsyslog is an "advanced" version of ...


28

This is a tricksy one, and it's actually a bug in rsyslog, specifically RepeatedMsgReduction On, and a change in behaviour with the version released with Trusty (compared to earlier versions) See http://bugzilla.adiscon.com/show_bug.cgi?id=527 for the gory details. In short, turn off RepeatedMsgReduction on Trusty (i.e. sudo sed -i -r 's/^\$...


24

A couple of things for you to try: Did you enable logging of debug messages in syslog? cp /etc/syslog.conf /etc/syslog.conf.original vi /etc/syslog.conf Add the following line: *.debug /var/log/debug.log Exit with :wq!. touch /var/log/debug.log service syslog restart You can enable debugging for all modules like so: touch /etc/pam_debug OR you ...


21

I figured the exact issue has been encountered by other Debian users (http://forums.debian.net/viewtopic.php?f=5&t=104049). To restore logging, one just needs to reinstall a syslog daemon (similar to the one that had been removed during upgrade), for example: apt-get install inetutils-syslogd


19

I've not used if like that (or syslogtag) but I have used :<blah>,<condition> ... (in particular :msg, contains,...) but try :syslogtag, isequal, "giomanager:" /var/log/giomanager.log & stop The & stop (Or, & ~ in rsyslog v6 and older (Such as on RHEL6)) causes the matched message to be discarded after logging otherwise it will be ...


19

Very tricky. :-) And here is the trick answer: Notice the file in /etc/rsyslog.d It says to log haproxy into /var/log/haproxy.log But this will not take effect without restarting rsyslog: service rsyslog restart


18

Control repeat message filtering using $RepeatedMsgReduction in /etc/rsyslog.conf (it's on by default on Ubuntu systems): # Filter duplicated messages $RepeatedMsgReduction on More details: http://www.rsyslog.com/doc/rsconf1_repeatedmsgreduction.html


14

From Forwarding to More than One Server; What is important to know, however, is that the full set of directives make up an action. So you can not simply add (just) a second forwarding rule, but need to duplicate the rule configuration as well. Be careful that you use different queue file names for the second action, else you will mess up your system. ...


13

The most secure and correct method is to use the audispd syslog plugin and/or audisp-remote. To quickly get it working you can edit /etc/audisp/plugins.d/syslog.conf. RHEL includes this by default, though it is disabled. You need only change one line to enable it, active = yes. active = yes direction = out path = builtin_syslog type = builtin args = ...


13

You've already rejected "other people's bash scripts", but this is a pretty common solution -- some creative use of the logger command can follow a file and send its contents elsewhere. I personally wouldn't do this in a production environment though. A better option which requires less scripting hackery is using rsyslogd and the text file input module like ...


12

Log the application name in your messages. Filter on the application name instead of facility. If your applications aren't generating syslog messages directly, you can apply an output filter (e.g., sed) to massage things to look the way you want. Take a look at the Rsyslog documentation on filter conditions to see how you might configure this behavior. ...


11

Well, after almost a day of hair pulling, I finally understand a) how to do it and b) a misconception I have about sec. In reading the sec man page and it describes desc= as essentially showing the match. So in my mind, that meant it should show whatever was matched in pattern. Well, yes, that is true, in this case the match in that pattern is the; hostname,...


10

At least on CentOS 6.4, /etc/pam_debug is NOT used. If the pam_warn.so module is installed, you can get some logging output this way: auth required pam_warn.so success required pam_warn.so etc. This module ensures that it will not interfere with the authentication process at any point, but it logs meaningful stuff via syslog. Update After examining the ...


10

Easiest way to see if it recently rebooted is just to type, uptime If you want to check over intentional reboots, then type, lastlog If there is no record of a deliberate reboot or power button press, yet it had restarted, you'll have to begin a standard diagnostic procedure to find out why it restarted. Start by looking ar server graphs for memory over ...


10

What you're seeing is a stack trace. It's an un-handled error from the kernel showing the path of execution when something goes so damn wrong that there's nothing else in place to do except log the problem and leave it for a human to figure out. The call at the head is usually the defining one: WARNING: at /build/buildd-linux-2.6_2.6.32-45-amd64-FcX7RM/...


10

UFW configuration option only toggles logging on/off (and alternatively specifies custom logging level): logging on|off|LEVEL toggle logging. Logged packets use the LOG_KERN syslog facility. Systems configured for rsyslog support may also log to /var/log/ufw.log. Specifying a LEVEL turns logging on for the specified LEVEL....


9

From looking at the source of the 'at' program (from the CentOS 5.3 source repository) , it looks like it is indeed logging to syslog, but only fatal errors regarding the at daemon itself are logged (for example, if you try to run 2 at daemons at the same time). However, process executions, resulting return code and standard error/output are not logged to ...


9

If this is an app you're writing or at least can influence, then use syslog and consider having the facility you log under configurable, this way an admin can choose to log to one of the standard facilities, or use one of the local facilities (i.e, those that are local0 thru' local9) which, through the magic of syslog.conf, can be sent to a different file (...


9

The default haproxy.conf file provides clear instructions under the Global settings - global. Here i am copy pasting it for you - #--------------------------------------------------------------------- # Global settings #--------------------------------------------------------------------- global # to have these messages end up in /var/log/haproxy.log ...


9

From where can I get the source code for syslog() This is provided by glibc or the libc implementations on other Unix flavors. This call basically submits your message to the syslog unix domain socket /dev/log. This socket is normally created by the system logger (e.g. rsyslog, syslog-ng, nxlog, etc).


8

Change /etc/default/cron # Or, to log standard messages, plus jobs with exit status != 0: # EXTRA_OPTS='-L 5' # # For quick reference, the currently available log levels are: # 0 no logging (errors are logged regardless) # 1 log start of jobs # 2 log end of jobs # 4 log jobs with exit status != 0 # 8 log the process ...


8

Configure /etc/rsyslog.conf to preserve the FQDN: $PreserveFQDN on


8

The only thing you need in rsyslog.conf to forward to a remote IP address is *.* @@192.0.2.25:514; Regarding your other question... I tried executing logger -p cron.info TEST on the client machine and found nothing is added to /var/log/cron! Be sure you restart rsyslogd after changing the configuration; you also need to be sure that /var/log/cron ...


8

For syslog-ng it's slightly different than regular syslog: You need to add cron to the filter associated with /var/log/syslog. In /etc/syslog-ng/syslog-ng.conf, replace this: filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); }; with: filter f_syslog3 { not facility(cron, auth, authpriv, mail) and not filter(f_debug); }; and ...


8

Your original question has been answered by NickW above, but in case it's helpful to you the next time something like this happens, here's a quick way to tell for yourself. The last bit of that log line says "PROTO=UDP SPT=68 DPT=67". This means that the packet denied by the firewall was a UDP packet, whose source port is 68, and whose destination is port ...


8

This can be achieved by commenting out the following line in /etc/rsyslog.conf as the comment suggests: # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat Log format now looks like this: 2014-04-29T20:41:36.366613+01:00 hostname msg


Only top voted, non community-wiki answers of a minimum length are eligible