Questions tagged [syslog]

Syslog is a standard for computer data logging. It separates the software that generates messages from the system that stores them and the software that reports and analyzes them.

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

Why does netcat -v send extra X packets?

I'm using netcat 1.218 on Ubuntu 22.04 to generate test syslog packets, and I noticed an odd behavior I can't explain. When I use the -v flag, netcat sends 2 additional packets containing the letter ...
Elliott B's user avatar
  • 1,195
0 votes
0 answers
42 views

Explanation for log source sending truncated syslog

I'm attempting to send syslog from an authentication platform to a syslog server. The Authentication platform can only be configured to send syslog on UDP/514. The log source is sending the events in ...
JaReg's user avatar
  • 13
0 votes
1 answer
75 views

Thousands of network messages in systemlog

Our Ubuntu server kernel log is being spammed by the following messages: Feb 5 12:08:32 Server kernel: [2071471.605255] BANDWIDTH_OUT:IN= OUT=eno1 SRC=192.168.48.2 DST=192.168.48.139 LEN=312 TOS=0x10 ...
Paul Sommer's user avatar
0 votes
0 answers
279 views

How to configure rsyslog to use the imfile module?

I have Red Hat 9.2 with rsyslog v8.2102.0-113.el9_2.1. I use default /etc/rsyslog.conf and a custom configuration called vums.conf located in /etc/rsyslog.d/. module(load="imfile") input(...
Ondřej Žižka's user avatar
0 votes
0 answers
273 views

/var/log consistently cleared on Ubuntu 22.04

On Ubuntu 22.04, /var/log is consistently cleared when log files should be present. rsyslog is installed and running. Restarting rsyslog shows files being created again in /var/log (such as auth.log, ...
domtor's user avatar
  • 1
2 votes
0 answers
162 views

Log file name based on application with syslog-ng

I'm using syslog-ng and currently my config only separates log files based on ip address and facility: source s_network_udp { syslog(transport(udp) port(514)); }; destination d_local { file("...
user9503's user avatar
0 votes
0 answers
281 views

How to Forward /var/log/yum.log to Remote Logging Server using rsyslog.conf?

Gents, I am trying to find a way to forward /var/log/yum.log towards Remote Logging Server using rsyslog.conf in my RHEL7. But Not happening. I have tried this approach but no luck - $InputFileName /...
Umang's user avatar
  • 69
2 votes
0 answers
44 views

SFTP user login details real-time filtering

I have enabled the SFTP login log into the default logfile /var/log/syslog and tried to filter the login time of each user and insert it into the database. But the filtering is not worked as I ...
Amal P Ramesh's user avatar
1 vote
1 answer
148 views

rSyslog stopped sending only SOME data

I have configured a remote logging from one of my servers to the central log server via rsyslog TCP/SSL Everything worked fine until yesterday where most of the files just stop being transmitted while ...
Mr.P's user avatar
  • 153
0 votes
0 answers
430 views

xinetd and rsyslog service never start in docker (from ubuntu 22.04 on RHEL9)

I need to deploy a service designed to run on Ubuntu (or another distribution with the same base) on an RHEL9 server. I thought that the best solution was to deploy it in docker. So I created a docker ...
Mathieu Vedie's user avatar
0 votes
0 answers
194 views

upgrading to bookworm sid, by forcing me to overwrite a lot of so links and config files, problems arised with glib and other programs in syslog

My syslog is full of such messages reaching gigas. What to do? I try to trunctuate logs. I know about logrotation. These bugs happened after upgrading to bookworm sid debian. I installed 2.7.6.1 glib ...
Estatistics's user avatar
1 vote
1 answer
335 views

REDHAT machine + rsyslogd eating up 10+ GB

we notice about this problem recently we found that rsyslog service is eating memory and some times its up to 10G we have different kind of redhat machines as version 7.6 and 7.9 is it possible to ...
King David's user avatar
1 vote
0 answers
283 views

net.core.netdev_max_backlog - what's the impact when set too HIGH?

I'm working on optimizing and right-sizing my EC2 syslog-ng servers and have some carryover settings in our ansible playbook for kernel settings that were used on "in-house" data center ...
jasonr's user avatar
  • 11
1 vote
1 answer
7k views

Rsyslog forward logs cannot connect Permission Denied

Have configured Rsyslog to ship logs to a remote location through an SSH tunnel. However rsyslog complains with "Permission denied": rsyslogd[28412]: cannot connect to 127.0.0.1:10601: ...
sastorsl's user avatar
  • 171
1 vote
2 answers
491 views

Rsyslog: relay messages from UDP input only

Considering a docker container which receives logs on UDP and forwards to a central logging server using TLS, I was wondering if I could be satisfied with one queue or if I needed several. Indeed, ...
Ashlanfox's user avatar
0 votes
1 answer
1k views

Changing security levels of Fortigate logs?

Tech newbie here. I want to send Fortigate logs to a syslog server. Previously, I was receiving way too many unnecessary firewall logs, 90% of them with a security level of "notice." I have ...
user avatar
1 vote
1 answer
390 views

Why would vsftpd be logging to syslog even though logging is disabled in vsftpd?

I have all logging disabled in /etc/vsftpd but for some reason it is still logging to /var/log/syslog and I can't figure out why. root@unraid:/etc# cat /etc/vsftpd.conf # vsftpd.conf for unRAID # ...
IMTheNachoMan's user avatar
1 vote
1 answer
2k views

Rsyslog logs readable by all users

I have an rsyslog instance in a RHEL8 linux server that is used to collect logs from other systems. That works fine, and it stores all the logs in the /var/log directory with following format /var/log/...
Hamperfait's user avatar
0 votes
1 answer
617 views

filebeat works from file but not from syslog with checkpoint module

I'm trying send CheckPoint Firewall logs to Elasticsearch 8.0. I have machine A 192.168.1.123 running Rsyslog receiving logs on port 514 that logs to a file and machine B 192.168.1.234 running ...
mfloris's user avatar
  • 261
0 votes
0 answers
281 views

Configuring rsyslog output format strings

I'm setting up rsyslog for an application and using the following configuration: $FileCreateMode 0644 if $programname == 'proxy' then /var/log/proxy/log & stop This generates log entries like the ...
eof's user avatar
  • 101
0 votes
1 answer
95 views

"-" symbol into rsyslog.conf file

I see into my "rsyslog.conf" a "-" symbol before the path, what is it? Example: mail.info -/var/log/mail.info mail.err /var/log/mail/err Thank's
CH06's user avatar
  • 1
0 votes
1 answer
44 views

Regex char class - more elegant solution

I have two barracuda FWs with different log structure and a Logstash grok filter plugin that needs to parse them. values only log entry +02:00 Info blabla Detect: FWD|TCP|bond0.777|1.1.1.1|53329|...
lord_sommersby's user avatar
0 votes
1 answer
6k views

Getting logger to log to rsyslog in alpine

I installed rsyslog on my Alpine-based system to replace busybox syslogd. After completely disabling syslogd in openrc, enabling ryslog at boot and rebooting, all services correctly started logging to ...
Johannes H.'s user avatar
1 vote
1 answer
569 views

gnome-shell spamming on /var/log/syslog

Moved from https://stackoverflow.com/questions/66061925/gnome-shell-spamming-on-var-log-syslog because it was closed there without a solution; and it's also currently happening to me (I am running ...
Kind Contributor's user avatar
1 vote
1 answer
430 views

Logs missing and empty message when forwarding syslog from macOS

I have tried the syslog forwarding configuration as mentioned in splunk document, But on the syslog server I not getting all logs generated in macOS and also there is no Syslog content (message) in ...
User G's user avatar
  • 11
2 votes
0 answers
347 views

Rsyslog fills up disk - unexpected behaviour

I have a rsyslog that forwards messages to elasticsearch. It worked well for over a year but recently the disk starts to fill mysteriously until it reaches 100%. When I restart the process the disk ...
Root -'s user avatar
  • 121
0 votes
1 answer
534 views

SYSLOG-NG: Sending same log to two different index in elasticsearch

I'm trying to send the same log flow to two different elasticsearch indexes, because of users with different roles each index. I use a file for destination too. Here is a sample: 2021-02-12T14:00:00+...
Nand0san's user avatar
  • 101
1 vote
0 answers
548 views

How to disable logging from a given module on linux (Ubuntu)?

I have some issue on my Ubuntu 20.4 system where the mceusb module is filling up the kern.log and syslog file with messages like: mceusb 2-2:1.0: Error: urb status = -71/d This completely filled up ...
Vik's user avatar
  • 111
0 votes
1 answer
535 views

Testing syslog-ng on CentOS 8

I am relatively new to Linux and networking but was tasked with the following at work: I built up a CentOS VM machine ( using VirtualBox) on which I had to install Splunk Heavy Forwarder and syslog-ng....
lord_sommersby's user avatar
1 vote
1 answer
1k views

understanding syslog logs format

Im geting syslogs from multiple servers, and Im having trouble to understand some syslog logs, here is one example <189>12593340: 16596512: Jul 6 20:31:09: %PARSER-5-CFGLOG_LOGGEDCMD: User:...
JhonDoe's user avatar
  • 35
6 votes
1 answer
3k views

How to get SSH logs and send to remote syslog server in macOS?

On Linux, I can get sshd logs such as: sshd Accepted publickey for user from xxx.xxx.xxx.xxx port xxx ssh2: RSA SHA256:..... and send them to a remote syslog server by adding a file in /etc/rsyslog.d/...
weiyin's user avatar
  • 251
1 vote
1 answer
5k views

How can I get my Cygwin SSH server to log into a file?

On proper Linux systems, the SSH server typically logs into a file, e.g. /var/log/auth.log or /var/log/syslog etc. But - that doesn't exist on my Cygwin system; and merely editing /etc/sshd_config ...
einpoklum's user avatar
  • 9,393
0 votes
0 answers
802 views

How to get syslog in common event format (CEF)?

I want /var/log/syslog in common event format(CEF). Is there any way to convert a syslog into CEF?
Utsav Patel's user avatar
0 votes
1 answer
64 views

configure dockerd to log userid or username of the user who is launching the container

I updated docker daemon config to enable debug mode for dockerd daemon on Linux. And also using rsyslog I managed to create a separate debug log file. Now I want to log the userid/name of the user ...
naresh chilukurthi's user avatar
0 votes
1 answer
99 views

How to save syslog severity <132> to a different file?

We have an old appliance that sends syslog with severity <132> to its management server. To capture said events the previous team created a tcpdump script and ran it via crontab to capture the ...
sarvesh.lad's user avatar
0 votes
1 answer
55 views

Have "individual" logging instead of logging everything to "journalctl" on CentOS 7

On my CentOS 7 system, no output are written to the well known log files and I'm forced to use journalctl to view anything that happening. For example, there is no data in /var/log/messages, nor /var/...
Eugene van der Merwe's user avatar
0 votes
1 answer
503 views

Rsyslog filtering messages based on time

I want to filter logs so that only messages from 13:00-14:00 can go through, how can I do that? I know I can access message content with $msg, but how can I do that for time?
mikol's user avatar
  • 5
1 vote
1 answer
8k views

How to read from syslog?

I can write to syslog via: logger "foo bar baz" but how do I read from syslog? my only guess is: tail -f /var/log/syslog but that doesn't seem right from my testing. Note: also looking for a way ...
MrCholo's user avatar
1 vote
1 answer
1k views

Usbrip read from external syslog file

I want to examine usb violations with the usbrip tool (usbrip github) but the source log file which i want to read from is not the local system syslog file. Instead i have an external file. When i ...
wh4bb17's user avatar
  • 21
1 vote
1 answer
430 views

syslog-ng starts and runs fine manually... starts but doesnt create logs when using systemd

Redhat 7.6 with latest syslog-ng (3.22) ive searched and tried all the old remedies. Nothing has worked to resolve this. My syslog-ng.conf file has a bunch of ports and a bunch of destinations. When ...
Carver Stone's user avatar
0 votes
1 answer
261 views

How to append host IP address and host MAC addres to every log message?

I have several log agents with iptables logging rules and default rsyslog config. Rsyslog sends the logs to the central server. Iptables rule: iptables -A INPUT -j LOG --log-prefix "INPUT:DROP:" --...
mg3's user avatar
  • 3
0 votes
1 answer
590 views

How to know when Rsyslog has read all lines in a file, and have read 100% of a file

I have to pull log files, static files. Let's imagine I have 100 events (100 lines) in a file. Rsyslog has to forward those logs to a server. Once Rsyslog has read the last line, I want to shutdown ...
Marcel's user avatar
  • 21
1 vote
1 answer
277 views

Debian 9 /var/log/ message, syslog,dmesg are these safe to post to a forum?

On a very stock Debian 9 VPS, running a multiplayer game system with very expensive scripting in it. I am having a problem with that multiplayer server, and one the server developers is asking me to ...
Xabache's user avatar
  • 35
0 votes
0 answers
1k views

Rsyslog won't forward with JSON template

so I'm trying to use rsyslog to accept udp traffic on port 514, apply a json template, and then send it out over udp to port 10514 (this is so my logstash installation can pick it up). I'm running ...
johnbchron's user avatar
0 votes
1 answer
75 views

Using Syslog-kafka got some python syntax erro

I need to send message to my kafka cluster, I do the same like this https://syslogng-kafka.readthedocs.io/en/latest/installation.html , and /etc/syslog-ng/conf.d/kafka.conf like destination ...
user10570334's user avatar
1 vote
1 answer
2k views

Forward logs via rsyslog to Datadog without agents?

I'm trying to forward my container logs ( apache2 access.log on Febian container) to datadog but it didn't work. I followed this [tutorial][1]. This is rsyslog.conf file: # /etc/rsyslog.conf ...
auau's user avatar
  • 11
0 votes
1 answer
2k views

How to setup blacklist rule of elastalert

I have syslog messages of following type. I want to capture all such messages which contains "errors" in message field of syslog. <30>Apr 9 04:27:13 ip-172-31-26-235 POSTMETHOD_fx-control-...
James Taylor's user avatar
1 vote
0 answers
533 views

Log correlation with syslog-ng patterndb

I'm trying to play with syslog-ng and patterndb and I am having trouble with log correlation. The documentation on how to do it is here : https://www.syslog-ng.com/technical-documents/doc/syslog-ng-...
Logger_444's user avatar
1 vote
1 answer
629 views

How to convert rsyslog octal codes to ascii

Rsyslog by default uses octal codes to encode control codes and whitespace: #012 for newline, #011 for tab A Google search only turned up results on how to convert octal codes using the standard \012 ...
IanB's user avatar
  • 687
0 votes
0 answers
63 views

Linux log grows large, resets, does it again

Am running Ubuntu 18 and don't have a ton on their for apps. The hardware is setup with one 120gb SSD as root/boot and the rest of the drives as 2 pair of raid drives where media files, etc... reside. ...
Mark's user avatar
  • 113