Questions tagged [syslog]
Syslog is a standard for computer data logging. It separates the software that generates messages from the system that stores them and the software that reports and analyzes them.
144
questions
1
vote
1
answer
588
views
Rsyslog only log snort and dns
I'm currently running Graylog to receive logs from my Pi-Hole and Snort instance.
However, rsyslog is sending all logs e.g. java, sudo etc as well.
How do I configure Rsyslog to only log Snort ...
1
vote
1
answer
440
views
Prevent program from writing to journal
I'm using openconnect with some VPN's, and after a while I see that the journald and syslog are using a lot of resources. The vpn's still work perfectly, but the computer gets really slow. After ...
1
vote
1
answer
773
views
List of all the syslog messages?
I want to be able to filter for specific entries in the Syslog on my Linux computer. For instance, I'd like to be able to filter for user authentication failure or success, or for access to sensitive ...
0
votes
1
answer
6k
views
syslog : How can I filter syslog messages on windows 10?
I would like to how I can filter syslog messages to get only the ones I am interested in on Windows 10.
For example I would like to get the syslog message when the identification/authentication of a ...
0
votes
1
answer
369
views
How do I log syslog to virtual console from systemd?
This fails:
$ cat /etc/systemd/system/[email protected]/override.conf
[Service]
ExecStart=
ExecStart=-/usr/bin/tail -f /var/log/syslog
Aug 2 11:28:22 darts02 tail[317]: Aug 2 11:28:18 darts02 ...
1
vote
1
answer
3k
views
The log files are empty
I found out that my /var/log/messages is empty!
Also my /var/log/auth.log is also empty!
Also it is not logging any messages.
My /etc/rsyslog.conf file is as follows:
# /etc/rsyslog.conf ...
0
votes
0
answers
712
views
How to find the client IP/name from the audit logs
I'm auditing the files in a nfs share. When I look at the audit logs using the command ausearch -f /var/nfs/general , I get some logs that looks like this:
In the server side:
time->Tue Jun 12 16:...
1
vote
0
answers
2k
views
Rsyslog logging into /var/log/messages instead of custom file
I have multiple perl daemons processes writing into a specific log file. In /etc/rsyslog.conf following is configuration -
$ModLoad imuxsock
$ModLoad imjournal
$OmitLocalLogging off
*....
3
votes
1
answer
4k
views
OSX High Sierra wake reason syslog location?
I'm running OSX 10.13.3. I understand that if I run the following command in terminal I will get the wake reason for my machine.
log show --style syslog | fgrep "Wake reason"
Currently when I run ...
0
votes
2
answers
61
views
Watch (rotating) log in screen
I'm running a mailserver which I connect to using SSH. My .bash_profile is configured to attatch a SSH session to a certain screen session.
Now I'd like to have a log (e.g. the syslog) printed to one ...
2
votes
0
answers
531
views
MacOS - How to change syslogd's log level for a specific process/program?
I am new to MacOS and I would like to get a better of view of what's going on with a system process when my computer is starting up. I can see in the log that a process is changing settings, but the ...
0
votes
0
answers
86
views
Reliably tail/stream a log file to another machine (Keyword: Reliably). Strangely impossible?
I have a growing logfile on a unix box. I just want something that collects that data on another box within a few seconds of it being written.
Sounds simple. But I need it to not introduce screw ups ...
2
votes
1
answer
2k
views
Send specific rsyslog facility to remote server and not local
I have a rsyslog facility (local1) that is used by one application only, and I would like to send the logs from that to a remote server but not to the local machine. I've managed to find the info in ...
1
vote
0
answers
715
views
Measure EPS (Events per Seconds)
I want to measure the EPS metric, or the number of processed events per seconds in my device.
I read that the most accurate measurement of EPS is to use a simple syslog server, such as Kiwi Syslog ...
6
votes
1
answer
12k
views
Why does `& ~` mean "discard the messages that were matched in the previous line"?
In the webpage iptables log
Create /etc/rsyslog.d/iptables.conf with the following contents:
:msg, startswith, "iptables: " -/var/log/iptables.log
& ~
The second line means discard ...
9
votes
1
answer
19k
views
rsyslog changing file owner
I'm trying to change the owner and group of a log to a different user than what is is rsyslog.conf, which has:
#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$...
2
votes
1
answer
11k
views
How to disable syslog messaging to /var/log/syslog
I'm working on a centralized logging solution using the ELK stack and Kafka.
I'm running Ubuntu Xenial on all the machines, and I'm using Rsyslog with omkafka to write all log messages to a kafka ...
9
votes
1
answer
36k
views
Simple way to generate syslog over TCP?
I want to troubleshoot logstash server issue and need to generate syslog message from time to time. Is there a simple way that allows me to connect to a syslog server using TCP and send some arbitrary ...
1
vote
1
answer
1k
views
Debian Jessie with systemd: bloated log files are never deleted
I have a fairly stock, minimal Debian Jessie distro on which log files under /var/log are being rotated (seemingly arbitrarily) but never deleted:
$ sudo du -sk /var/log/* | sort -rn
4167364 /var/log/...
1
vote
1
answer
1k
views
how to configure Mac OS X Sierra for syslog or unified log forwarding
I am trying to perform syslog forwarding. But after launching plist like this:
launchctl unload/System/Library/LaunchDaemons/com.apple.syslogd.plist
I get this error:
/System/Library/...
4
votes
1
answer
2k
views
How to send log entries to a remote server running journald (systemd)
I have an iot module running a firmware that has the capability of sending the logs to a remote syslog host. I've already configured it to send the entries to an Ubuntu Server running rsyslog.
I'd ...
0
votes
1
answer
7k
views
rsyslogd: how can you use $ModLoad imfile more than once?
I am testing out Loggly.com, which uses rsyslogd to collect log entries. Loggly provides scripts that generate config files. Each config file starts with $ModLoad imfile, however this seems to only ...
5
votes
1
answer
7k
views
Running OSX as a syslog server
I want to receive the logs from my router (an ASUS RT68U) on my laptop (OSX 10.9). It supports syslog and OSX has ASL (a superset of syslog, apparently). I've followed the instructions in OS X Lion as ...
0
votes
1
answer
348
views
php7 - prevent errors being broadcast
On Centos7 With PHP 7 configured to send errors to syslog, parse errors get broadcast to wall e.g. logged in users see messages like this:
Broadcast message from systemd-journald@xxxxxxxxxx (Fri 2017-...
2
votes
1
answer
6k
views
Disable rsyslog remote server 's console messages [duplicate]
My console is been flooded with rsyslog messages. These are messages that come from a remote server:
Message from syslogd@MSAN-RSPAE_O1A0F at Mar 3 11:07:13 ...
rOT1[291]: 17/03/03 11:07:13 ...
1
vote
0
answers
343
views
How can I get exact same log file name in Rsyslog v-8
Previously I was using Rsyslog v-7.14 and having the template:
$template UDP-Logging, "/var/log/RemoteLogs/%HOSTNAME%/UDP-%PROGRAME%-%$now%.log"
if $fromhost-ip ! '127.0.0.1' then -?UDP-Logging
&...
1
vote
1
answer
673
views
How to disable RC4 cipher when using Syslog-NG 3.5 as Syslog Server over TCP/TLS?
Syslog-ng 3.5.6 is the latest version currently offered by Debian stable (jessie).
I'm not sure how to blacklist ciphers with this version.
Newer versions of Syslog-ng seem to offer a more ...
0
votes
1
answer
2k
views
incorrect encoding of rsyslog output
I'm running a rsyslog service in a docker container.
Its configuration(rsyslog.conf) looks like below,
module(load="imuxsock") # local system logging support (e.g. via
logger command)
...
-1
votes
1
answer
88
views
Linux RedHat - Logging await
How can I create an await log for the devices /dev/emcpower*1.
The log should be in the pattern of:
Aug 23 10:00:11 /dev/emcpowera1 2.96
Aug 23 10:00:11 /dev/emcpowerb1 2.91
Aug 23 10:00:13 /dev/...
0
votes
1
answer
1k
views
Log file location based on hostname with syslog-ng
I'm using syslog-ng for a big amount of servers. To get everything more in shape in the folder structure, I use several filters with regex and multiple destination and log lines in the syslog-ng.conf
...
0
votes
1
answer
867
views
rsyslog exclude logs based on hostname
We have our rsyslog server set up to forward messages to our Splunk box. However we want to cut through some of the noise so we have set up specific programs to disregard. So basically if logs are ...
2
votes
1
answer
2k
views
How do I stop Tomcat / rsyslog from logging to console?
At my work someone once setup Tomcat to log to syslog. The problem is that these messages also get sent to the console.
The system is RHEL6, these are the involved RPM's
rsyslog-5.8.10-10.el6_6....
1
vote
1
answer
10k
views
Missing /var/log/messages file in CentOS 6.8
I'm not sure what I'm doing wrong, but my Linux box doesn't seem to be logging any info to the /var/log/messages file.
I've also checked and the kernel isn't logging anything either.
My syslog ...
1
vote
0
answers
744
views
rsyslogd: How to prevent logging in the /var/kern.log file and redirecting to another file?
I am trying to redirect iptables log to another file.
Based upon my reading on the net, I did the following:
In my iptables rule, I have rules like:
iptables -A INPUT -s ... -j LOG --log-prefix "...
0
votes
1
answer
762
views
Error in the rsyslog.conf file, how to log more than one device?
I am trying to log my dd-wrt router and my nas4free device.
All logs are sent to a spare raspberrypi with a usb disk connected to to store the log files.
But there is a problem with my rsyslog.conf ...
4
votes
2
answers
43k
views
Rsyslog: how to separate incoming logs with IP addresses
I am trying to setup an Rsyslog with the following configuration:
I listen to the 514 port to receive data from different hosts: 172.16.111.222, 172.16.111.111 and 172.16.222.111. And I want to store ...
0
votes
0
answers
33
views
Is there a general solution to delivering bytes to a destination with reliability and buffering configuration?
I have some application events.
I want these events to be delivered to a few places: a periodically rotated file (in proprietary TSV format in my case), a message bus (Kafka in my case), for archival ...
1
vote
0
answers
2k
views
ISC DHCP Spamming /var/log/messages
I recently setup a Linux box to run a DHCP server. One of the prerequisites was to get all of its log messages onto a specific file outside of the /var/log folder. For that purpose, I inserted the ...
1
vote
1
answer
5k
views
Setup for rsyslog to log from two network devices
I have 2 VOIP devices on my network (ht502 and ht704) which are both capable of sending their log info as syslog data. Receiver is a little Raspberry on Raspbian.
I wanted to configure syslog to ...
1
vote
1
answer
749
views
Debian Jessie shutting down too fast (<1 second)
I recently have bought an SSD for my laptop and installed fresh Debian Jessie on it (I used Wheezy before). As a result, most operations on the laptop have sped up, and one operation in particular ...
1
vote
1
answer
2k
views
Snort installed on Ubuntu not sending alerts to syslog
I have a Magento website setup on a Linux machine that is based on a Bitnami ready-made image.
The main goal is to be notified by email whenever there might be a potential attack on the site.
My ...
1
vote
1
answer
2k
views
How can I use Pacemaker to setup a virtual IP for receiving syslog messages?
I need to setup a VIP / floating IP that network devices will send their syslog messages to. The idea behind the VIP is to have a highly available setup in an attempt to minimize the amount of logs ...
1
vote
1
answer
840
views
Centralized and local syslog
Right now I have my clients send any syslog messages to my centralized syslog server. However, if that server went down, I would be unable to capture any logs. Is there an option to have syslog write ...
1
vote
0
answers
659
views
boot.log created with permissions 644 instead of 600
My rsyslog.conf file has this line in it.
#### GLOBAL DIRECTIVES ####
$FileCreateMode 0600
I also have
$FileCreateMode 0600
local7.* /var/log/boot.log
Yet after every reboot the file permissions ...
0
votes
2
answers
608
views
How to get Syslog Referer URL
I have two urls one.example.com and two.example.com, is there a way in the syslog conf of capturing which URL was used to hit the server?
I need to modify a database filed based on this information.
...
0
votes
2
answers
3k
views
What does it mean when a kernel terminates a process with status 131?
I am trying to debug an issue where a redis-server process died, and in the syslog I see:
Mar 9 23:56:44 ip-10-236-158-228 kernel: [25188369.962457] init: redis1-server main process (2822) ...
0
votes
0
answers
122
views
rsyslog loses messages from firewall
I am trying to make rsyslog to log messages from iptables MASQUERADE. I have iptables LOG rule in nat table and PREROUTING chain before the MASQUERADE rules.
The actual iptables rules:
iptables -t ...
1
vote
1
answer
994
views
Millisecond precision in syslogd on OS X
When I log messages to syslog in OS X (10.10.1), it truncates the timestamp to the second. If I log to a file, for example, I am able to capture milliseconds. Milliseconds matter when logs are coming ...
0
votes
1
answer
2k
views
Catching malware and demonstrate it through windows logs
I need to catch a virus/malware on purpose on a VM and demonstrate the infection through windows logs analysis. I am using both syslog and eventlog analyzer, but no sign of events logged. I caught on ...
0
votes
1
answer
397
views
File monitoring using syslog
Can rsyslog, syslog-ng programs monitor change of file? I want to monitor files and receive the changes made to the file by syslog on server. Thank you.