Questions tagged [syslog]

Syslog is a standard for computer data logging. It separates the software that generates messages from the system that stores them and the software that reports and analyzes them.

Filter by
Sorted by
Tagged with
1 vote
1 answer
588 views

Rsyslog only log snort and dns

I'm currently running Graylog to receive logs from my Pi-Hole and Snort instance. However, rsyslog is sending all logs e.g. java, sudo etc as well. How do I configure Rsyslog to only log Snort ...
Jackie's user avatar
  • 11
1 vote
1 answer
440 views

Prevent program from writing to journal

I'm using openconnect with some VPN's, and after a while I see that the journald and syslog are using a lot of resources. The vpn's still work perfectly, but the computer gets really slow. After ...
user134167's user avatar
1 vote
1 answer
773 views

List of all the syslog messages?

I want to be able to filter for specific entries in the Syslog on my Linux computer. For instance, I'd like to be able to filter for user authentication failure or success, or for access to sensitive ...
M.Brbr's user avatar
  • 149
0 votes
1 answer
6k views

syslog : How can I filter syslog messages on windows 10?

I would like to how I can filter syslog messages to get only the ones I am interested in on Windows 10. For example I would like to get the syslog message when the identification/authentication of a ...
M.Brbr's user avatar
  • 149
0 votes
1 answer
369 views

How do I log syslog to virtual console from systemd?

This fails: $ cat /etc/systemd/system/[email protected]/override.conf [Service] ExecStart= ExecStart=-/usr/bin/tail -f /var/log/syslog Aug 2 11:28:22 darts02 tail[317]: Aug 2 11:28:18 darts02 ...
JPT's user avatar
  • 200
1 vote
1 answer
3k views

The log files are empty

I found out that my /var/log/messages is empty! Also my /var/log/auth.log is also empty! Also it is not logging any messages. My /etc/rsyslog.conf file is as follows: # /etc/rsyslog.conf ...
Lublaut's user avatar
  • 181
0 votes
0 answers
712 views

How to find the client IP/name from the audit logs

I'm auditing the files in a nfs share. When I look at the audit logs using the command ausearch -f /var/nfs/general , I get some logs that looks like this: In the server side: time->Tue Jun 12 16:...
Lublaut's user avatar
  • 181
1 vote
0 answers
2k views

Rsyslog logging into /var/log/messages instead of custom file

I have multiple perl daemons processes writing into a specific log file. In /etc/rsyslog.conf following is configuration - $ModLoad imuxsock $ModLoad imjournal $OmitLocalLogging off *....
Pawan Rao's user avatar
3 votes
1 answer
4k views

OSX High Sierra wake reason syslog location?

I'm running OSX 10.13.3. I understand that if I run the following command in terminal I will get the wake reason for my machine. log show --style syslog | fgrep "Wake reason" Currently when I run ...
cc970's user avatar
  • 61
0 votes
2 answers
61 views

Watch (rotating) log in screen

I'm running a mailserver which I connect to using SSH. My .bash_profile is configured to attatch a SSH session to a certain screen session. Now I'd like to have a log (e.g. the syslog) printed to one ...
tr01's user avatar
  • 153
2 votes
0 answers
531 views

MacOS - How to change syslogd's log level for a specific process/program?

I am new to MacOS and I would like to get a better of view of what's going on with a system process when my computer is starting up. I can see in the log that a process is changing settings, but the ...
Cathy A. Brink's user avatar
0 votes
0 answers
86 views

Reliably tail/stream a log file to another machine (Keyword: Reliably). Strangely impossible?

I have a growing logfile on a unix box. I just want something that collects that data on another box within a few seconds of it being written. Sounds simple. But I need it to not introduce screw ups ...
declanw's user avatar
2 votes
1 answer
2k views

Send specific rsyslog facility to remote server and not local

I have a rsyslog facility (local1) that is used by one application only, and I would like to send the logs from that to a remote server but not to the local machine. I've managed to find the info in ...
spookypeanut's user avatar
1 vote
0 answers
715 views

Measure EPS (Events per Seconds)

I want to measure the EPS metric, or the number of processed events per seconds in my device. I read that the most accurate measurement of EPS is to use a simple syslog server, such as Kiwi Syslog ...
U. User's user avatar
  • 111
6 votes
1 answer
12k views

Why does `& ~` mean "discard the messages that were matched in the previous line"?

In the webpage iptables log Create /etc/rsyslog.d/iptables.conf with the following contents: :msg, startswith, "iptables: " -/var/log/iptables.log & ~ The second line means discard ...
scrapy's user avatar
  • 163
9 votes
1 answer
19k views

rsyslog changing file owner

I'm trying to change the owner and group of a log to a different user than what is is rsyslog.conf, which has: # # Set the default permissions for all log files. # $FileOwner syslog $FileGroup adm $...
Andy's user avatar
  • 91
2 votes
1 answer
11k views

How to disable syslog messaging to /var/log/syslog

I'm working on a centralized logging solution using the ELK stack and Kafka. I'm running Ubuntu Xenial on all the machines, and I'm using Rsyslog with omkafka to write all log messages to a kafka ...
John Blackberry's user avatar
9 votes
1 answer
36k views

Simple way to generate syslog over TCP?

I want to troubleshoot logstash server issue and need to generate syslog message from time to time. Is there a simple way that allows me to connect to a syslog server using TCP and send some arbitrary ...
some user's user avatar
  • 2,377
1 vote
1 answer
1k views

Debian Jessie with systemd: bloated log files are never deleted

I have a fairly stock, minimal Debian Jessie distro on which log files under /var/log are being rotated (seemingly arbitrarily) but never deleted: $ sudo du -sk /var/log/* | sort -rn 4167364 /var/log/...
Thom Nichols's user avatar
1 vote
1 answer
1k views

how to configure Mac OS X Sierra for syslog or unified log forwarding

I am trying to perform syslog forwarding. But after launching plist like this: launchctl unload/System/Library/LaunchDaemons/com.apple.syslogd.plist I get this error: /System/Library/...
user738597's user avatar
4 votes
1 answer
2k views

How to send log entries to a remote server running journald (systemd)

I have an iot module running a firmware that has the capability of sending the logs to a remote syslog host. I've already configured it to send the entries to an Ubuntu Server running rsyslog. I'd ...
Dario's user avatar
  • 143
0 votes
1 answer
7k views

rsyslogd: how can you use $ModLoad imfile more than once?

I am testing out Loggly.com, which uses rsyslogd to collect log entries. Loggly provides scripts that generate config files. Each config file starts with $ModLoad imfile, however this seems to only ...
Craig Wright's user avatar
5 votes
1 answer
7k views

Running OSX as a syslog server

I want to receive the logs from my router (an ASUS RT68U) on my laptop (OSX 10.9). It supports syslog and OSX has ASL (a superset of syslog, apparently). I've followed the instructions in OS X Lion as ...
ian's user avatar
  • 402
0 votes
1 answer
348 views

php7 - prevent errors being broadcast

On Centos7 With PHP 7 configured to send errors to syslog, parse errors get broadcast to wall e.g. logged in users see messages like this: Broadcast message from systemd-journald@xxxxxxxxxx (Fri 2017-...
IanB's user avatar
  • 687
2 votes
1 answer
6k views

Disable rsyslog remote server 's console messages [duplicate]

My console is been flooded with rsyslog messages. These are messages that come from a remote server: Message from syslogd@MSAN-RSPAE_O1A0F at Mar 3 11:07:13 ... rOT1[291]: 17/03/03 11:07:13 ...
Rodrigo Formighieri's user avatar
1 vote
0 answers
343 views

How can I get exact same log file name in Rsyslog v-8

Previously I was using Rsyslog v-7.14 and having the template: $template UDP-Logging, "/var/log/RemoteLogs/%HOSTNAME%/UDP-%PROGRAME%-%$now%.log" if $fromhost-ip ! '127.0.0.1' then -?UDP-Logging &...
Amarjeet Sharma's user avatar
1 vote
1 answer
673 views

How to disable RC4 cipher when using Syslog-NG 3.5 as Syslog Server over TCP/TLS?

Syslog-ng 3.5.6 is the latest version currently offered by Debian stable (jessie). I'm not sure how to blacklist ciphers with this version. Newer versions of Syslog-ng seem to offer a more ...
PhilippN's user avatar
0 votes
1 answer
2k views

incorrect encoding of rsyslog output

I'm running a rsyslog service in a docker container. Its configuration(rsyslog.conf) looks like below, module(load="imuxsock") # local system logging support (e.g. via logger command) ...
Kane's user avatar
  • 495
-1 votes
1 answer
88 views

Linux RedHat - Logging await

How can I create an await log for the devices /dev/emcpower*1. The log should be in the pattern of: Aug 23 10:00:11 /dev/emcpowera1 2.96 Aug 23 10:00:11 /dev/emcpowerb1 2.91 Aug 23 10:00:13 /dev/...
Oz Bar-Shalom's user avatar
0 votes
1 answer
1k views

Log file location based on hostname with syslog-ng

I'm using syslog-ng for a big amount of servers. To get everything more in shape in the folder structure, I use several filters with regex and multiple destination and log lines in the syslog-ng.conf ...
Marco Sysadmin's user avatar
0 votes
1 answer
867 views

rsyslog exclude logs based on hostname

We have our rsyslog server set up to forward messages to our Splunk box. However we want to cut through some of the noise so we have set up specific programs to disregard. So basically if logs are ...
mcgoosh's user avatar
  • 11
2 votes
1 answer
2k views

How do I stop Tomcat / rsyslog from logging to console?

At my work someone once setup Tomcat to log to syslog. The problem is that these messages also get sent to the console. The system is RHEL6, these are the involved RPM's rsyslog-5.8.10-10.el6_6....
Jacco's user avatar
  • 51
1 vote
1 answer
10k views

Missing /var/log/messages file in CentOS 6.8

I'm not sure what I'm doing wrong, but my Linux box doesn't seem to be logging any info to the /var/log/messages file. I've also checked and the kernel isn't logging anything either. My syslog ...
Tam N.'s user avatar
  • 143
1 vote
0 answers
744 views

rsyslogd: How to prevent logging in the /var/kern.log file and redirecting to another file?

I am trying to redirect iptables log to another file. Based upon my reading on the net, I did the following: In my iptables rule, I have rules like: iptables -A INPUT -s ... -j LOG --log-prefix "...
Sunny's user avatar
  • 369
0 votes
1 answer
762 views

Error in the rsyslog.conf file, how to log more than one device?

I am trying to log my dd-wrt router and my nas4free device. All logs are sent to a spare raspberrypi with a usb disk connected to to store the log files. But there is a problem with my rsyslog.conf ...
maxim's user avatar
  • 116
4 votes
2 answers
43k views

Rsyslog: how to separate incoming logs with IP addresses

I am trying to setup an Rsyslog with the following configuration: I listen to the 514 port to receive data from different hosts: 172.16.111.222, 172.16.111.111 and 172.16.222.111. And I want to store ...
ctaf's user avatar
  • 171
0 votes
0 answers
33 views

Is there a general solution to delivering bytes to a destination with reliability and buffering configuration?

I have some application events. I want these events to be delivered to a few places: a periodically rotated file (in proprietary TSV format in my case), a message bus (Kafka in my case), for archival ...
Julian's user avatar
  • 101
1 vote
0 answers
2k views

ISC DHCP Spamming /var/log/messages

I recently setup a Linux box to run a DHCP server. One of the prerequisites was to get all of its log messages onto a specific file outside of the /var/log folder. For that purpose, I inserted the ...
Lopson's user avatar
  • 111
1 vote
1 answer
5k views

Setup for rsyslog to log from two network devices

I have 2 VOIP devices on my network (ht502 and ht704) which are both capable of sending their log info as syslog data. Receiver is a little Raspberry on Raspbian. I wanted to configure syslog to ...
Gert Gottschalk's user avatar
1 vote
1 answer
749 views

Debian Jessie shutting down too fast (<1 second)

I recently have bought an SSD for my laptop and installed fresh Debian Jessie on it (I used Wheezy before). As a result, most operations on the laptop have sped up, and one operation in particular ...
Dmitry Grigoryev's user avatar
1 vote
1 answer
2k views

Snort installed on Ubuntu not sending alerts to syslog

I have a Magento website setup on a Linux machine that is based on a Bitnami ready-made image. The main goal is to be notified by email whenever there might be a potential attack on the site. My ...
Haim's user avatar
  • 11
1 vote
1 answer
2k views

How can I use Pacemaker to setup a virtual IP for receiving syslog messages?

I need to setup a VIP / floating IP that network devices will send their syslog messages to. The idea behind the VIP is to have a highly available setup in an attempt to minimize the amount of logs ...
GeneBean's user avatar
  • 215
1 vote
1 answer
840 views

Centralized and local syslog

Right now I have my clients send any syslog messages to my centralized syslog server. However, if that server went down, I would be unable to capture any logs. Is there an option to have syslog write ...
deb8user's user avatar
1 vote
0 answers
659 views

boot.log created with permissions 644 instead of 600

My rsyslog.conf file has this line in it. #### GLOBAL DIRECTIVES #### $FileCreateMode 0600 I also have $FileCreateMode 0600 local7.* /var/log/boot.log Yet after every reboot the file permissions ...
blakepeterman's user avatar
0 votes
2 answers
608 views

How to get Syslog Referer URL

I have two urls one.example.com and two.example.com, is there a way in the syslog conf of capturing which URL was used to hit the server? I need to modify a database filed based on this information. ...
The Humble Rat's user avatar
0 votes
2 answers
3k views

What does it mean when a kernel terminates a process with status 131?

I am trying to debug an issue where a redis-server process died, and in the syslog I see: Mar 9 23:56:44 ip-10-236-158-228 kernel: [25188369.962457] init: redis1-server main process (2822) ...
esilverberg's user avatar
0 votes
0 answers
122 views

rsyslog loses messages from firewall

I am trying to make rsyslog to log messages from iptables MASQUERADE. I have iptables LOG rule in nat table and PREROUTING chain before the MASQUERADE rules. The actual iptables rules: iptables -t ...
WRz's user avatar
  • 123
1 vote
1 answer
994 views

Millisecond precision in syslogd on OS X

When I log messages to syslog in OS X (10.10.1), it truncates the timestamp to the second. If I log to a file, for example, I am able to capture milliseconds. Milliseconds matter when logs are coming ...
Justin Makeig's user avatar
0 votes
1 answer
2k views

Catching malware and demonstrate it through windows logs

I need to catch a virus/malware on purpose on a VM and demonstrate the infection through windows logs analysis. I am using both syslog and eventlog analyzer, but no sign of events logged. I caught on ...
David Torreggiani's user avatar
0 votes
1 answer
397 views

File monitoring using syslog

Can rsyslog, syslog-ng programs monitor change of file? I want to monitor files and receive the changes made to the file by syslog on server. Thank you.
mau5's user avatar
  • 3