Questions tagged [syslog]
Syslog is a standard for computer data logging. It separates the software that generates messages from the system that stores them and the software that reports and analyzes them.
143
questions
1
vote
2
answers
512
views
Rsyslog: relay messages from UDP input only
Considering a docker container which receives logs on UDP and forwards to a central logging server using TLS, I was wondering if I could be satisfied with one queue or if I needed several.
Indeed, ...
- 13
1
vote
1
answer
589
views
gnome-shell spamming on /var/log/syslog
Moved from https://stackoverflow.com/questions/66061925/gnome-shell-spamming-on-var-log-syslog because it was closed there without a solution; and it's also currently happening to me (I am running ...
- 239
1
vote
1
answer
1k
views
understanding syslog logs format
Im geting syslogs from multiple servers, and Im having trouble to understand some syslog logs, here is one example
<189>12593340: 16596512: Jul 6 20:31:09: %PARSER-5-CFGLOG_LOGGEDCMD: User:...
- 35
1
vote
1
answer
9k
views
How to read from syslog?
I can write to syslog via:
logger "foo bar baz"
but how do I read from syslog? my only guess is:
tail -f /var/log/syslog
but that doesn't seem right from my testing.
Note: also looking for a way ...
- 1
1
vote
1
answer
1k
views
Usbrip read from external syslog file
I want to examine usb violations with the usbrip tool (usbrip github) but the source log file which i want to read from is not the local system syslog file. Instead i have an external file.
When i ...
- 21
1
vote
1
answer
282
views
Debian 9 /var/log/ message, syslog,dmesg are these safe to post to a forum?
On a very stock Debian 9 VPS, running a multiplayer game system with very expensive scripting in it. I am having a problem with that multiplayer server, and one the server developers is asking me to ...
- 35
1
vote
1
answer
451
views
Prevent program from writing to journal
I'm using openconnect with some VPN's, and after a while I see that the journald and syslog are using a lot of resources. The vpn's still work perfectly, but the computer gets really slow. After ...
- 53
1
vote
1
answer
3k
views
The log files are empty
I found out that my /var/log/messages is empty!
Also my /var/log/auth.log is also empty!
Also it is not logging any messages.
My /etc/rsyslog.conf file is as follows:
# /etc/rsyslog.conf ...
- 181
1
vote
1
answer
10k
views
Missing /var/log/messages file in CentOS 6.8
I'm not sure what I'm doing wrong, but my Linux box doesn't seem to be logging any info to the /var/log/messages file.
I've also checked and the kernel isn't logging anything either.
My syslog ...
- 143
1
vote
1
answer
5k
views
Setup for rsyslog to log from two network devices
I have 2 VOIP devices on my network (ht502 and ht704) which are both capable of sending their log info as syslog data. Receiver is a little Raspberry on Raspbian.
I wanted to configure syslog to ...
- 205
1
vote
1
answer
846
views
Centralized and local syslog
Right now I have my clients send any syslog messages to my centralized syslog server. However, if that server went down, I would be unable to capture any logs. Is there an option to have syslog write ...
- 13
1
vote
1
answer
5k
views
make particular service logs to be written in separate file in syslog.conf
One of the service is writting logs by default in /var/log/messages file. I want that service logs to be written other file.
Logs in /var/log/messages files are being dislpalyed as below.
Nov 20 ...
- 417
1
vote
2
answers
7k
views
How do I configure rsyslog to write to /var/log/{hostname of sender} when receiving remote logs?
My ADSL modem supports remote logging via syslog. I have set up my server, running rsyslog, to accept the log messages from the modem and they are being show in /var/log/syslog along with the messages ...
- 495
1
vote
1
answer
1k
views
Useless nm_dbus_manager_init_bus error messages fill log
My system runs fine, but /var/log/messages repeats this message every
few seconds, filling up my log directory:
Oct 13 09:10:57 barry NetworkManager: <WARN>
nm_dbus_manager_init_bus(): Could ...
user59328
1
vote
1
answer
609
views
how to setup syslogd for network equipment such as routers
I seen syslog server logging options on various pieces of equipment on my network. I was wondering how would I setup a syslog server for them to broadcast to? Is there anything special I need to do. I ...
- 671
1
vote
1
answer
166
views
rSyslog stopped sending only SOME data
I have configured a remote logging from one of my servers to the central log server via rsyslog TCP/SSL
Everything worked fine until yesterday where most of the files just stop being transmitted while ...
- 153
1
vote
0
answers
328
views
net.core.netdev_max_backlog - what's the impact when set too HIGH?
I'm working on optimizing and right-sizing my EC2 syslog-ng servers and have some carryover settings in our ansible playbook for kernel settings that were used on "in-house" data center ...
- 11
1
vote
1
answer
408
views
Why would vsftpd be logging to syslog even though logging is disabled in vsftpd?
I have all logging disabled in /etc/vsftpd but for some reason it is still logging to /var/log/syslog and I can't figure out why.
root@unraid:/etc# cat /etc/vsftpd.conf
# vsftpd.conf for unRAID
# ...
- 384
1
vote
1
answer
436
views
Logs missing and empty message when forwarding syslog from macOS
I have tried the syslog forwarding configuration as mentioned in splunk document, But on the syslog server I not getting all logs generated in macOS and also there is no Syslog content (message) in ...
- 11
1
vote
0
answers
555
views
How to disable logging from a given module on linux (Ubuntu)?
I have some issue on my Ubuntu 20.4 system where the mceusb module is filling up the kern.log and syslog file with messages like:
mceusb 2-2:1.0: Error: urb status = -71/d
This completely filled up ...
- 111
1
vote
1
answer
439
views
syslog-ng starts and runs fine manually... starts but doesnt create logs when using systemd
Redhat 7.6 with latest syslog-ng (3.22)
ive searched and tried all the old remedies. Nothing has worked to resolve this.
My syslog-ng.conf file has a bunch of ports and a bunch of destinations. When ...
- 23
1
vote
1
answer
2k
views
Forward logs via rsyslog to Datadog without agents?
I'm trying to forward my container logs ( apache2 access.log on Febian container) to datadog but it didn't work. I followed this [tutorial][1].
This is rsyslog.conf file:
# /etc/rsyslog.conf ...
- 11
1
vote
0
answers
540
views
Log correlation with syslog-ng patterndb
I'm trying to play with syslog-ng and patterndb and I am having trouble with log correlation.
The documentation on how to do it is here : https://www.syslog-ng.com/technical-documents/doc/syslog-ng-...
- 11
1
vote
1
answer
644
views
How to convert rsyslog octal codes to ascii
Rsyslog by default uses octal codes to encode control codes and whitespace: #012 for newline, #011 for tab
A Google search only turned up results on how to convert octal codes using the standard \012 ...
- 697
1
vote
0
answers
2k
views
Rsyslog logging into /var/log/messages instead of custom file
I have multiple perl daemons processes writing into a specific log file. In /etc/rsyslog.conf following is configuration -
$ModLoad imuxsock
$ModLoad imjournal
$OmitLocalLogging off
*....
- 11
1
vote
0
answers
725
views
Measure EPS (Events per Seconds)
I want to measure the EPS metric, or the number of processed events per seconds in my device.
I read that the most accurate measurement of EPS is to use a simple syslog server, such as Kiwi Syslog ...
- 111
1
vote
1
answer
1k
views
how to configure Mac OS X Sierra for syslog or unified log forwarding
I am trying to perform syslog forwarding. But after launching plist like this:
launchctl unload/System/Library/LaunchDaemons/com.apple.syslogd.plist
I get this error:
/System/Library/...
- 11
1
vote
0
answers
343
views
How can I get exact same log file name in Rsyslog v-8
Previously I was using Rsyslog v-7.14 and having the template:
$template UDP-Logging, "/var/log/RemoteLogs/%HOSTNAME%/UDP-%PROGRAME%-%$now%.log"
if $fromhost-ip ! '127.0.0.1' then -?UDP-Logging
&...
1
vote
0
answers
753
views
rsyslogd: How to prevent logging in the /var/kern.log file and redirecting to another file?
I am trying to redirect iptables log to another file.
Based upon my reading on the net, I did the following:
In my iptables rule, I have rules like:
iptables -A INPUT -s ... -j LOG --log-prefix "...
- 369
1
vote
0
answers
2k
views
ISC DHCP Spamming /var/log/messages
I recently setup a Linux box to run a DHCP server. One of the prerequisites was to get all of its log messages onto a specific file outside of the /var/log folder. For that purpose, I inserted the ...
- 111
1
vote
1
answer
749
views
Debian Jessie shutting down too fast (<1 second)
I recently have bought an SSD for my laptop and installed fresh Debian Jessie on it (I used Wheezy before). As a result, most operations on the laptop have sped up, and one operation in particular ...
- 9,377
1
vote
1
answer
2k
views
Snort installed on Ubuntu not sending alerts to syslog
I have a Magento website setup on a Linux machine that is based on a Bitnami ready-made image.
The main goal is to be notified by email whenever there might be a potential attack on the site.
My ...
- 11
1
vote
1
answer
2k
views
How can I use Pacemaker to setup a virtual IP for receiving syslog messages?
I need to setup a VIP / floating IP that network devices will send their syslog messages to. The idea behind the VIP is to have a highly available setup in an attempt to minimize the amount of logs ...
- 215
1
vote
0
answers
664
views
boot.log created with permissions 644 instead of 600
My rsyslog.conf file has this line in it.
#### GLOBAL DIRECTIVES ####
$FileCreateMode 0600
I also have
$FileCreateMode 0600
local7.* /var/log/boot.log
Yet after every reboot the file permissions ...
- 111
1
vote
1
answer
996
views
Millisecond precision in syslogd on OS X
When I log messages to syslog in OS X (10.10.1), it truncates the timestamp to the second. If I log to a file, for example, I am able to capture milliseconds. Milliseconds matter when logs are coming ...
- 161
1
vote
1
answer
3k
views
Cablemodem (SBG6580) firewall denying some outbound traffic? Why? Not configured
I finally got around to turning the syslog on for my cablemodem (Motorola Surfboard SBG6580) and I'm seeing about the expected amount of inbound attackage being blocked...
2014-05-30 21:59:02 ...
- 341
1
vote
0
answers
167
views
rsyslog block by dns
rsyslog version is 5.8.6
The rsyslog client send message to remote server by udp， the remote server is used by domain, when the domian can't resolv and timeout, the rsyslog will be blocked.
I add ...
- 175
1
vote
1
answer
156
views
How do I view syslogs on a remote server with Windows and a web browser?
I have Ubuntu Clients running 12.04 LTS and a Ubuntu machine as the server. Now I have configured Ubuntu machines as syslog clients and they are intended to send their logs to the Ubuntu machine.
But ...
- 113
1
vote
2
answers
90
views
VMware ESX/i syslog content
I am working on an expansion of our monitoring footprint, and we are currently looking at including data from our visualized environment. As our monitoring license is based on logged volumes, and we ...
- 205
1
vote
0
answers
632
views
how to get logs in DD/MM/YYYY format and ipaddress format using rsyslog in ubuntu
Feb 4 10:32:57 master sshd[2070]: pam_unix(sshd:session): session opened for user root by (uid=0)
Feb 4 10:32:59 master sshd[2070]: Received disconnect from 192.168.0.107: 11: disconnected by user
...
- 111
1
vote
2
answers
949
views
dmesg/syslog spam for usb device (carl9170 wifi-dongle, not related to driver, though)
So, I'm getting spammed hardcorely by my kernel (note that this is the log for only 1 second):
Feb 9 00:35:05 vanaheimr kernel: [26761.862104] usb 1-4: link qh0-00ff/f529e540 start 0 [2/0 us]
Feb 9 ...
- 165
0
votes
1
answer
6k
views
syslog : How can I filter syslog messages on windows 10?
I would like to how I can filter syslog messages to get only the ones I am interested in on Windows 10.
For example I would like to get the syslog message when the identification/authentication of a ...
- 149
0
votes
2
answers
612
views
How to get Syslog Referer URL
I have two urls one.example.com and two.example.com, is there a way in the syslog conf of capturing which URL was used to hit the server?
I need to modify a database filed based on this information.
...
- 182
0
votes
1
answer
75
views
Thousands of network messages in systemlog
Our Ubuntu server kernel log is being spammed by the following messages:
Feb 5 12:08:32 Server kernel: [2071471.605255] BANDWIDTH_OUT:IN= OUT=eno1 SRC=192.168.48.2 DST=192.168.48.139 LEN=312 TOS=0x10 ...
- 15
0
votes
1
answer
6k
views
Getting logger to log to rsyslog in alpine
I installed rsyslog on my Alpine-based system to replace busybox syslogd. After completely disabling syslogd in openrc, enabling ryslog at boot and rebooting, all services correctly started logging to ...
- 569
0
votes
1
answer
100
views
How to save syslog severity <132> to a different file?
We have an old appliance that sends syslog with severity <132> to its management server.
To capture said events the previous team created a tcpdump script and ran it via crontab to capture the ...
- 349
0
votes
2
answers
62
views
Watch (rotating) log in screen
I'm running a mailserver which I connect to using SSH. My .bash_profile is configured to attatch a SSH session to a certain screen session.
Now I'd like to have a log (e.g. the syslog) printed to one ...
- 153
0
votes
1
answer
7k
views
rsyslogd: how can you use $ModLoad imfile more than once?
I am testing out Loggly.com, which uses rsyslogd to collect log entries. Loggly provides scripts that generate config files. Each config file starts with $ModLoad imfile, however this seems to only ...
- 165
0
votes
1
answer
349
views
php7 - prevent errors being broadcast
On Centos7 With PHP 7 configured to send errors to syslog, parse errors get broadcast to wall e.g. logged in users see messages like this:
Broadcast message from systemd-journald@xxxxxxxxxx (Fri 2017-...
- 697
0
votes
1
answer
2k
views
Catching malware and demonstrate it through windows logs
I need to catch a virus/malware on purpose on a VM and demonstrate the infection through windows logs analysis. I am using both syslog and eventlog analyzer, but no sign of events logged. I caught on ...
