Hot answers tagged

18

I suggest you alter your /etc/sysctl.conf. Specifcally, you want to tweak the kernel.printk line. # Uncomment the following to stop low-level messages on console kernel.printk = 3 4 1 3 I am not sure what the centos default settings are, but I seems likely that have things set more verbose then you need. Also do see the shorewall section on logging. ...


14

To set the values at runtime, use sysctl. (I suppose one can write to /proc/sys/kernel/printk directly too and apparently you can also use dmesg -n CUR as described here) Display: # sysctl kernel.printk kernel.printk = 2 4 1 7 The separators in the output are single tabs, btw. Set. Here the separators are just spaces. Works as well. # ...


11

I found this helpful as well. On RHEL based distros you can cat /proc/sys/kernel/printk to see what your current settings are. Four values are found in the printk file. Each of these values define a different rule for dealing with error messages. The first value, called the console loglevel, defines the lowest priority of messages printed to the console. (...


9

Try this command: ln -sfn /dev/null /var/log/lastlog


6

Yes it is possible and you can use rsyslog. There is a good online manual for doing this: http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html And the general rsyslog doc is: http://www.rsyslog.com/doc/manual.html


6

The syslog calls both issue one send() to an AF_UNIX socket per call. Even if the syslogd discards the data it'll still have to read it first. All this takes time. The writes to /dev/null also issue one write() per call but since the data is discarded it can be processed very quickly by the kernel. The fprintf() calls only generate one write() for every ...


4

Use cat -v /etc/crontab to check for unintended control characters.


4

Here is the "official" way to do it, according to RedHat: To set the console loglevel in Red Hat Enterprise Linux 6, pass loglevel=<number> as a boot time parameter.


4

Well I finally figured it out. I wish someone had answered this for me. Took several days to figure out what was wrong, but I guess there just aren't very many people on superuser. The issue was with the file permissions of the custom log file as I originally theorized. I thought I had the permissions correct, but it turns out the owner needs to be "syslog" ...


3

There is no way to monitor the sent mails in a clean way. You can only grep the details from the maillog of postfix. Here is an example: log='logfile of postfix' grep "status=sent" $log | \ egrep -ve 'postfix/(cleanup|pickup|master|qmgr|smtpd|local|pipe)' And also avoid the logs for dkim etc. If you need the count of mails then pipe on wc -l at the end.


3

I'd point you along the lines of Munin, but that's probably overkill for you. Instead, I'd suggest generating a ssh key-pair (if you do not have one already -- have a look in ~/.ssh/ for id_*.pub): SSH way You may monitor your Raspberry Pi's without typing a password every time by generating a ssh key pair and copying the public key to each of your ...


3

Syslog files must exist before syslogd will write to them. You will need to touch (as root) the filenames you wish to use first. touch /var/log/mail.log touch /var/log/kern.log ...etc and then refresh syslog


2

You can add a pre-up, post-up, pre-down, and post-down directives to your /etc/network/interfaces file to achieve this. For example: auto eth0 iface eth0 inet static name Ethernet LAN card address 192.168.1.1 netmask 255.255.255.0 broadcast 192.168.1.255 network 192.168.1.0 gateway 192.168.1.254 post-up /etc/network/if-up.d/...


2

Option 1: Make rsyslog ignore this message Just shut off this specific message. Add this to the top of your rsyslog.conf :msg, startswith, "NetworkManager: <WARN> nm_dbus_manager_init_bus(): Could not get the system bus" ~ Note the tilde (~) at the end of the line. Copy & paste the beginning of the message you want to ignore, and be as ...


2

The best solution here, in my opinion, is to use tar's -S / --sparse option to handle sparse files properly.


2

you need to start rshd with -L switch on server_args parameter within xinetd.conf: service shell { disable = no socket_type = stream wait = no user = root log_on_success += USERID log_on_failure += USERID server ...


2

If you want something quick and dirty, just use netcat to listen on the syslog port. Redirecting to a file, filtering what you see, etc. can all be done with tee or shell redirection, grep, awk, etc. sudo nc -l 514 Add the -u flag if using a UDP transport.


2

A few hints in order of importance: -) logrotate configuration file seems ok but is there somebody calling logrotate? This is usually done by cron or anacron. Check this out since logrotate needs somebody to call it indeed (usually cron/anacron) otherwise configuring it is useless. Check in your cron/anacron configurations and check that the daemon is ...


2

I caught some hits in the logs with: grep -r '"()' /var/log/httpd/ grep -r "'()" /var/log/httpd/


2

The specifications for the hostname state that it can comprise of A-Za-z0-9 and dashes. You have included a dot, which is being interpreted as a domain separater, which is why you are only getting the first zero. Consider this: What is the difference between host 0.0 on domain hello.com and host 0 on domain 0.hello.com? If dots were allowed in the ...


2

Found it (duh). Commenting out this in /etc/rsyslog.conf stopped the messages: # Everybody gets emergency messages *.emerg * And also found out the the fact that tomcat is the only application logging to this continuously is due to a badly programmed application logging each message as fatal, causing it to go to the console.


1

Generally, viruses/malware are specifically designed to do nothing the user can see including generating log files and/or events in the event viewer. You would have to change the event viewer to log/monitor all registry,file, and network events and then you would have an even larger problem. Monitoring like this generates 100's of entries per second. Your ...


1

The solution is to use custom rsyslog templates. First you create the log message template. The following template resembles the default syslog format but has the %fromhost-ip% added you can add other variables in the same manner $template tplremote,"%timegenerated% %HOSTNAME% %fromhost-ip% %syslogtag%%msg:::drop-last-lf%\n" Then we create the file name ...


1

How about: multitail -eX "smtp.*to=<(.*)>.*sent.*250" './bin/received' -f /var/log/maillog ./bin/received is a shell script that gets the destination email address as a parameter and does something with it.


1

You could probably do something like: tail -f /path/to/logfile | egrep yourProgramName


1

On your RPI install Webmin, then access your boxes via web interface: https:yourPI:10000 More about webmin: http://www.webmin.com/


1

On your receiving rsyslog server, add the following template line to /etc/syslog.conf $template myFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n" $ActionFileDefaultTemplate myFormat The %timegenerated% properly is what you are asking for. From man page timegenerated timestamp when the message was RECEIVED. Always in high resolution You can ...


1

Just add it as an arbitrary file to Syslog In /etc/rsyslog.conf add $ModLoad imfile. Then create a minecraft.conf file for minecraft's logs in /etc/rsyslog.d with the import definitions: $InputFileName /mine/logs/latest.log $InputFileTag minecraft $InputFileStateFile minecraft-file1 $InputFileSeverity info $InputFileFacility local7 $...


1

I had the same issue under CentOS 6 - /var/log/messages.log was empty, yum install syslog showed "already installed" but when I tried service syslog restart or service syslogd restart it said "unrecognized service". Then I found in /etc/sysconfig/rsyslog and I tried service rsyslog start and bingo! it worked. Now messages.log is populated.


1

I went to look at /etc/syslog.conf. It included the line *.info;mail.none;authpriv.none;cron.none;local*.none; /var/log/messages This might be the problem. This is a backup DNS server, and I set up several local* syslog facilities once to do extra DNS logging. The syslog service might not actually like the local* partial wild card. So, change the line ...



Only top voted, non community-wiki answers of a minimum length are eligible