Tag Info

Hot answers tagged

13

I suggest you alter your /etc/sysctl.conf. Specifcally, you want to tweak the kernel.printk line. # Uncomment the following to stop low-level messages on console kernel.printk = 3 4 1 3 I am not sure what the centos default settings are, but I seems likely that have things set more verbose then you need. Also do see the shorewall section on logging. ...


11

I found this helpful as well. On RHEL based distros you can cat /proc/sys/kernel/printk to see what your current settings are. Four values are found in the printk file. Each of these values define a different rule for dealing with error messages. The first value, called the console loglevel, defines the lowest priority of messages printed to the console. ...


9

To set the values at runtime, use sysctl. (I suppose one can write to /proc/sys/kernel/printk directly too and apparently you can also use dmesg -n CUR as described here) Display: # sysctl kernel.printk kernel.printk = 2 4 1 7 The separators in the output are single tabs, btw. Set. Here the separators are just spaces. Works as well. # ...


9

Try this command: ln -sfn /dev/null /var/log/lastlog


6

Yes it is possible and you can use rsyslog. There is a good online manual for doing this: http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html And the general rsyslog doc is: http://www.rsyslog.com/doc/manual.html


6

The syslog calls both issue one send() to an AF_UNIX socket per call. Even if the syslogd discards the data it'll still have to read it first. All this takes time. The writes to /dev/null also issue one write() per call but since the data is discarded it can be processed very quickly by the kernel. The fprintf() calls only generate one write() for every ...


4

Here is the "official" way to do it, according to RedHat: To set the console loglevel in Red Hat Enterprise Linux 6, pass loglevel=<number> as a boot time parameter.


4

Use cat -v /etc/crontab to check for unintended control characters.


3

There is no way to monitor the sent mails in a clean way. You can only grep the details from the maillog of postfix. Here is an example: log='logfile of postfix' grep "status=sent" $log | \ egrep -ve 'postfix/(cleanup|pickup|master|qmgr|smtpd|local|pipe)' And also avoid the logs for dkim etc. If you need the count of mails then pipe on wc -l at the end. ...


3

You can add a pre-up, post-up, pre-down, and post-down directives to your /etc/network/interfaces file to achieve this. For example: auto eth0 iface eth0 inet static name Ethernet LAN card address 192.168.1.1 netmask 255.255.255.0 broadcast 192.168.1.255 network 192.168.1.0 gateway 192.168.1.254 post-up ...


3

I'd point you along the lines of Munin, but that's probably overkill for you. Instead, I'd suggest generating a ssh key-pair (if you do not have one already -- have a look in ~/.ssh/ for id_*.pub): SSH way You may monitor your Raspberry Pi's without typing a password every time by generating a ssh key pair and copying the public key to each of your ...


3

Syslog files must exist before syslogd will write to them. You will need to touch (as root) the filenames you wish to use first. touch /var/log/mail.log touch /var/log/kern.log ...etc and then refresh syslog


2

The best solution here, in my opinion, is to use tar's -S / --sparse option to handle sparse files properly.


2

Option 1: Make rsyslog ignore this message Just shut off this specific message. Add this to the top of your rsyslog.conf :msg, startswith, "NetworkManager: <WARN> nm_dbus_manager_init_bus(): Could not get the system bus" ~ Note the tilde (~) at the end of the line. Copy & paste the beginning of the message you want to ignore, and be as ...


2

you need to start rshd with -L switch on server_args parameter within xinetd.conf: service shell { disable = no socket_type = stream wait = no user = root log_on_success += USERID log_on_failure += USERID server ...


2

If you want something quick and dirty, just use netcat to listen on the syslog port. Redirecting to a file, filtering what you see, etc. can all be done with tee or shell redirection, grep, awk, etc. sudo nc -l 514 Add the -u flag if using a UDP transport.


2

Well I finally figured it out. I wish someone had answered this for me. Took several days to figure out what was wrong, but I guess there just aren't very many people on superuser. The issue was with the file permissions of the custom log file as I originally theorized. I thought I had the permissions correct, but it turns out the owner needs to be "syslog" ...


2

The specifications for the hostname state that it can comprise of A-Za-z0-9 and dashes. You have included a dot, which is being interpreted as a domain separater, which is why you are only getting the first zero. Consider this: What is the difference between host 0.0 on domain hello.com and host 0 on domain 0.hello.com? If dots were allowed in the ...


2

I caught some hits in the logs with: grep -r '"()' /var/log/httpd/ grep -r "'()" /var/log/httpd/


1

Generally, viruses/malware are specifically designed to do nothing the user can see including generating log files and/or events in the event viewer. You would have to change the event viewer to log/monitor all registry,file, and network events and then you would have an even larger problem. Monitoring like this generates 100's of entries per second. Your ...


1

The remote syslogd server should indicate a hostname (or IP address) as the next field immediately after the date and time. Here's a sample entry in a syslog file. The hostname/ip of the machine sending the entry in this case is "pizza" Jun 16 15:45:01 pizza auth.info sshd[26861]: Failed password for user from 123.45.67.89 port 59903 ssh2 Even though ...


1

The simplest way to accomplish what you want given the constraints that you've outlined in the original post and other comments, as well as the inherent limitations involved is to run two instances of the syslog server on the master syslog machine. Run them on two different ports (say 30001 and 30002) and have them write their logs to two different files. ...


1

Just add to config both on that remote host *.* @YourServerThatReceivingFromThisMachine *.* /var/log/messages


1

A few hints in order of importance: -) logrotate configuration file seems ok but is there somebody calling logrotate? This is usually done by cron or anacron. Check this out since logrotate needs somebody to call it indeed (usually cron/anacron) otherwise configuring it is useless. Check in your cron/anacron configurations and check that the daemon is ...


1

You could probably do something like: tail -f /path/to/logfile | egrep yourProgramName


1

How about: multitail -eX "smtp.*to=<(.*)>.*sent.*250" './bin/received' -f /var/log/maillog ./bin/received is a shell script that gets the destination email address as a parameter and does something with it.


1

You need to, configure syslogd to accept remote data ensure you don't have a firewall in the way I think Ubuntu uses sysklogd, and this article seems to cover it. You'll need to know if you want to sent TCP or UDP syslog messages (or both), and therefore which firewall (iptables) ports to open, etc. That varies depending on the device sending the ...


1

On your RPI install Webmin, then access your boxes via web interface: https:yourPI:10000 More about webmin: http://www.webmin.com/


1

If you want to send it to a syslog server as 192.168.1.1 you have to write like this in /etc/syslog.conf user.info @192.168.1.1 rotate size 100k files 5 syslog.info @192.168.1.1 rotate size 100k files 5 auth.info @192.168.1.1 rotate size 100k files 5 local2.info @192.168.1.1 rotate size 100k files 5 after that don't forget to apply the changes using: ...


1

I went to look at /etc/syslog.conf. It included the line *.info;mail.none;authpriv.none;cron.none;local*.none; /var/log/messages This might be the problem. This is a backup DNS server, and I set up several local* syslog facilities once to do extra DNS logging. The syslog service might not actually like the local* partial wild card. So, change the line ...



Only top voted, non community-wiki answers of a minimum length are eligible