Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [syslog]

Syslog is a standard for computer data logging. It separates the software that generates messages from the system that stores them and the software that reports and analyzes them.

0
votes
0answers
10 views

Rsyslog only log snort and dns

I'm currently running Graylog to receive logs from my Pi-Hole and Snort instance. However, rsyslog is sending all logs e.g. java, sudo etc as well. How do I configure Rsyslog to only log Snort ...
0
votes
0answers
23 views

syslog-ng destination plugin elasticsearch2 not found

I have Linux Mint 19. syslog-ng --version: options { threaded(yes); use-uniqid(yes); }; source s_syslog { syslog(); }; destination d_elastic { elasticsearch2( index("syslog-...
0
votes
0answers
11 views

Shall syslog be used with udp, tcp, or tcp over TLS?

Of course, it depends the usage: UDP port 514 has been used by sysadmins for years to monitor IT mostly for performance, usage, maintenance. Loosing some logs was not important to get the whole ...
0
votes
0answers
9 views

AlienVault Setup & Configuration Using Syslog for network traffic

I am attempting to deploy an AlienVault instance and am a bit confused about tracking the traffic. I can see that i can set policies and alarms based on certain events and that i think i need to port ...
0
votes
0answers
17 views

Sending Client Logs to Remote machine with exact file name and messages using rsyslog 7.6.1

I am working on a project where I need to harden the OS before going to deployment up and live. One of the steps involved to set up the remote log server to collect and log from the deployment machine....
1
vote
1answer
36 views

Prevent program from writing to journal

I'm using openconnect with some VPN's, and after a while I see that the journald and syslog are using a lot of resources. The vpn's still work perfectly, but the computer gets really slow. After ...
1
vote
1answer
61 views

List of all the syslog messages?

I want to be able to filter for specific entries in the Syslog on my Linux computer. For instance, I'd like to be able to filter for user authentication failure or success, or for access to sensitive ...
0
votes
1answer
36 views

syslog : How can I filter syslog messages on windows 10?

I would like to how I can filter syslog messages to get only the ones I am interested in on Windows 10. For example I would like to get the syslog message when the identification/authentication of a ...
0
votes
0answers
27 views

Rhel - How to create non root user, to administrate app installed by root?

Installed Syslog-NG as root, because the syslog-NG and its dependency packages like Eventlog is supposed to be installed in custom folder /app/syslog-ng. But, going further, we would like a non-root ...
0
votes
1answer
26 views

How do I log syslog to virtual console from systemd?

This fails: $ cat /etc/systemd/system/getty@tty8.service.d/override.conf [Service] ExecStart= ExecStart=-/usr/bin/tail -f /var/log/syslog Aug 2 11:28:22 darts02 tail[317]: Aug 2 11:28:18 darts02 ...
0
votes
0answers
35 views

Why crontab job stopped during running?

last year it can generate *Error.txt files and no limit this year only add new switches in new project and changed to new security manager. what is wrong in syslog server? Linux version 2.6.32-573.22....
1
vote
1answer
191 views

The log files are empty

I found out that my /var/log/messages is empty! Also my /var/log/auth.log is also empty! Also it is not logging any messages. My /etc/rsyslog.conf file is as follows: # /etc/rsyslog.conf ...
0
votes
0answers
308 views

How to view audit logs on the nfs server

I'm trying to do a nfs share. I've configured the share. Now I want to view the logs associated with the files in the nfs share. I've created a centralized log server. I don't know the difference ...
0
votes
0answers
58 views

How to find the client IP/name from the audit logs

I'm auditing the files in a nfs share. When I look at the audit logs using the command ausearch -f /var/nfs/general , I get some logs that looks like this: In the server side: time->Tue Jun 12 16:...
0
votes
0answers
15 views

what can be done or not in a syslog arquitature using rsylog?

I am creating a logging system on a centralized server. I am able to create a client connection to the server using rsyslog. My doubts are: Can I use an rsyslog server to be an rsyslog client to ...
1
vote
0answers
393 views

Rsyslog logging into /var/log/messages instead of custom file

I have multiple perl daemons processes writing into a specific log file. In /etc/rsyslog.conf following is configuration - $ModLoad imuxsock $ModLoad imjournal $OmitLocalLogging off *....
0
votes
0answers
38 views

nx_log parsing windows server 2008

I'm using nxlog to collect Windows Server 2008 logs to central syslog. The logs are too verbose which makes them hard to read and they waste too much space. I'd like to get rid of the description part ...
2
votes
1answer
2k views

OSX High Sierra wake reason syslog location?

I'm running OSX 10.13.3. I understand that if I run the following command in terminal I will get the wake reason for my machine. log show --style syslog | fgrep "Wake reason" Currently when I run ...
0
votes
2answers
38 views

Watch (rotating) log in screen

I'm running a mailserver which I connect to using SSH. My .bash_profile is configured to attatch a SSH session to a certain screen session. Now I'd like to have a log (e.g. the syslog) printed to one ...
2
votes
0answers
94 views

MacOS - How to change syslogd's log level for a specific process/program?

I am new to MacOS and I would like to get a better of view of what's going on with a system process when my computer is starting up. I can see in the log that a process is changing settings, but the ...
0
votes
0answers
49 views

limiting rsyslog direct queue

I have the following configuration in my rsyslog.conf file in debian system: action(type="omfile" file="/var/Debug.log" fileOwner="user" fileGroup="user") how can I limit the /var/Debug.log file ...
0
votes
0answers
37 views

Reliably tail/stream a log file to another machine (Keyword: Reliably). Strangely impossible?

I have a growing logfile on a unix box. I just want something that collects that data on another box within a few seconds of it being written. Sounds simple. But I need it to not introduce screw ups ...
1
vote
1answer
596 views

Send specific rsyslog facility to remote server and not local

I have a rsyslog facility (local1) that is used by one application only, and I would like to send the logs from that to a remote server but not to the local machine. I've managed to find the info in ...
1
vote
0answers
175 views

Measure EPS (Events per Seconds)

I want to measure the EPS metric, or the number of processed events per seconds in my device. I read that the most accurate measurement of EPS is to use a simple syslog server, such as Kiwi Syslog ...
0
votes
1answer
498 views

Why does `& ~` mean “discard the messages that were matched in the previous line”?

In the webpage iptables log Create /etc/rsyslog.d/iptables.conf with the following contents: :msg, startswith, "iptables: " -/var/log/iptables.log & ~ The second line means discard the ...
4
votes
1answer
2k views

rsyslog changing file owner

I'm trying to change the owner and group of a log to a different user than what is is rsyslog.conf, which has: # # Set the default permissions for all log files. # $FileOwner syslog $FileGroup adm $...
1
vote
1answer
2k views

How to disable syslog messaging to /var/log/syslog

I'm working on a centralized logging solution using the ELK stack and Kafka. I'm running Ubuntu Xenial on all the machines, and I'm using Rsyslog with omkafka to write all log messages to a kafka ...
1
vote
1answer
5k views

Simple way to generate syslog over TCP?

I want to troubleshoot logstash server issue and need to generate syslog message from time to time. Is there a simple way that allows me to connect to a syslog server using TCP and send some arbitrary ...
0
votes
1answer
600 views

Debian Jessie with systemd: bloated log files are never deleted

I have a fairly stock, minimal Debian Jessie distro on which log files under /var/log are being rotated (seemingly arbitrarily) but never deleted: $ sudo du -sk /var/log/* | sort -rn 4167364 /var/log/...
1
vote
1answer
807 views

how to configure Mac OS X Sierra for syslog or unified log forwarding

I am trying to perform syslog forwarding. But after launching plist like this: launchctl unload/System/Library/LaunchDaemons/com.apple.syslogd.plist I get this error: /System/Library/...
4
votes
1answer
977 views

How to send log entries to a remote server running journald (systemd)

I have an iot module running a firmware that has the capability of sending the logs to a remote syslog host. I've already configured it to send the entries to an Ubuntu Server running rsyslog. I'd ...
0
votes
1answer
1k views

rsyslogd: how can you use $ModLoad imfile more than once?

I am testing out Loggly.com, which uses rsyslogd to collect log entries. Loggly provides scripts that generate config files. Each config file starts with $ModLoad imfile, however this seems to only ...
4
votes
0answers
3k views

Running OSX as a syslog server

I want to receive the logs from my router (an ASUS RT68U) on my laptop (OSX 10.9). It supports syslog and OSX has ASL (a superset of syslog, apparently). I've followed the instructions in OS X Lion as ...
0
votes
1answer
124 views

php7 - prevent errors being broadcast

On Centos7 With PHP 7 configured to send errors to syslog, parse errors get broadcast to wall e.g. logged in users see messages like this: Broadcast message from systemd-journald@xxxxxxxxxx (Fri 2017-...
1
vote
1answer
1k views

Disable rsyslog remote server 's console messages [duplicate]

My console is been flooded with rsyslog messages. These are messages that come from a remote server: Message from syslogd@MSAN-RSPAE_O1A0F at Mar 3 11:07:13 ... rOT1[291]: 17/03/03 11:07:13 ...
1
vote
0answers
197 views

hard disk - what these log entries mean

I am running a brand new WD Black 3TB. It is formatted as ext4 filesystem and used with Banana Pi card. Actually I am having two such setups, but only one gives me any problems. The second Pi makes a ...
1
vote
0answers
118 views

How can I get exact same log file name in Rsyslog v-8

Previously I was using Rsyslog v-7.14 and having the template: $template UDP-Logging, "/var/log/RemoteLogs/%HOSTNAME%/UDP-%PROGRAME%-%$now%.log" if $fromhost-ip ! '127.0.0.1' then -?UDP-Logging &...
1
vote
1answer
303 views

How to disable RC4 cipher when using Syslog-NG 3.5 as Syslog Server over TCP/TLS?

Syslog-ng 3.5.6 is the latest version currently offered by Debian stable (jessie). I'm not sure how to blacklist ciphers with this version. Newer versions of Syslog-ng seem to offer a more ...
0
votes
1answer
545 views

incorrect encoding of rsyslog output

I'm running a rsyslog service in a docker container. Its configuration(rsyslog.conf) looks like below, module(load="imuxsock") # local system logging support (e.g. via logger command) ...
-1
votes
1answer
55 views

Linux RedHat - Logging await

How can I create an await log for the devices /dev/emcpower*1. The log should be in the pattern of: Aug 23 10:00:11 /dev/emcpowera1 2.96 Aug 23 10:00:11 /dev/emcpowerb1 2.91 Aug 23 10:00:13 /dev/...
0
votes
1answer
926 views

Log file location based on hostname with syslog-ng

I'm using syslog-ng for a big amount of servers. To get everything more in shape in the folder structure, I use several filters with regex and multiple destination and log lines in the syslog-ng.conf ...
0
votes
1answer
334 views

rsyslog exclude logs based on hostname

We have our rsyslog server set up to forward messages to our Splunk box. However we want to cut through some of the noise so we have set up specific programs to disregard. So basically if logs are ...
1
vote
1answer
881 views

How do I stop Tomcat / rsyslog from logging to console?

At my work someone once setup Tomcat to log to syslog. The problem is that these messages also get sent to the console. The system is RHEL6, these are the involved RPM's rsyslog-5.8.10-10.el6_6....
1
vote
1answer
2k views

Missing /var/log/messages file in CentOS 6.8

I'm not sure what I'm doing wrong, but my Linux box doesn't seem to be logging any info to the /var/log/messages file. I've also checked and the kernel isn't logging anything either. My syslog ...
1
vote
0answers
419 views

rsyslogd: How to prevent logging in the /var/kern.log file and redirecting to another file?

I am trying to redirect iptables log to another file. Based upon my reading on the net, I did the following: In my iptables rule, I have rules like: iptables -A INPUT -s ... -j LOG --log-prefix "...
0
votes
1answer
245 views

Error in the rsyslog.conf file, how to log more than one device?

I am trying to log my dd-wrt router and my nas4free device. All logs are sent to a spare raspberrypi with a usb disk connected to to store the log files. But there is a problem with my rsyslog.conf ...
2
votes
2answers
11k views

Rsyslog: how to separate incoming logs with IP addresses

I am trying to setup an Rsyslog with the following configuration: I listen to the 514 port to receive data from different hosts: 172.16.111.222, 172.16.111.111 and 172.16.222.111. And I want to store ...
0
votes
0answers
30 views

Is there a general solution to delivering bytes to a destination with reliability and buffering configuration?

I have some application events. I want these events to be delivered to a few places: a periodically rotated file (in proprietary TSV format in my case), a message bus (Kafka in my case), for archival ...
0
votes
0answers
893 views

ISC DHCP Spamming /var/log/messages

I recently setup a Linux box to run a DHCP server. One of the prerequisites was to get all of its log messages onto a specific file outside of the /var/log folder. For that purpose, I inserted the ...
1
vote
1answer
2k views

Setup for rsyslog to log from two network devices

I have 2 VOIP devices on my network (ht502 and ht704) which are both capable of sending their log info as syslog data. Receiver is a little Raspberry on Raspbian. I wanted to configure syslog to ...