Questions tagged [syslog]

Syslog is a standard for computer data logging. It separates the software that generates messages from the system that stores them and the software that reports and analyzes them.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

Send rsylog logs through http proxy

I need to send my rsyslog logs to an SaaS enpoint on the internet. However, I don't have a direct internet access on my server. Naturally I thought about using our corporate proxy to do so. However, ...
0
votes
1answer
18 views

How can I get my Cygwin SSH server to log into a file?

On proper Linux systems, the SSH server typically logs into a file, e.g. /var/log/auth.log or /var/log/syslog etc. But - that doesn't exist on my Cygwin system; and merely editing /etc/sshd_config ...
0
votes
0answers
47 views

How to Add a Tag to Filebeat's System Module?

Using the System module from Elasticsearch's Filebeat, the documents created in the index do not have any tags. How can I add a tag to just the entries from this module? The documentation for the ...
0
votes
0answers
40 views

Oracle audit syslog-ng config

I'm configuring my Oracle instance to syslog auditing ... I have the following steps completed as per documentation: Edit the file init.ora to add the following lines: .audit_sys_operations=TRUE ....
0
votes
0answers
22 views

Display the custom token automatically in the original syslog messages generated by rsyslog

We have purchased a cloud based application with multi tenant support that we have deployed for our selves and a number of our customers. This particular cloud based application has a custom token ...
0
votes
0answers
65 views

How to get syslog in Common event format(CEF)

I want /var/log/syslog in common event format(CEF).Is there any way to convert a syslog into CEF? Syslog sample
0
votes
0answers
29 views

Radius Server log copy to remote server

I have one radius server. I want to grab all radius server logs on local radius server as well as on my any remote server. Currently, I can see all log in /var/log/radius/radius.log file. But I want ...
0
votes
1answer
35 views

configure dockerd to log userid or username of the user who is launching the container

I updated docker daemon config to enable debug mode for dockerd daemon on Linux. And also using rsyslog I managed to create a separate debug log file. Now I want to log the userid/name of the user ...
0
votes
1answer
16 views

How to save syslog severity <132> to a different file?

We have an old appliance that sends syslog with severity <132> to its management server. To capture said events the previous team created a tcpdump script and ran it via crontab to capture the ...
0
votes
1answer
40 views

Have “individual” logging instead of logging everything to “journalctl” on CentOS 7

On my CentOS 7 system, no output are written to the well known log files and I'm forced to use journalctl to view anything that happening. For example, there is no data in /var/log/messages, nor /var/...
0
votes
0answers
56 views

how to find use with audit log who deleted the file?

I want to find who has deleted the file under the /home/oracle directory. my ausearch output like this: ausearch -f /home/oracle/ time->Mon Nov 25 01:00:02 2019 type=PROCTITLE msg=audit(...
0
votes
0answers
19 views

rsyslogd bug? Dir/file owned by ROOT not dirOwner/fileOwner

Info about my rsyslog server: Information for package rsyslog: -------------------------------- Repository : SLES12-SP4-Updates for x86_64 Name : rsyslog Version : 8.24.0-3.33.2 ...
0
votes
0answers
34 views

How to configure rsyslog to send to multiple remote servers, some with and some without tls?

This is how my configuration looks like currently: # start forwarding rule1 $WorkDirectory /some/path # where to place spool files $ActionQueueFileName fwd1 # unique name prefix for spool files $...
0
votes
0answers
14 views

How to concfigure kibana charts for syslog message

I have configured elk in one of our server and installed filebeat on it. We have rsyslog server running on another machine and logs are storing on the shared area. I have selected file beat input as ...
0
votes
1answer
36 views

Rsyslog filtering messages based on time

I want to filter logs so that only messages from 13:00-14:00 can go through, how can I do that? I know I can access message content with $msg, but how can I do that for time?
1
vote
1answer
115 views

How to read from syslog?

I can write to syslog via: logger "foo bar baz" but how do I read from syslog? my only guess is: tail -f /var/log/syslog but that doesn't seem right from my testing. Note: also looking for a way ...
0
votes
0answers
22 views

Docker log-tag templates

I'm trying to send docker logs to a syslog instance using log driver "syslog". Works fine, but I found some undocumented yet interesting information. The option --log-opt "tag=<template>" ...
0
votes
0answers
9 views

How to record volume of data of each connection in SysLog?

I set up a SysLog in a DrayTek router as in this page. I see DNS and TCP connections in the logs: <150>Sep 11 15:20:02 DrayTek: Local User (MAC=00-00-00-00-00-00): 192.168.1.18 DNS -> 88.214....
1
vote
1answer
505 views

Usbrip read from external syslog file

I want to examine usb violations with the usbrip tool (usbrip github) but the source log file which i want to read from is not the local system syslog file. Instead i have an external file. When i ...
1
vote
1answer
38 views

syslog-ng starts and runs fine manually… starts but doesnt create logs when using systemd

Redhat 7.6 with latest syslog-ng (3.22) ive searched and tried all the old remedies. Nothing has worked to resolve this. My syslog-ng.conf file has a bunch of ports and a bunch of destinations. When ...
0
votes
0answers
51 views

Docker Logs are not showing up in Syslog

We are using Docker Community Edition , we configured the docker logging driver to syslog . However when i read syslog , there are not logs of docker. Is configuring Docker logs to go to Syslog only ...
0
votes
0answers
18 views

In rsyslog 'programname' property of itself sometimes has some strange number suffix

I'm forwarding logs from local rsyslogs to central rsyslog and then to Elasticsearch. Everything works fine, but entries with severity error generated by rsyslog itself have property programname like ...
0
votes
1answer
41 views

How to append host IP address and host MAC addres to every log message?

I have several log agents with iptables logging rules and default rsyslog config. Rsyslog sends the logs to the central server. Iptables rule: iptables -A INPUT -j LOG --log-prefix "INPUT:DROP:" --...
0
votes
1answer
58 views

How to know when Rsyslog has read all lines in a file, and have read 100% of a file

I have to pull log files, static files. Let's imagine I have 100 events (100 lines) in a file. Rsyslog has to forward those logs to a server. Once Rsyslog has read the last line, I want to shutdown ...
0
votes
0answers
29 views

Why does `syslog` on `Cygwin` ignores messages silently?

I run syslog on Windows via Cygwin. My configuration file follows: ############################################################################# # Default syslog-ng.conf file which collects all local ...
0
votes
0answers
113 views

Syslog-ng stops logging on console after system time is changed

After changing the system time to an older timestamp, I am observing syslog-ng 3.8.1 on debian stretch stops forwarding logs to console. Here is the syslog-ng configuration: @version: 3.8 @include "...
1
vote
1answer
81 views

Debian 9 /var/log/ message, syslog,dmesg are these safe to post to a forum?

On a very stock Debian 9 VPS, running a multiplayer game system with very expensive scripting in it. I am having a problem with that multiplayer server, and one the server developers is asking me to ...
0
votes
0answers
35 views

Configure rsyslog to use TLS for only one input

I am pretty new to configuring rsyslog besides the very basics. We have a ton of simple unencrypted UDP listeners already set up, but this new connection that we need apparently requires TLS. So far ...
0
votes
0answers
316 views

Rsyslog won't forward with JSON template

so I'm trying to use rsyslog to accept udp traffic on port 514, apply a json template, and then send it out over udp to port 10514 (this is so my logstash installation can pick it up). I'm running ...
0
votes
1answer
51 views

Using Syslog-kafka got some python syntax erro

I need to send message to my kafka cluster, I do the same like this https://syslogng-kafka.readthedocs.io/en/latest/installation.html , and /etc/syslog-ng/conf.d/kafka.conf like destination ...
0
votes
1answer
355 views

Foarward logs via Rsyslog to datadog without agents

I am trying to forward my container logs ( apache2 access.log on debian container) to datadog but it didn't work . ifollowed this tutorial this is rsyslog.conf file # /etc/rsyslog.conf ...
0
votes
1answer
604 views

How to setup blacklist rule of elastalert

I have syslog messages of following type. I want to capture all such messages which contains "errors" in message field of syslog. <30>Apr 9 04:27:13 ip-172-31-26-235 POSTMETHOD_fx-control-...
1
vote
0answers
250 views

Log correlation with syslog-ng patterndb

I'm trying to play with syslog-ng and patterndb and I am having trouble with log correlation. The documentation on how to do it is here : https://www.syslog-ng.com/technical-documents/doc/syslog-ng-...
1
vote
1answer
231 views

How to convert rsyslog octal codes to ascii

Rsyslog by default uses octal codes to encode control codes and whitespace: #012 for newline, #011 for tab A Google search only turned up results on how to convert octal codes using the standard \012 ...
0
votes
0answers
24 views

Linux log grows large, resets, does it again

Am running Ubuntu 18 and don't have a ton on their for apps. The hardware is setup with one 120gb SSD as root/boot and the rest of the drives as 2 pair of raid drives where media files, etc... reside. ...
1
vote
1answer
274 views

Rsyslog only log snort and dns

I'm currently running Graylog to receive logs from my Pi-Hole and Snort instance. However, rsyslog is sending all logs e.g. java, sudo etc as well. How do I configure Rsyslog to only log Snort ...
1
vote
1answer
85 views

Prevent program from writing to journal

I'm using openconnect with some VPN's, and after a while I see that the journald and syslog are using a lot of resources. The vpn's still work perfectly, but the computer gets really slow. After ...
1
vote
1answer
198 views

List of all the syslog messages?

I want to be able to filter for specific entries in the Syslog on my Linux computer. For instance, I'd like to be able to filter for user authentication failure or success, or for access to sensitive ...
0
votes
1answer
940 views

syslog : How can I filter syslog messages on windows 10?

I would like to how I can filter syslog messages to get only the ones I am interested in on Windows 10. For example I would like to get the syslog message when the identification/authentication of a ...
0
votes
1answer
119 views

How do I log syslog to virtual console from systemd?

This fails: $ cat /etc/systemd/system/getty@tty8.service.d/override.conf [Service] ExecStart= ExecStart=-/usr/bin/tail -f /var/log/syslog Aug 2 11:28:22 darts02 tail[317]: Aug 2 11:28:18 darts02 ...
1
vote
1answer
768 views

The log files are empty

I found out that my /var/log/messages is empty! Also my /var/log/auth.log is also empty! Also it is not logging any messages. My /etc/rsyslog.conf file is as follows: # /etc/rsyslog.conf ...
0
votes
0answers
306 views

How to find the client IP/name from the audit logs

I'm auditing the files in a nfs share. When I look at the audit logs using the command ausearch -f /var/nfs/general , I get some logs that looks like this: In the server side: time->Tue Jun 12 16:...
1
vote
0answers
753 views

Rsyslog logging into /var/log/messages instead of custom file

I have multiple perl daemons processes writing into a specific log file. In /etc/rsyslog.conf following is configuration - $ModLoad imuxsock $ModLoad imjournal $OmitLocalLogging off *....
3
votes
1answer
4k views

OSX High Sierra wake reason syslog location?

I'm running OSX 10.13.3. I understand that if I run the following command in terminal I will get the wake reason for my machine. log show --style syslog | fgrep "Wake reason" Currently when I run ...
0
votes
2answers
45 views

Watch (rotating) log in screen

I'm running a mailserver which I connect to using SSH. My .bash_profile is configured to attatch a SSH session to a certain screen session. Now I'd like to have a log (e.g. the syslog) printed to one ...
2
votes
0answers
258 views

MacOS - How to change syslogd's log level for a specific process/program?

I am new to MacOS and I would like to get a better of view of what's going on with a system process when my computer is starting up. I can see in the log that a process is changing settings, but the ...
0
votes
0answers
117 views

limiting rsyslog direct queue

I have the following configuration in my rsyslog.conf file in debian system: action(type="omfile" file="/var/Debug.log" fileOwner="user" fileGroup="user") how can I limit the /var/Debug.log file ...
0
votes
0answers
74 views

Reliably tail/stream a log file to another machine (Keyword: Reliably). Strangely impossible?

I have a growing logfile on a unix box. I just want something that collects that data on another box within a few seconds of it being written. Sounds simple. But I need it to not introduce screw ups ...
1
vote
1answer
1k views

Send specific rsyslog facility to remote server and not local

I have a rsyslog facility (local1) that is used by one application only, and I would like to send the logs from that to a remote server but not to the local machine. I've managed to find the info in ...
1
vote
0answers
420 views

Measure EPS (Events per Seconds)

I want to measure the EPS metric, or the number of processed events per seconds in my device. I read that the most accurate measurement of EPS is to use a simple syslog server, such as Kiwi Syslog ...