Questions tagged [syslog]
Syslog is a standard for computer data logging. It separates the software that generates messages from the system that stores them and the software that reports and analyzes them.
137
questions
0
votes
0
answers
34
views
How can I be informed if firewalld is disabled
I want to be informed when firewalld is disabled or enabled from logs. For finding this I searched this kind of logs in syslog file but I can't find it. I forward Linux's(RHEL 8/9) logs to the SIEM ...
- 1
1
vote
1
answer
65
views
REDHAT machine + rsyslogd eating up 10+ GB
we notice about this problem recently
we found that rsyslog service is eating memory and some times its up to 10G
we have different kind of redhat machines as version 7.6 and 7.9
is it possible to ...
- 711
0
votes
0
answers
57
views
rsyslog won't start on Debian 10 - activating .. won't even stop :(
I am trying export logs from a client to my rsyslog server via TLS/SSL (with an option when the server is down, the client will queue all logs locally and resume once the server/master is up again)..
...
- 133
1
vote
0
answers
59
views
net.core.netdev_max_backlog - what's the impact when set too HIGH?
I'm working on optimizing and right-sizing my EC2 syslog-ng servers and have some carryover settings in our ansible playbook for kernel settings that were used on "in-house" data center ...
- 11
0
votes
0
answers
61
views
do not rsyslog localhost
tl;dr I want log messages from the local system to use the typical log file paths under /var/log, remote systems to use /var/log/remote/
On an rsyslog server, remote systems are sending their log ...
- 672
0
votes
0
answers
24
views
Winsyslog forward .log file to server
I have winsys log installed. I need to simply forward a .log file loggings to winsyslog server,
I can see client has forwarding options,
So somehow I need to configure, and I should verify from ...
Jagadheeswaran Mohan
1
vote
1
answer
2k
views
Rsyslog forward logs cannot connect Permission Denied
Have configured Rsyslog to ship logs to a remote location through an SSH tunnel.
However rsyslog complains with "Permission denied":
rsyslogd[28412]: cannot connect to 127.0.0.1:10601: ...
- 171
1
vote
2
answers
213
views
Rsyslog: relay messages from UDP input only
Considering a docker container which receives logs on UDP and forwards to a central logging server using TLS, I was wondering if I could be satisfied with one queue or if I needed several.
Indeed, ...
- 13
0
votes
1
answer
232
views
Changing security levels of Fortigate logs?
Tech newbie here.
I want to send Fortigate logs to a syslog server. Previously, I was receiving way too many unnecessary firewall logs, 90% of them with a security level of "notice." I have ...
1
vote
1
answer
171
views
Why would vsftpd be logging to syslog even though logging is disabled in vsftpd?
I have all logging disabled in /etc/vsftpd but for some reason it is still logging to /var/log/syslog and I can't figure out why.
root@unraid:/etc# cat /etc/vsftpd.conf
# vsftpd.conf for unRAID
# ...
- 340
1
vote
1
answer
737
views
Rsyslog logs readable by all users
I have an rsyslog instance in a RHEL8 linux server that is used to collect logs from other systems. That works fine, and it stores all the logs in the /var/log directory with following format /var/log/...
- 113
0
votes
1
answer
400
views
filebeat works from file but not from syslog with checkpoint module
I'm trying send CheckPoint Firewall logs to Elasticsearch 8.0.
I have machine A 192.168.1.123 running Rsyslog receiving logs on port 514 that logs to a file and machine B 192.168.1.234 running ...
- 261
0
votes
0
answers
96
views
Configuring rsyslog output format strings
I'm setting up rsyslog for an application and using the following configuration:
$FileCreateMode 0644
if $programname == 'proxy' then /var/log/proxy/log
& stop
This generates log entries like the ...
- 101
0
votes
1
answer
46
views
"-" symbol into rsyslog.conf file
I see into my "rsyslog.conf" a "-" symbol before the path, what is it?
Example:
mail.info -/var/log/mail.info
mail.err /var/log/mail/err
Thank's
- 1
0
votes
1
answer
43
views
Regex char class - more elegant solution
I have two barracuda FWs with different log structure and a Logstash grok filter plugin that needs to parse them.
values only log entry
+02:00 Info blabla Detect: FWD|TCP|bond0.777|1.1.1.1|53329|...
0
votes
1
answer
3k
views
Getting logger to log to rsyslog in alpine
I installed rsyslog on my Alpine-based system to replace busybox syslogd. After completely disabling syslogd in openrc, enabling ryslog at boot and rebooting, all services correctly started logging to ...
- 549
1
vote
1
answer
331
views
gnome-shell spamming on /var/log/syslog
Moved from https://stackoverflow.com/questions/66061925/gnome-shell-spamming-on-var-log-syslog because it was closed there without a solution; and it's also currently happening to me (I am running ...
- 239
1
vote
1
answer
313
views
Logs missing and empty message when forwarding syslog from macOS
I have tried the syslog forwarding configuration as mentioned in splunk document, But on the syslog server I not getting all logs generated in macOS and also there is no Syslog content (message) in ...
- 11
2
votes
0
answers
240
views
Rsyslog fills up disk - unexpected behaviour
I have a rsyslog that forwards messages to elasticsearch. It worked well for over a year but recently the disk starts to fill mysteriously until it reaches 100%.
When I restart the process the disk ...
- 121
0
votes
1
answer
313
views
SYSLOG-NG: Sending same log to two different index in elasticsearch
I'm trying to send the same log flow to two different elasticsearch indexes, because of users with different roles each index.
I use a file for destination too. Here is a sample:
2021-02-12T14:00:00+...
- 101
1
vote
0
answers
332
views
How to disable logging from a given module on linux (Ubuntu)?
I have some issue on my Ubuntu 20.4 system where the mceusb module is filling up the kern.log and syslog file with messages like:
mceusb 2-2:1.0: Error: urb status = -71/d
This completely filled up ...
- 111
0
votes
1
answer
381
views
Testing syslog-ng on CentOS 8
I am relatively new to Linux and networking but was tasked with the following at work:
I built up a CentOS VM machine ( using VirtualBox) on which I had to install Splunk Heavy Forwarder and syslog-ng....
1
vote
1
answer
334
views
understanding syslog logs format
Im geting syslogs from multiple servers, and Im having trouble to understand some syslog logs, here is one example
<189>12593340: 16596512: Jul 6 20:31:09: %PARSER-5-CFGLOG_LOGGEDCMD: User:...
- 25
4
votes
1
answer
2k
views
How to get SSH logs and send to remote syslog server in macOS?
On Linux, I can get sshd logs such as:
sshd Accepted publickey for user from xxx.xxx.xxx.xxx port xxx ssh2: RSA SHA256:.....
and send them to a remote syslog server by adding a file in /etc/rsyslog.d/...
- 221
1
vote
1
answer
3k
views
How can I get my Cygwin SSH server to log into a file?
On proper Linux systems, the SSH server typically logs into a file, e.g. /var/log/auth.log or /var/log/syslog etc. But - that doesn't exist on my Cygwin system; and merely editing /etc/sshd_config ...
- 8,288
0
votes
0
answers
461
views
How to get syslog in Common event format(CEF)
I want /var/log/syslog in common event format(CEF).Is there any way to convert a syslog into CEF?
Syslog sample
0
votes
1
answer
46
views
configure dockerd to log userid or username of the user who is launching the container
I updated docker daemon config to enable debug mode for dockerd daemon on Linux. And also using rsyslog I managed to create a separate debug log file. Now I want to log the userid/name of the user ...
0
votes
1
answer
64
views
How to save syslog severity <132> to a different file?
We have an old appliance that sends syslog with severity <132> to its management server.
To capture said events the previous team created a tcpdump script and ran it via crontab to capture the ...
- 329
0
votes
1
answer
46
views
Have "individual" logging instead of logging everything to "journalctl" on CentOS 7
On my CentOS 7 system, no output are written to the well known log files and I'm forced to use journalctl to view anything that happening.
For example, there is no data in /var/log/messages, nor /var/...
0
votes
1
answer
381
views
Rsyslog filtering messages based on time
I want to filter logs so that only messages from 13:00-14:00 can go through, how can I do that? I know I can access message content with $msg, but how can I do that for time?
- 5
1
vote
1
answer
4k
views
How to read from syslog?
I can write to syslog via:
logger "foo bar baz"
but how do I read from syslog? my only guess is:
tail -f /var/log/syslog
but that doesn't seem right from my testing.
Note: also looking for a way ...
- 1
1
vote
1
answer
1k
views
Usbrip read from external syslog file
I want to examine usb violations with the usbrip tool (usbrip github) but the source log file which i want to read from is not the local system syslog file. Instead i have an external file.
When i ...
- 21
1
vote
1
answer
279
views
syslog-ng starts and runs fine manually... starts but doesnt create logs when using systemd
Redhat 7.6 with latest syslog-ng (3.22)
ive searched and tried all the old remedies. Nothing has worked to resolve this.
My syslog-ng.conf file has a bunch of ports and a bunch of destinations. When ...
- 23
0
votes
1
answer
179
views
How to append host IP address and host MAC addres to every log message?
I have several log agents with iptables logging rules and default rsyslog config. Rsyslog sends the logs to the central server.
Iptables rule:
iptables -A INPUT -j LOG --log-prefix "INPUT:DROP:" --...
- 3
0
votes
1
answer
403
views
How to know when Rsyslog has read all lines in a file, and have read 100% of a file
I have to pull log files, static files. Let's imagine I have 100 events (100 lines) in a file. Rsyslog has to forward those logs to a server. Once Rsyslog has read the last line, I want to shutdown ...
- 21
1
vote
1
answer
247
views
Debian 9 /var/log/ message, syslog,dmesg are these safe to post to a forum?
On a very stock Debian 9 VPS, running a multiplayer game system with very expensive scripting in it. I am having a problem with that multiplayer server, and one the server developers is asking me to ...
- 35
0
votes
0
answers
990
views
Rsyslog won't forward with JSON template
so I'm trying to use rsyslog to accept udp traffic on port 514, apply a json template, and then send it out over udp to port 10514 (this is so my logstash installation can pick it up). I'm running ...
- 161
0
votes
1
answer
71
views
Using Syslog-kafka got some python syntax erro
I need to send message to my kafka cluster, I do the same like this https://syslogng-kafka.readthedocs.io/en/latest/installation.html
, and /etc/syslog-ng/conf.d/kafka.conf like
destination ...
0
votes
1
answer
1k
views
Foarward logs via Rsyslog to datadog without agents
I am trying to forward my container logs ( apache2 access.log on debian container) to datadog but it didn't work . ifollowed this tutorial
this is rsyslog.conf file
# /etc/rsyslog.conf ...
- 1
0
votes
1
answer
1k
views
How to setup blacklist rule of elastalert
I have syslog messages of following type. I want to capture all such messages which contains "errors" in message field of syslog.
<30>Apr 9 04:27:13 ip-172-31-26-235 POSTMETHOD_fx-control-...
- 149
1
vote
0
answers
472
views
Log correlation with syslog-ng patterndb
I'm trying to play with syslog-ng and patterndb and I am having trouble with log correlation.
The documentation on how to do it is here : https://www.syslog-ng.com/technical-documents/doc/syslog-ng-...
- 11
1
vote
1
answer
526
views
How to convert rsyslog octal codes to ascii
Rsyslog by default uses octal codes to encode control codes and whitespace: #012 for newline, #011 for tab
A Google search only turned up results on how to convert octal codes using the standard \012 ...
- 567
0
votes
0
answers
50
views
Linux log grows large, resets, does it again
Am running Ubuntu 18 and don't have a ton on their for apps. The hardware is setup with one 120gb SSD as root/boot and the rest of the drives as 2 pair of raid drives where media files, etc... reside.
...
- 113
1
vote
1
answer
481
views
Rsyslog only log snort and dns
I'm currently running Graylog to receive logs from my Pi-Hole and Snort instance.
However, rsyslog is sending all logs e.g. java, sudo etc as well.
How do I configure Rsyslog to only log Snort ...
- 11
1
vote
1
answer
294
views
Prevent program from writing to journal
I'm using openconnect with some VPN's, and after a while I see that the journald and syslog are using a lot of resources. The vpn's still work perfectly, but the computer gets really slow. After ...
- 31
1
vote
1
answer
577
views
List of all the syslog messages?
I want to be able to filter for specific entries in the Syslog on my Linux computer. For instance, I'd like to be able to filter for user authentication failure or success, or for access to sensitive ...
- 129
0
votes
1
answer
4k
views
syslog : How can I filter syslog messages on windows 10?
I would like to how I can filter syslog messages to get only the ones I am interested in on Windows 10.
For example I would like to get the syslog message when the identification/authentication of a ...
- 129
0
votes
1
answer
295
views
How do I log syslog to virtual console from systemd?
This fails:
$ cat /etc/systemd/system/getty@tty8.service.d/override.conf
[Service]
ExecStart=
ExecStart=-/usr/bin/tail -f /var/log/syslog
Aug 2 11:28:22 darts02 tail[317]: Aug 2 11:28:18 darts02 ...
- 180
1
vote
1
answer
2k
views
The log files are empty
I found out that my /var/log/messages is empty!
Also my /var/log/auth.log is also empty!
Also it is not logging any messages.
My /etc/rsyslog.conf file is as follows:
# /etc/rsyslog.conf ...
- 171
0
votes
0
answers
522
views
How to find the client IP/name from the audit logs
I'm auditing the files in a nfs share. When I look at the audit logs using the command ausearch -f /var/nfs/general , I get some logs that looks like this:
In the server side:
time->Tue Jun 12 16:...
- 171