The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
7 views

Generating Email alert for events in system log

How to generate email alert for every critical event logged in system log /var/log/messages. Suppose, for the following log message, I want an email alert to be generated. Oct 24 11:17:42 eforms ...
0
votes
0answers
28 views

Stopping syslogd also closes /dev/log UNIX domain socket

I am working on a project and from some testing I found out that stopping syslogd daemon also closes /dev/log socket. Is there some other way so that even if syslogd is down, /dev/log socket still ...
0
votes
1answer
29 views

rsyslog doesnt seem to write to log file, without restart after touch'ing the file

I have a separate file for logging local7 facility, and this file is touched and permissions set, from my installer. But sometimes I see that the logs are not being written to it (after I do a ...
2
votes
1answer
50 views

Installing rsyslog from source - No package 'liblogging-stdlog' found

I asked this over in AskUbuntu but have had no luck with an answer. I am doing experiments with different logging systems. At the moment I am trying to install rsyslog from source so I can make some ...
1
vote
2answers
48 views

Force rsyslogd to create new file before somebody will write to it

I'm using rsyslogd 7.4.4 on Ubuntu 14.04. I've updated the configuration file /etc/rsyslog.d/30-component.conf with the following content: # provides UDP syslog reception $ModLoad imudp $UDPServerRun ...
1
vote
0answers
37 views

Get KERN_DEBUG messages into syslog on rhel7/centos7?

I've been trying to get KERN_DEBUG messages logged to a file in centos7, but have had no luck. I can get them just fine from "dmesg," but not /var/log/messages or /var/log/dmesg Here's a MWE kernel ...
0
votes
1answer
16 views

filtering rsyslog log on the server side

Hi I'm trying to filter usb messages, specifically of new connections. all of my clients are configured to send to a central server their 'kern.*' log. problem is I'm getting to much "junk" logs and ...
2
votes
1answer
167 views

How to disable systemd's “Time has been changed” message spam in /var/log/syslog on Debian jessie?

Due to combined use of Debian jessie, that uses systemd by default, and sdwdate (that uses Slow Clock Adjuster ( gh )), my system clock is frequently changed. As a result /var/log/syslog gets ...
0
votes
0answers
61 views

Seeing SSH debug messages in Terminal/console

I am seeing "debug3: Received SSH2_MSG_IGNORE" appear in the terminal on a RHEL 6 Linux server. I thought maybe rsyslog had a console entry, but it doesn't. sshd_config has logging at AUTHPRIV, and ...
1
vote
0answers
59 views

Changing the date format of auth.log

I was looking to change the date format in which auth.log logs information. I could not find a way to do it. Is there a method to do this? My system uses rsyslog.
2
votes
1answer
248 views

How to change ssh log location from /var/log/secure to custom location in rhel 6?

By default in RHEL 6, SSH server logs are sent to /var/log/secure. I want to change this location to a custom one. Is it possible to do that? I have tried modifying the rsyslog.conf file, but it does ...
3
votes
1answer
92 views

Grep with spaces suddenly doesn't work

When performing a grep like: $ tail -f apilog_2014.07.09.log | grep "HELLO" | grep "99999" I get the desired output: 12:22:35 server apache2: HELLO FRIEND 99999 12:22:35 server apache2: HELLO ...
1
vote
1answer
58 views

learning to output custom rsyslogs [closed]

I've installed rsyslog. I want to log why my server is refusing to show my index page in the browser in /var/log/browser.log Should it be listening on a standard port? I can see netstat -tpan. To ...
0
votes
1answer
45 views

don't log cron events in auth.log

In my /etc/rsyslog.conf, I have following line to log auth facility into /var/log/auth.log: auth,authpriv.* /var/log/auth.log but the file is flooded with cron logs, sucgh as these: ...
1
vote
1answer
63 views

How to redirect logs to a fifo device?

I have the following line in the rsyslog config file: *.*;auth,daemon,kern,user -/dev/logi and it does what it should, but I wanted to send some iptables logs to a different file, so I added the ...
3
votes
0answers
282 views

Why does rsyslogd not honor the following lines in rsyslog.d

This is somewhat related to my previous question here. I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf: 00-iptables.conf 50-default.conf postfix.conf The first one ...
1
vote
1answer
216 views

How to check if the remote rsyslog client is running

At the moment I'm implementing the part of the monitoring system that is build around the rsyslog and auditd. I would like to include into the project a correct verification of the fact that remote ...
1
vote
1answer
293 views

Missing Messages and Secure logs files on CentOS

I'm having troubles with CentOS release 6.4 (Final). I'm looking for log files in /var/log/ and I'm obviously missing two files: /var/logs/messages /var/log/secure I was checking if rsyslog is ...
3
votes
3answers
391 views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
3
votes
1answer
1k views

rsyslog not logging

This is an odd issue. I was testing the chrony/ntp services on a RHEL7 VM and was resetting its time as well as the host's. Once I was satisfied with it I checked /var/log/messages and realized it ...
4
votes
2answers
117 views

rsyslog - action AND action

I want to create rule to send data from facility to file AND to MySQL database. How it can realized? Only by adding second line like: syslog.* /var/log/syslog.log syslog.* ...
1
vote
0answers
172 views

rsyslog && sending data to other host

Using CentOS 6.4. Problem is - that messages from kern.* facility doesn't appear on other server. Tring to send data: # logger -p kern.warning -t TEST "Test warning for remote host KERNEL" # logger ...
0
votes
0answers
63 views

Send data from file to rsyslog local0 facility

Is any possibility for logger to permanently get data from file - and send it to local0 facility? Why - I want to collect all data in database. For this - I'm use rsyslog-mysql. In it - I have ...
2
votes
0answers
110 views

Extract particular words from Rsyslog %msg% facility

After lot of search on Google and reading all manuals available on man page and internet, I finally ask here. In my scenario, I have one rsyslog server working with mysql and a custom template ...
0
votes
0answers
62 views

rsyslogd crashes while running from board.(rsyslogd -M /lib/rsyslog option is running well)

when i tried rsyslogd without any option from my board it will give following error. rsyslog runtime error(-2066): could not load module '/home/vipul_test/lib/rsyslog/lmnet.so', dlopen: ...
2
votes
1answer
560 views

rsyslog using short hostname

I'm using CentOS 6.5 and rsyslogd: Name : rsyslog Arch : x86_64 Version : 5.8.10 Release : 8.el6 In rsyslog.d's conf file I have: $PreserveFQDN on and ...
0
votes
0answers
181 views

Rsyslog Problem, Custom Template

I have a problem with rsyslog. bellow is my configuration ,partial. This is File Name Template: $template ...
2
votes
0answers
56 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
3
votes
1answer
213 views

rsyslog conf file problem

I'm running Fedora (F19) and my /var/log/messages is filled with info coming from avahi-daemon: stuff like: Jan 21 14:13:42 localhost avahi-daemon[554]: Invalid response packet from host 10.10.22.3. ...
1
vote
1answer
166 views

logrotate custom “rotate” action equivalent for upstart?

In lots of online posts regarding how to rotate your iptables log files, for example here rsyslog config files get reloaded by the postrotate option of logrotate, presumably in order to stop rsyslog ...
2
votes
1answer
2k views

What does the *.*;auth,authpriv.none -/var/log/syslog line mean in rsyslog config file?

I'm trying to understand the /etc/rsyslog.conf file, but I'm missing something. For example, this is a part of the file: auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none ...
2
votes
2answers
339 views

rsyslog: make %syslogtag% equal length

I have rsyslog configured to log in the following format: $template long-iso,"%$NOW% %timereported:8:15% %syslogtag% %msg%\n" which produces logs like this one: 2013-12-14 15:59:39 ...
1
vote
1answer
565 views

Add year to entries generated by rsyslogd

The default configuration of rsyslogd writes log entries in the traditional format, which looks like this: Nov 30 10:40:01 localhost CRON[30786]: pam_unix(cron:session): session closed for user list ...
1
vote
1answer
554 views

if statement apparently not working in rsyslog

I'm trying to use the RainerScript syntax in my Debian /etc/rsyslog.conf file. I want to log daemon stuff to a particular file, but only from pppd. Here's what I added: if $programname == 'pppd' ...
2
votes
1answer
262 views

Syslog TLS Compression and Message Buffering

Where I work, we have a site-to-site VPN tunnel set up between our main data center and a third party data center that does some Oracle PaaS for us. Since they charge per-VM, we're monitoring the ...
6
votes
2answers
4k views

How to tell rsyslog to create log file if not there?

Default behaviour by rsyslog is to append traces to an existing log file. Now, I've seen (CentOs, Scientific Linux) that when rsyslog is already running, you delete the log file (e.g. the one ...
5
votes
4answers
4k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit ...
4
votes
1answer
90 views

Is it possible to change the priority of a message in rsyslog?

I have a very dramatic and hypocondriac program, and it likes to spew alarming messages to syslog in cases when nothing really important happens. Besides, it sends them with priority "alert", so they ...
2
votes
2answers
247 views

rsyslog: execute script on matching log event

I have the following line in my /etc/rsyslog.conf :programname, contains, "suhosin" /var/log/suhosin.log which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I ...
1
vote
1answer
1k views

Pimp rsyslogd to have less i/o (cron, pam,…) and less logging

On my raspberry I really don't need crons and pam logging and I want to have less i/o to make the SD card life a little longer.. I have already removed cron with the second line cron.none, I'm ...
2
votes
0answers
177 views

Logwatch ignores self-defined service, but explicit setting --service $service works

I am using SSLH on my server to accept both SSL and SSH connections on Port 443. As the logs of sshd and apache2 show each incoming connection via SSLH originating from 127.0.0.1, I want to add the ...
3
votes
1answer
1k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
2
votes
1answer
129 views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
4
votes
1answer
287 views

Preventing output to /var/log/syslog

I have rules such as: if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog and don't want to output messages that go into that log to /var/log/syslog as well. Is ...
1
vote
0answers
76 views

Nested filtering in rsyslogd

I'm using rsyslogd and trying to figure out why things like if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/bla2app work just fine, but if $hostname startswith ...
5
votes
2answers
2k views

rsyslog drops messages excessively

We have a CentOS machine acting as our syslog server. I recently noticed that the machine has been dropping large numbers of syslog messages at times. We have over 250 routers and switches, as well ...
2
votes
2answers
349 views

Start rsyslog as unprivileged user

On Debian, rsyslog runs by default as root (due to POSIX compatibility). It can drop privileges after start, but a cleaner way would be to start as a non-privileged user. Could somebody please advise, ...
2
votes
0answers
801 views

Seagate external hard disk creating problems

I've bought a new hard disk, a Seagate (Backup Plus), but I'm having problems with it. Firstly, it doesn't mounts every time I plug it in. In such cases, I've got to restart the machine to work with ...
1
vote
1answer
289 views

Where does rsyslog keep facility local0?

I added to rsyslog.conf a lines ModLoad imudp UDPServerRun 514 local0.* /var/log/dlink.log With tcpdump I can see the packets from dlink somethimes local0 somethimes local1 even local2. Nothing ...
3
votes
2answers
463 views

If I redirect logs using rsyslog, will dmesg be affected?

I am trying to get some logging in place and am trying to troubleshoot it and this question became relevant. I use rsyslog config files to redirect some of my logging. (Will use iptables logging ...