0
votes
0answers
44 views

Seeing SSH debug messages in Terminal/console

I am seeing "debug3: Received SSH2_MSG_IGNORE" appear in the terminal on a RHEL 6 Linux server. I thought maybe rsyslog had a console entry, but it doesn't. sshd_config has logging at AUTHPRIV, and ...
1
vote
0answers
45 views

Changing the date format of auth.log

I was looking to change the date format in which auth.log logs information. I could not find a way to do it. Is there a method to do this? My system uses rsyslog.
2
votes
1answer
34 views

don't log cron events in auth.log

In my /etc/rsyslog.conf, I have following line to log auth facility into /var/log/auth.log: auth,authpriv.* /var/log/auth.log but the file is flooded with cron logs, sucgh as these: ...
1
vote
0answers
49 views

How to redirect logs to a fifo device?

I have the following line in the rsyslog config file: *.*;auth,daemon,kern,user -/dev/logi and it does what it should, but I wanted to send some iptables logs to a different file, so I added the ...
1
vote
1answer
175 views

Missing Messages and Secure logs files on CentOS

I'm having troubles with CentOS release 6.4 (Final). I'm looking for log files in /var/log/ and I'm obviously missing two files: /var/logs/messages /var/log/secure I was checking if rsyslog is ...
3
votes
3answers
242 views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
2
votes
0answers
97 views

Extract particular words from Rsyslog %msg% facility

After lot of search on Google and reading all manuals available on man page and internet, I finally ask here. In my scenario, I have one rsyslog server working with mysql and a custom template ...
2
votes
0answers
54 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
3
votes
2answers
263 views

rsyslog: make %syslogtag% equal length

I have rsyslog configured to log in the following format: $template long-iso,"%$NOW% %timereported:8:15% %syslogtag% %msg%\n" which produces logs like this one: 2013-12-14 15:59:39 ...
6
votes
2answers
3k views

How to tell rsyslog to create log file if not there?

Default behaviour by rsyslog is to append traces to an existing log file. Now, I've seen (CentOs, Scientific Linux) that when rsyslog is already running, you delete the log file (e.g. the one ...
5
votes
3answers
3k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit ...
2
votes
0answers
160 views

Logwatch ignores self-defined service, but explicit setting --service $service works

I am using SSLH on my server to accept both SSL and SSH connections on Port 443. As the logs of sshd and apache2 show each incoming connection via SSLH originating from 127.0.0.1, I want to add the ...
4
votes
1answer
262 views

Preventing output to /var/log/syslog

I have rules such as: if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog and don't want to output messages that go into that log to /var/log/syslog as well. Is ...
1
vote
0answers
74 views

Nested filtering in rsyslogd

I'm using rsyslogd and trying to figure out why things like if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/bla2app work just fine, but if $hostname startswith ...
3
votes
2answers
449 views

If I redirect logs using rsyslog, will dmesg be affected?

I am trying to get some logging in place and am trying to troubleshoot it and this question became relevant. I use rsyslog config files to redirect some of my logging. (Will use iptables logging ...
1
vote
1answer
498 views

How to set up a daemon to monitor an error log and trigger email notifications alerts (maybe syslogd?)

I have a log file that my custom application uses named 'application.log'. I want to set up a daemon that will monitor this file and scan for any errors marked CRIT and ignore the other DEBUG and ...
1
vote
1answer
413 views

Behavior of rsyslog writing to a pipe

I configure rsyslog with an additional entry, like this: *.* |/var/log/logpipes/pipe1 and have my own evaluation program for the messages received. This works so far, but I am unsure, how rsyslog ...
1
vote
0answers
273 views

really basic bootstrap logger - (preferably syslog, cascade to http/raw)

I have a bootstrap shell script that is run as the very first thing when a fresh Linux server is booted up to multi-user mode with networking. Once it is complete, I would like to report the error ...
30
votes
1answer
4k views

How to do a `tail -f` of log rotated files?

On a long running system I usually have a terminal with $ tail -f /var/log/kern.log or something like this open. But from time to time I have to restart such command because no new messages are ...
4
votes
3answers
121 views

How to deal with a pre-packaged program not adhering to the Rule of Silence?

Concrete problem: Mailman comes with a script to synchronize mailing list subscribers from a flat file (sync_members(8)). This script does not very well adhere to the Rule of Silence. For example, ...
7
votes
2answers
9k views

add new syslog facility

I would like to use syslog to log messages coming from my PHP based site. My question is - can I add custom facility name? I know there are predefined facilities like: auth, authpriv, cron, dæmon, ...
5
votes
2answers
3k views

How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?

I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
5
votes
1answer
563 views

rsyslog rule inconsistently applied

I have created a rule to redirect messages containing {FILTER} in file /etc/rsyslog.d/40-filter.conf :msg,contains,"{FILTER}" /var/log/filter.log & ~ I have edited file /etc/rsyslog.conf so it ...
2
votes
2answers
1k views

rsyslog is not discarding message as it should

I have setup rsyslog to write messages from local0.* to a seperate logfile, and then discard the messages. For some reason, the logs are going to both /var/log/syslog, and the new logfile. I have ...
10
votes
2answers
2k views

Parse syslog messages into separate MySQL tables with rsyslog

Out of the box rsyslog will dump everything into the SystemEvents table within the `Syslog database (if you use the default schema provided). I would like to use a regular expression to filter inbound ...