The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
29 views

Analyzing logs offsite, with a different computer

I have a computer deployed with no internet access. I have small windows in which to copy the log directory to a USB stick and analyze offsite. If I pull the logs off of a CentOS / RHEL system ...
1
vote
1answer
32 views

Create new syslog file on boot

I want to create a new syslog file each time the system boots and save the old data in another file so that I can detect abnormal behavior on the current boot if any. Is there any configuration for ...
3
votes
0answers
65 views

Why does the syslog timestamp not include a year?

I am planning to store some of my log messages for more than a year, but the syslog timestamp description from RFC3164 does not include a year in the timestamp portion of a log entry. An example ...
1
vote
1answer
10 views

syslog set tag from api?

I can pump messages into rsyslog with a syslogtag using the following from the command line using the -t option: myprogram | logger -t MYTAG And later filter based on that tag: :syslogtag, ...
0
votes
2answers
22 views

Save syslog from honeypot to a host virtual machine

So im making a research honeypot. The host is ubuntu 14.04. I want to store all of the logs from the honeypot ssh to the ubuntu host so the data is not lost. Does anyone know anything about this? I ...
0
votes
2answers
30 views

syslog-ng.conf under SLES 12

Where can I find the syslog config file under SLES 12? rsyslog and syslog-service are installed according to YaST2 and rcsyslog status outputs: ServerName:~ # rcsyslog status Usage: /sbin/rcsyslog ...
0
votes
0answers
8 views

syslog - remote logging (remote server)

I have few applications running on my machine. Example: : /var/cacti/logs/Eload1.log Whatever is written to this log i would like it to be logging/written to: @syslogserver Is this possible?
1
vote
1answer
19 views

Why is logcheck reporting successful Horde logins?

I'm running Ubuntu 14.04 LTS server and use logcheck to report log messages. I have the logcheck-database installed which contains a horde3 ignore file for the server: ^\w{3} [ :0-9]{11} ...
0
votes
0answers
19 views

Equivalent to syslog-ng program-override option for rsyslog

I would like to know what is the rsyslog equivalent to the program-override option in syslog-ng?
0
votes
0answers
54 views

Why doesn't syslog traffic show up in netstat and lsof output?

I've noticed on my CentOS 5.x system that outbound syslog traffic (UDP) doesn't show up in lsof or netstat results. I've even tried stuff like watch -n .1 'netstat -l -u -n --program' to make sure ...
0
votes
1answer
153 views

How to redirect logs to syslog for an application which doesn't support syslog yet?

Nginx adds logging to syslog feature in version 1.7.1. I can only get the version 1.6.2 from ppa:nginx/stable, or the version 1.4.6 from the default Ubuntu package sources. I have a common log ...
0
votes
1answer
47 views

Understanding network problem (syslog)

I am running a lubuntu 14.04 server and its always worked well, except for the last couple of days it keeps dropping off the LAN. I am using a couple of powerlink adapters to connect it up as WiFi was ...
0
votes
0answers
73 views

Is there a “supported” way in RHEL/CentOS 7 to union-mount a directory tree on top of an NFS mount point?

I have an NFS share containing almost 500 chrooted (s)ftp user's home directories. This NFS share is mounted on several FTP servers forming a highly available FTP cluster. I would like to enable ...
0
votes
1answer
29 views

Disable log of specified crontab item

How can i disable logging for specified item/line in crontab? (i´m on debian/raspbian) I have a script that checks if wlan0 is up every minute, but i don't like that cron logs every minute on syslog ...
0
votes
0answers
54 views

Syslog message “rt_bind_peer(0) @ffffffffa0283f57”, twice in every second

My /var/log/syslog on a Debian server is flooded with lines similar to: Dec 23 16:05:40 server1 kernel: [ 686.957585] rt_bind_peer(0) @ffffffffa0283f57 These messages occur up to twice a second ...
2
votes
3answers
62 views

In HP-UX, how can I log Informational Only system event messages in syslog.log?

I was getting some Informational Only single-bit memory errors on a server for at least three weeks, but I only happened to notice them because I went looking through the SEL via the MP console for an ...
0
votes
1answer
35 views

Logging of what ended a process?

Due to the tight resources of the server, I suspect System will end processes from time to time. I want those events to be logged in a separate file for investigation. How do I set that in ...
1
vote
1answer
32 views

How should unix application log huge amounts of data?

I'm worried that my application might produce huge amounts of logs for some users. What should I take into consideration so that usability is not hampered (support rolling etc.)? Is there a standard ...
4
votes
1answer
203 views

cronjob does not execute when not logged in

SOLVED, see 'useless' answer. I have a cronjob in my crontab. When I specify the job to be executed in 2minutes, I wait, and then I can see files created by the job, I can see the process with ps. ...
1
vote
1answer
150 views

HPUX logging ftp connection

Host is 11iV3. I am trying to log ftp transfert outside syslog.log in /etc/inetd.conf ftp stream tcp6 nowait root /usr/lbin/ftpd ftpd -u 022 -o -i -X where -i/-o tell ftpd to log ...
0
votes
0answers
102 views

Stopping syslogd also closes /dev/log UNIX domain socket

I am working on a project and from some testing I found out that stopping syslogd daemon also closes /dev/log socket. Is there some other way so that even if syslogd is down, /dev/log socket still ...
1
vote
1answer
384 views

How do I troubleshoot ssh tunnels disconnection?

I am using SSH tunnels launched via autossh at boot on a device installed at remote locations. Up to now everything was working fine but yesterday the connection partly went down and autossh wouldn't ...
3
votes
1answer
27 views

Extract file from completely disconnected machine, possibly via Kernel messages

I have a VPS running inside an OpenStack cloud that has more or less crashed completely - the provider hasn't been able to get any kind of networking on it for over 2 days, seems completely broken on ...
0
votes
1answer
138 views

When does Linux send a root mail and how to force it for testing purposes?

Let's say I want to test root mail functionality after I set up nullmailer, how do I force my Debian Linux system to send a root mail? And furthermore on which events does Linux send root mails at ...
3
votes
1answer
698 views

Why does abrt take over log output for a process that didn't crash?

Short version: I have a long-running process (web proxy) that logs (verbosely) to syslog Something bad happens, and abrt steps in somehow The process continues to run... ...but all log messages to ...
1
vote
2answers
260 views

HPUX Logging Logins

I'm trying to enable security logging on some HPUX11 systems. I can get HPUX to generate a message that: a login is being attempted (username, no source IP) a login failed (no username or source ...
0
votes
1answer
50 views

Syslog log analyzer

Is there any syslog log analyzer script I can install on hosting to track user activity? I have giant user log and I need more specific log details.
2
votes
1answer
371 views

How to disable systemd's “Time has been changed” message spam in /var/log/syslog on Debian jessie?

Due to combined use of Debian jessie, that uses systemd by default, and sdwdate (that uses Slow Clock Adjuster ( gh )), my system clock is frequently changed. As a result /var/log/syslog gets ...
0
votes
1answer
68 views

dansguardian not using syslog

I configured dansguardian to use syslog, but I still see files in /var/log/dansguardian getting populated. I saw there was a bug for Fedora 12, I am using Fedora 20. Is this a known issue or is it a ...
0
votes
1answer
1k views

Logstash agent does not send logs to Redis server

I can't ship logs from Logstash to Redis server. Getting this error: Failed to send event to redis {:event=>#<LogStash::Event:0x7ccb7867 @cancelled=false, @data={"message"=>"welocwelcome", ...
1
vote
1answer
477 views

upstart writing to syslog in a simple way

I have an upstart script that uses pre-start script exec >/dev/kmsg 2>&1 echo starting program # run my program here npm install node app.js end script to redirect output of a ...
3
votes
0answers
793 views

Why does rsyslogd not honor the following lines in rsyslog.d

This is somewhat related to my previous question here. I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf: 00-iptables.conf 50-default.conf postfix.conf The first one ...
2
votes
1answer
448 views

Remote syslog command line Client

I use logger pretty regularly, but is there a FOSS command line tool for remote submission of syslog messages over the network? Right now, I have to configure a facility/priority pair to submit to a ...
4
votes
1answer
66 views

Seperate messages of multiple sshds in syslog-ng

Is there a common way of distinguishing between the messages of multiple processes in syslog-ng beside setting different facilities? +1 if filtering and therefore logging in different files would be ...
3
votes
1answer
3k views

rsyslog not logging

This is an odd issue. I was testing the chrony/ntp services on a RHEL7 VM and was resetting its time as well as the host's. Once I was satisfied with it I checked /var/log/messages and realized it ...
4
votes
2answers
173 views

rsyslog - action AND action

I want to create rule to send data from facility to file AND to MySQL database. How it can realized? Only by adding second line like: syslog.* /var/log/syslog.log syslog.* ...
7
votes
1answer
848 views

Where does the kernel ring buffer sit compared to rsyslog?

Is rsyslog just an abstraction layer on top of the kernel ring buffer? Or is the kernel ring buffer its own entity and rsyslogs interaction is like that of any other "application"?
2
votes
1answer
177 views

Best practices for maintaining error logs (system, device driver & application)

I have many Pandaboards with Ubuntu armhf and one PC server networked with Wi-Fi. On each embedded board I have a real-time application running constantly. I don't know how to reasonably maintain the ...
2
votes
1answer
489 views

How to redirect Tomcat logs back to catalina.out instead of syslog?

In the release notes for openSUSE 13.1, developers proudly stated that Tomcat logs are no longer being written into catalina.out, but rather written to syslog. I saw similar behaviour with new ...
1
vote
2answers
63 views

Basic syslog confusion

When an application logs using syslog does it mean that it stores the logs somewhere under /var/log? Or can it be elsewhere as well?
0
votes
1answer
293 views

Separate SSHD Authpriv logs into /var/log/sshd, all other authpriv logging goes to messages

Right now, sshd is using the authpriv facility. The level of logging is fine, but I don't want it in the syslog, I want it to go to /var/log/sshd (which doesn't yet exist) on Red Hat Linux/Enterprise ...
6
votes
3answers
1k views

How to send snmp trap when syslog is logged?

I need to send snmp trap n number of host whenever any syslog is logged in /var/log/messages. How can I do this, can anybody give me any idea?
3
votes
1answer
1k views

Does “syslogd” cause “cat /proc/kmsg” not to work properly?

I'm using cat /proc/kmsg to determine which process and file was involved in certain disc writes. I'm using the method given in this answer. But when I use cat /proc/kmsg, the output doesn't always ...
1
vote
1answer
204 views

journalctl process groups

I recently tried setting up the ChrootDirectory property in sshd_config and ran into the ownership problems for chroot targets. After i have fixed the problem i noticed that syslog-ng had created log ...
7
votes
4answers
11k views

How to make log-rotate change take effect

I followed this link to change log-rotate configuration for RHEL 6 After I made the change to config file, what should I do to let this take effect?
0
votes
1answer
65 views

Getting info from syslog.txt

I am looking for some cool commands I can use to pull pieces of information out of a syslog. Mostly using this as a learning experience. Let's say I have a syslog showing dropped/accepted ...
1
vote
1answer
683 views

syslog-ng won't write to log file - “No such file or directory”

I have set up a fresh instance of syslog-ng using the conf file included below. I can see that messages are trying to route to the right place (var/log/bash) when I look in val/log/messages. But I ...
0
votes
1answer
275 views

Failover with Syslog-ng?

Is it possible to set up a failover mechanism with Syslog-NG opensource edition? I want that the syslog-ng Daemon logs to a remote Loghost and switches to an other server if the first would go down ...
0
votes
0answers
63 views

Smarter log rotation

I want to reduce the amount of logs in my system, but reduce them smartly. The general idea is, each time you rotate, look for any warning/error/critical level logs, and keep 2 minutes of log context ...
2
votes
0answers
69 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...