Questions specific to the syslog-ng logging solution (https://syslog-ng.org/). Use this tag if your question relates to configuring or using syslog-ng, or if you'd like to know if you can solve a particular logging problem with syslog-ng.

learn more… | top users | synonyms

1
vote
0answers
21 views

Date, Facility and Severity is missing in LogAnalyzer

I have install Syslog-NG with MongoDB and LogAnalyzer, and as the Title saying, im missing Date, Facility and Severity on a front page of the LogAnalyzer ( first page ). I get just Hostname and ...
0
votes
0answers
59 views

Error binding socket / syslog-ng

I installed the syslog-ng and once I run the following command, "/usr/local/sbin/syslog-ng" I got bellow error, Error binding socket; addr='AF_INET(0.0.0.0:514)' , error='Address already in use (98)' ...
-1
votes
2answers
352 views

install syslog-ng on CentOS 7

I've just finished installing a fresh installation of syslog-ng on CentOS 7, but syslog-ng.service failed to start. It says: Failed to issue method call: Unit syslog.service failed to load: No ...
1
vote
1answer
177 views

Syslog service fails to start

I have installed syslog-ng 3.5 on RasperryPi Debian Jessie. When I try to start the service, it fails -- Unit syslog.socket has begun starting up. Feb 10 12:29:28 blackbox systemd[1]: Socket service ...
0
votes
2answers
95 views

TLS with syslog-ng 3.2.5

Does syslog-ng 3.2.5 from EPEL 6 (for CentOS 6) support TLS? I cannot get it to work at all; here is what I'm using: source s_network { tcp(ip(0.0.0.0) port(514) tls( ...
0
votes
1answer
11 views

soft-macros are empty in csv parser

I'm trying to parse log messages that are received from a udp port and insert them into a MYSQL database. My destination in my syslog-ng.conf file is as follows: source syslog_udp { ...
0
votes
0answers
59 views

syslog-ng and how to parse for jsession id from tomcat

Just like the title says. I'm trying to parse for the jsessionid from tomcat. Here is what my tomcat server.xml config file looks like: <Valve ...
1
vote
1answer
33 views

logrotate create group not working

cat /etc/issue Welcome to SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) - Kernel \r (\l). rpm -qf /etc/logrotate.conf logrotate-3.7.7-10.22 tail -n15 /etc/logrotate.d/syslog ...
0
votes
1answer
29 views

Upgrading `popt` requires to upgrade too many packages

I am currently in the process of upgrading syslog-ng using rpm. In the upgrade process, I found out that syslog-ng has a dependency with rpm-libs which have a dependency with popt. The dependency tree ...
13
votes
1answer
4k views

Understand logging in Linux

As I understand, Linux kernel logs to /proc/kmsg file(mostly hardware-related messages) and /dev/log socket? Anywhere else? Are other applications also able to send messages to /proc/kmsg or /dev/log? ...
3
votes
2answers
5k views

syslog-ng service not starting with systemd but command works fine

I have a freshly installed version on CentOS 7 once which I have installed syslog-ng from the EPEL repositories. ~: yum list | grep syslog syslog-ng.x86_64 3.5.6-1.el7 ...
0
votes
1answer
68 views

Log transfer using syslog-ng 3.3.5

I want to transfer client logs to a log server but the problem i am facing is that each time client's file gets modified , whole file is transfered to log server so i am getting redundant message at ...
2
votes
1answer
4k views

nginx send log to remote syslog server

I wnat to send nginx access log to a remote syslog-ng server. I installed syslog-ng on each side (server-client). Client: 10.10.10.2 Server: 10.10.10.1 Some log files (messages,syslog,mail.log) are ...
2
votes
1answer
94 views

Preferred approaches to remote logging of a script / daemon?

I run a script as a daemon which gets started and stopped via /etc/init.d on a Raspberry Pi. For a number of reasons - including limited local file storage - I'd like to direct stdout and stderr from ...
4
votes
1answer
113 views

Separate messages of multiple sshds in syslog-ng

Is there a common way of distinguishing between the messages of multiple processes in syslog-ng beside setting different facilities? +1 if filtering and therefore logging in different files would be ...
1
vote
1answer
1k views

syslog-ng won't write to log file - “No such file or directory”

I have set up a fresh instance of syslog-ng using the conf file included below. I can see that messages are trying to route to the right place (var/log/bash) when I look in val/log/messages. But I ...
0
votes
1answer
833 views

Failover with Syslog-ng?

Is it possible to set up a failover mechanism with Syslog-NG opensource edition? I want that the syslog-ng Daemon logs to a remote Loghost and switches to an other server if the first would go down ...
4
votes
2answers
8k views

Log every command typed in any shell: output (from logger function to syslog-ng/journald) contains duplicate entries for commands?

I installed syslog-ng to use on my desktop (Gentoo 64bit, upgraded to systemd i.e. was OpenRC before, with Openbox and Slim only) with my normal user to log all commands I type in the shell (bash ...
0
votes
2answers
164 views

Syslog-ng failover: logserver to local file

We want to use a central Logserver for our Webservers so we can manage everyhing on one machhine. I'm a bit scared of what happens if the network breaks or the Logserver is down. Is it possible that ...
1
vote
0answers
156 views

ssh log sent to email in Cygwin

I am using Cygwin in Windows 7. I am trying to make my syslog-ng daemon send a ssh log via email to me when ever someone tries to log into my computer. I tried using the code below (entered into ...
2
votes
1answer
808 views

Syslog TLS Compression and Message Buffering

Where I work, we have a site-to-site VPN tunnel set up between our main data center and a third party data center that does some Oracle PaaS for us. Since they charge per-VM, we're monitoring the ...
1
vote
1answer
282 views

syslog-ng ignores MSSQL database name

syslog-ng ignores the database defined in syslog-ng.conf and instead uses the default database of the user when logging to MSSQL destination. destination d_mssql { sql(type(mssql) ...
1
vote
1answer
157 views

syslog-ng difference between “not message(something)” and “not match(something)”?

What is the difference between these two?: filter f_avc { not message(something); }; and: filter f_avc { not match(something); }; it's hard to google for these types of questions :D
3
votes
1answer
544 views

Rsyslog Central Log Host

I'm moving from a syslog-ng central log host to rsyslog. I can't even seem to find syslog-ng in the CentOS repos these days. I want to filter logs by hostname and facility. Here is how I do it in ...
4
votes
3answers
4k views

How to exclude given lines in syslog-ng?

I need to exclude a given line in the messages file: Oct 25 04:09:23 SERVERNAME PFILTER-DROP: IN=ifeth4 OUT= MAC=ff:ff:ff:ff:ff:ff:AA:AA:AA:AA:AA:AA:AA:AA SRC=192.168.202.4 DST=192.168.202.255 ...
2
votes
1answer
580 views

Configure & Compile syslog-ng from source, got: Threads are not supported on this platform

I have configure, gmake, and gmake installed syslog-ng-3.4.0alpha1 with eventlog-0.2.12 and other dependencies. From then output of the ./configure --prefix=/syslog --with-gnu-ld, I can see that the ...
2
votes
1answer
3k views

Starting syslog-ng

I've recently installed syslog-ng but am confused about how to start it (on Fedora). I do: /etc/init.d/syslog-ng start which reports that it's started ok. However, it doesn't actually do anything ...
4
votes
1answer
7k views

Converting syslog-ng 3.0? format to 3.2 format

Just rebooted my system to this warning :: Starting Syslog-NG [BUSY] WARNING: Configuration file format is too old, please update ...
2
votes
2answers
310 views

Can I send the ouput of a log to a command as an argument to an option in syslog-ng?

According to the documentation I can execute a program somewhat like so: destination knotifier { program('/path/to/executable'; }; And it will send the log to the stdin of the executable. But what ...