Tag Info

Hot answers tagged

5

It seems to me that your config file uses the wrong quotes: “ vs. " So the quotes are seen as part of the name. “/var/log/bash” -> 93 2f 76 61 72 2f 6c 6f 67 2f 62 61 73 68 94 "/var/log/bash" -> 22 2f 76 61 72 2f 6c 6f 67 2f 62 61 73 68 22


4

You have a lot going on there..... My best answer to this is to explain simply how I have seen session logging done in the past. Hopefully that will give you some options to explore. As you have already mentioned, pulling the bash history from the user accounts. This only works after the session has ended. Not really the best option but it's easy and ...


3

Change the name of the executable (note that that also affects PAM configuration). ln /path/to/sshd /path/to/sshd-whatever Start as /path/to/sshd-whatever. And define PAM configuration in /etc/pam.d/sshd-whatever. Log entries will show as sshd-whatever instead of sshd.


3

This is done via templates, like this: $template HostDynFile,"/var/log/HOSTS/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/%syslogfacility-text%_%HOSTNAME%_%$YEAR%_%$MONTH%_%$DAY%" This template can then be used when defining an output selector line, e.g.: *.* -?HostDynFile More info is available here: Building A Central Loghost On CentOS And RHEL 5 With rsyslog


3

BEFORE: SERVER:/etc/syslog-ng # tail -3 syslog-ng.conf # # log { source(src); destination(/var/log/messages); }; SERVER:/etc/syslog-ng # EDIT THE syslog-ng.conf FILE: vi /etc/syslog-ng/syslog-ng.conf AFTER: SERVER:/etc/syslog-ng # tail -3 syslog-ng.conf #log { source(src); destination(/var/log/messages); }; filter heartbeat_filter { not ...


2

How can I extend this excluding rule to filter only those lines that contain: "DST=192.168.202.255" AND uses "udp" AND "PFILTER-DROP"? Use something like: filter demo_filter { program("PFILTER-DROP") and match("DST=192.168.202.255") and match("PROTO=UDP"); };


2

You can use a filter to match the program sending the message, in this case PFILTER-DROP, like this: filter f_pfilterdrop { program("PFILTER-DROP"); }; Then you include this filter in the log statement that writes to this log.


1

That functionality was once reserved to the commercial variant of nginx, but has since been included in the OS version. You can use the nginx module ngx_http_log_module for that. Here's a link to the module documentation, explaining the setup and configuration: http://nginx.org/en/docs/http/ngx_http_log_module.html Usage Syntax: access_log path [format ...


1

Sounds like rsyslog queueing might do what you want. Messages can also be stored for transmission during off-peak hours. Specifically, the following: The "$QueueDequeueSlowdown" directive allows to specify how long (in microseconds) dequeueing should be delayed.


1

From the Documentation (my boldface): Match a regular expression to the headers and the message itself (i.e., the values returned by the MSGHDR and MSG macros). Match a regular expression to the text of the log message, excluding the headers (i.e., the value returned by the MSG macros).


1

Three notes: you should use a current git snapshot instead of alpha1, as alpha1 crashes on start-up. please ask on the syslog-ng mailing list, as there are more people to answer your question, including syslog-ng developers. even current git needs a patch, see this thread on the mailing list: 3.4 on opensuse factory


1

Recent Fedora versions ship with systemd. There you could change to syslog-ng using the following commands: yum install syslog-ng systemctl disable rsyslog.service systemctl enable syslog-ng.service systemctl stop rsyslog.service systemctl start syslog-ng.service At the end probably also remove rsyslog with rpm -e rsyslog.



Only top voted, non community-wiki answers of a minimum length are eligible