The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [syslog]

syslog is a standard (RFC 5424) for message logging. Use this tag for syslog logging related messages. For generic logging messages use [logging] instead

Filter by
Sorted by
Tagged with
2
votes
2answers
28 views

How to split logs into monthly, daily and hourly folders when bringing in syslog events?

I am bringing in log files via rsyslog and my config looks like the following: root@rhel:/etc/rsyslog.d# head mail_prod_logs.conf if $fromhost-ip=="10.10.10.10" and $programname=="AMP_Logs" then -/...
0
votes
1answer
15 views

How to edit my config file to create two log files while ingesting syslog events?

I am sending mail message logs and amp logs from the same server 10.10.10.10 via syslog to my RHEL7 server. I am running rsyslog and have the following config file: mail_logs.conf $template ...
0
votes
0answers
10 views

How to read from syslog using systemd service

Does anyone know what the proper way is to create a systemd service and read from syslog write the logs out to the network? I had this in a service: tail -f /var/log/syslog | ...
0
votes
0answers
10 views

rsyslogd missing message?

I set up a logging host in the ryslogd config using python, restart daemon etc and get a correct message: Sep 20 09:03:20 Desk-r6 CLI[13845]: (admin) (root) (192.168.1.10) startup : Success Code to ...
-1
votes
1answer
19 views

allow user access to syslog

I'm running an embedded Linux (Dreadnaught), and I'd like to be able to manually enter a line into the syslog as the user login, and have the result of other commands stored in the syslog. e.g.: ...
0
votes
0answers
25 views

How to mute syslog from console, without using actual syslog daemon?

I usually switch between Xorg and (framebuffer) text console a lot. But every time I switch to text console, I got a message like this on the text console: acpid: client 7251[0:0] has disconnected ...
0
votes
0answers
19 views

Logger on remote server

I am trying to send log message to my virtual machine from work station. Command : logger -n 192.168.122.78 Test After this command nothing shows up in /var/log/messages of VM, or work station. No ...
0
votes
0answers
20 views

Syslog problems when running an old version of wu-ftpd in Docker

I am implementing the ftpd exploit found here in a Docker container. I have downloaded the rpm, and I install it with the following dockerfile: FROM centos:7 WORKDIR /ftpd/ COPY ...
0
votes
0answers
22 views

$InputTCPMaxListeners and $InputTCPMaxSessions not being respected

I have set up many rulesets with $RulesetCreateMainQueue on and when I prepend $InputTCPMaxListeners and $InputTCPMaxSessions before any $InputTCPServerRun directives, the $InputTCPMaxListeners and $...
1
vote
2answers
46 views

rsyslog filter severity not working

I have following Rsyslog config to send logs to remote servers. Problem is its sending lots of INFO mesg to remote server and i don't want that noise. I am trying to configure filter so it send all ...
1
vote
1answer
46 views

Does not write logs into /var/log/security after I modified this file

I run a script that modifies /var/log/security. If someone tries to connect to my server via ssh, this event writes into /var/log/security.( I have set firewall_enable="YES" and firewall_logging="...
1
vote
0answers
73 views

Auditd, Syslog and Journald

I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me. According to the things I read, auditd audits events in the ...
0
votes
0answers
26 views

No irq handler for vector when using hwinfo --short

I have been reading the various fora, while they seem to fix the annoying error, they don't tell the reason why the error crops in the first place. The error message I get - Message from syslogd@...
1
vote
4answers
227 views

How to convert Syslog Date-Time [UTC] to Epoch?

I am currently piecing together a tool to work with Syslogs generated in my network, one of the requirements is to convert the DateTime from the format in which it is in syslog (%b %d %Y %T) to epoch. ...
0
votes
0answers
60 views

How computationally heavy is converting datetime to epoch? [duplicate]

I am writing a shell script to help me work with the syslog's generated in my network. In brief the goal is to grep the logs I am interested in and append them separately to another file (lets say ...
2
votes
0answers
25 views

Removed debug.log, and it is not generating again

Using RHEL 7.2, due to larger file size I've removed debug.log (from /var/log/debug.log). And after that debug.log file is not generating automatically. I've checked "messages" log it's working fine.
1
vote
1answer
32 views

Syslog not working if program is started from init.d [closed]

I have a program that needs to run on start up. If i run the script from terminal /etc/init.d/Program_B.sh syslog is working fine. However, the program does NOT log into syslog on boot even though it ...
0
votes
0answers
40 views

Program not working after setting script in init.d

I have two programs that need to run on start up. I am using init.d scripts because the virtual machine in my system does not have systemctl. With my configuration program_A is working but program_B ...
1
vote
0answers
22 views

Duplicate entry in /var/log/syslog … sh vs dhcpd

Whenever I run tail -F /var/log/syslog, I notice there is duplicate entry in the log. user@svr01:~$ tail -F /var/log/syslog Jun 19 03:13:37 svr01 dhcpd[2361]: in your dhcpd.conf file for the ...
0
votes
0answers
17 views

Can I issue a command when a specific message issued in the syslog [duplicate]

I am having power problems with my USB devices which is proving difficult to resolve. However I can see on the syslog that there is a specific error message which shows there is a problem. What I ...
0
votes
0answers
74 views

syslog-ng execute script on syslog pattern

I have a simple requirement. I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script. ...
1
vote
0answers
203 views

How to monitor system with `snort` and send emails about `alerts`

PROBLEM: I have been configuring snort on my systems and would like to get emails from the systems if there are any alerts. What I have tried is swatch but I can't find much documentation on it, can ...
0
votes
1answer
67 views

`syslog` spammed by `dbus-daemon`, claims that unit `tracker-extract.service` is masked

[5.0.9-arch1-1-ARCH with gnome-desktop 3.32.1.2-1 and tracker 2.2.1] This is a follow-up on a previous answered question, where I unmasked the tracker-store.service, which was spamming my syslog at ...
-2
votes
1answer
351 views

OpenVPN doesn't seem to run: active (exited), code=exited, status=0/SUCCESS

I'm trying to run OpenVPN on Ubuntu remote server. I've been following this tutorial. As of now, I'm right before Step 3, trying to get "VPN 'server' is running" message. However, when I run service ...
1
vote
1answer
236 views

Gnome-desktop's 'tracker' spams syslog at boot

[5.0.9-arch1-1-ARCH with gnome-desktop 3.32.1.2-1 and tracker 2.2.1] My syslog at boot ($ sudo journalctl -b) is being spammed by messages about tracker-miner not being able to execute sparql along ...
1
vote
0answers
44 views

Docker Debian, getting some specific syslog in the docker container log

I have been installing SSH in the Debian Docker. Since I wanted to have some extra log, I also installed the Rsyslog as described in this question. Result was that some extra logs are created e.g. ...
0
votes
0answers
22 views

Losing syslog packets between hosts

I am losing syslog packets between two redhat servers. They are both virtual machines and have a couple of virtual firewalls inbetween them. I have no access to the firewalls but am assured that the ...
0
votes
1answer
146 views

Logrotate is not compressing

I need to compress the files in var/log/remots/*/* with the following logrotate rule /var/log/remots/*/* { rotate 178 daily maxage 178 compress } located in /etc/logrotate.d/remots. ...
0
votes
0answers
11 views

Failing to install my syslog-startup.conf via yocto bitbake

I'm trying to install my own syslog-startup.conf file as a part of the busybox recipe. The file will look like this: DESTINATION=file # log destinations (buffer file remote) LOGFILE=/mnt/userrw/...
0
votes
1answer
72 views

Syslog to console, drawbacks?

I am wondering are there any drawback (performance wise) when output from some software is not logged to a file, but instead to console? Specific case would be running Docker containers, as some of ...
0
votes
1answer
315 views

How to keep kern.log out of syslog

I'm working on Ubuntu 16.04.3 and I found that I could get the log of kernel from two places: /var/log/kern.log and /var/log/syslog. /var/log/syslog contains other logs but I could find /var/log/kern....
0
votes
0answers
14 views

ksystemlog not working on Red Hat 7: “Error: BadDrawable (invalid Pixmap or Window parameter) 9”

Launching ksystemlog from the UI or the command sudo /bin/ksystemlog --icon utilities-log-viewer results in blank window and a ton of errors like this: Error: BadDrawable (invalid Pixmap or Window ...
0
votes
2answers
105 views

Syslog Output File Splitting HOURLY at Syslog Server

I have implemented syslog server on CentOS and using below Template to generate output file on daily basis - $template TmplNationalIP_PL, "/var/log/NIPFW/MX480/CGNAT_PL_%$year%.%$month%.%$day%" if ($...
4
votes
1answer
60 views

I have three different timezones on my Debian Linux

I use Debian 9.5.1. I used the dpkg-reconfigure tzdata command to set my timezone to Tehran. Now I have three timezones in my Linux. I execute the following three command together and look at logs: ...
1
vote
0answers
154 views

CentOS: Collecting and analysing logs using NXlog and OSSIM

Objective: Forward logs from all servers to OSSIM, correctly formatted and readable. Steps: Deploying one NXlog Collector/proxy node in each network zone - DONE Deploying one NXlog Collector/master ...
0
votes
0answers
602 views

Error while dialing dial unix /run/containerd/containerd.sock: connect: connection refused\“” module=libcontainerd namespace=plugins.moby`

Can someone explain what the following error in/var/log/syslog means? I don't know if I picked the relevant part, there is a lot more information in the log. Feb 4 10:57:51 chriad-VirtualBox dockerd[...
0
votes
2answers
147 views

How can I configure a running kernel to output dmesg info directly to the tty, without involving any userspace programs?

There are a large variety of questions floating around the 'net from people who want to watch the output of dmesg in real time. All the suggestions and answers involve using dmesg -w, tail, journalctl ...
1
vote
0answers
254 views

Nvidia-persistenced in syslog

On boot, I saw multiple lines about nvidia flashing on-screen before the X login screen. Looking at the /var/log/syslog, grep showed many entries about nvidia-persistenced on boot. It seems to start ...
-1
votes
2answers
26 views

log file question [closed]

I have a program that put out a log file to the /var/log/myfiles/ directory. these files are kept small in size and the file name is incremented by number . at the end of the day I want to cat the ...
0
votes
0answers
99 views

rsyslog: send logs to different file by filtering syslogs

I have a CentOS based rsyslog server which have the below settings, where it's getting all the remote NATing events from multiple hosts. $template TmplcpFW, "/var/log/%HOSTNAME%.log" if ($hostname == ...
2
votes
1answer
193 views

Source of this error: udevd [ PID ]: inotify_add_watch(6, /dev/sda, 10) failed: operation not permitted

We have this log in our syslog: udevd [ PID ]: inotify_add_watch(6, /dev/sda, 10) failed: operation not permitted Why do we get this error and how do we solve it? Our environment: Ubuntu 12.04; LXC;...
1
vote
1answer
44 views

Track active logging to log files

Is there a way to track which service/file is actively logging to a log file? In this case taking info from the syslog file and creating a file called filtered.log. I'm not seeing a process for ...
1
vote
1answer
920 views

rsyslog: send logs to different file using custom template

So, I'm using systemd to send the logs to rsyslog, and I want to write the logs to /var/log/app.log. Since it is a Java app with its own log format, I don't want to have timestamps or anything on it,...
1
vote
1answer
120 views

My attempts to use rsyslog to route messages to a log file

In myapp.service, I have : StandardOutput=syslog StandardErr=syslog When I do : $ journalctl -e -u myapp I can see each line of log contains "myapp[PID]". I've tried to set up /etc/rsyslog.d/...
0
votes
1answer
193 views

syslog-ng modification issue for unix socket

I am having issue researching the right way to go about a problem. The problem is the syslog-ng file in the salt master server at the moment only enforces unix-stream as follows: source s_sys { ...
3
votes
1answer
44 views

Find what program accessed a kernel module

How do I access a list of users/programs that accessed a certain module? I run: lsmod | grep ^uvcvideo This returns this line when no application is using my video camera: uvcvideo ...
-1
votes
1answer
156 views

Could I disable syslog.service after installing rsyslog on Ubuntu 18.04 server?

I am making a minimal Ubuntu for embedded system starting from Ubuntu base. Our samba-related script code relies on rsyslog so I installed this package. systemctl shows there is also a syslog.service,...
0
votes
1answer
993 views

Why is there no /var/log/kern.log?

I have an embedded system running a slim installation of Buildroot Linux with kernel 3.10.105. Apparently most commands come from BusyBox here, and it seems those do not always implement the full ...
1
vote
1answer
1k views

Where does cron log by default?

On Ubuntu 18.04, man cron says cron logs its action to the syslog facility 'cron', and logging may be controlled using the standard syslogd(8) facility Also, the default configuration of ...
0
votes
1answer
267 views

syslog forwarding

I'm using Solaris and have an application that writes to a log file /app/data/log/foo_log.021118. Am I able to use syslog to forward that specific log file to a remote server? Should I put ...