Questions tagged [syslog]

syslog is a standard (RFC 5424) for message logging. Use this tag for syslog logging related messages. For generic logging messages use [logging] instead

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

How to manually send a log file with specefic count and rate to a server

I have a txt log file (syslog format) that i want to send it with specific count(number of lines) and rate(logs per second) to a server (ELK Stack) that parse this logs on port 514. i see the logger ...
0
votes
1answer
28 views

Is “syslog” often used to refer to both a protocol and an implementation?

Is "syslog" by definition a protocol? Is "syslog" often used to refer to both a protocol and an implementation? If it is sometimes used to refer to an implementation, how may I ...
-1
votes
1answer
39 views

/var/log/syslog as background image

I like to have a text file (vor example /var/log/syslog) as a background image within years. So for example a script that automatically turns the syslog file into a jpg file and then sets it as ...
1
vote
0answers
26 views

What are the message formats in `/var/log/syslog` and the output of `dmesg`?

On Debian or Ubuntu, what are the formats of /var/log/syslog and the output of dmesg? In /var/log/syslog, I figure from Apr 1 08:15:01 mycomputer CRON[12494]: (root) CMD (command -v debian-sa1 > /...
-1
votes
1answer
46 views

Is inetutils not included in Debian or Ubuntu?

Is inetutils or some programs in it provided or installed by default in Debian or Ubuntu? If not, why does Debian or Ubuntu not include it? Is it because they have better alternative programs in other ...
0
votes
1answer
73 views

In syslog or rsyslog, are ring buffer, queue of message, and write buffer the same?

Are the ring buffer, the queue of messages, and the write buffer the same? If not, how do ring buffer, queue and write buffer work together in syslogd or rsyslogd? Most implementations of syslogd ...
1
vote
0answers
37 views

Rsyslog - send logs to remote server

I'm trying to send service log files to a centralized Rsyslog server. On the Syslog server, I have a simple configuration $template DailyPerHostLogs,"/var/log/syslog/%$DAY%/%Fromhost-ip%/%...
0
votes
0answers
32 views

Netcat listener: Line break between syslog messages

I am playing with netcat command. On this linux system, I have set up a netcat listener on UDP 514, so that I get to see syslog messages from remote systems. $ sudo nc -v -ulp 514 listening on [::]:...
2
votes
0answers
60 views

What format does syslog() use when writing to /dev/log?

I initially thought to post this to StackOverflow because my interest was primarily from a programming focus, but after reading about the history tag (and the question it linked to), I posted it to ...
0
votes
0answers
17 views

What is the syntax of a crashed service log message in /var/log/messages?

A few weeks ago we had a monitoring service crash which resulted in our monitoring being down for over 12 hours. I've set up a secondary log collection service for these servers, but our previous logs ...
-1
votes
1answer
55 views

Computer froze and unable to restart for tens of minutes : can my syslog show if the trouble comes from a memory stick, a package or its power unit?

I encounter a bug that made my computer, under Debian 10, crash two times in ten days, and being unable to restart for ten minutes to half an hour. Today during an Eclipse session, before while ...
0
votes
1answer
13 views

Debian - Copy packets incoming to rsyslog and send to localhost on another port

I am trying to configure a server that will have two syslog servers. One is storing all messages and the other is analyzing them for statistics. The only way I can figure out how to do this is to have ...
0
votes
1answer
27 views

Forwarding Data From rsyslog

We have set up a centralized syslog server (RHEL 7 running rsyslogd) that receives syslog data from most of our hosts. Our Security team wants to receive data as well. I'd prefer not to duplicate the ...
0
votes
1answer
33 views

run command after every line of grep output appears

I'm wanting to constantly monitor syslog and perform some computations after a regex pattern appears, and use the grep output in the command, as well as continue to monitor for new matching lines. The ...
0
votes
0answers
12 views

Modifying logs journal

I have a use case where I need to export the logs from journald to some remote host but before doing that I need to prepend some info to every log. Can someone help me on how can that be achieved, if ...
0
votes
1answer
139 views

Enhance Journalctl to show /var/log/messages

I am not able to find /var/log/messages under journald. Is there any way I can integrate journald with /var/log/messages such that journalctl shows logs from /var/log/messages?
0
votes
0answers
13 views

Cannot perform command as a different User -even from root user

I have pm2 node modules installed in a user called otheruser. I need to run the program from root user. If I normally logged to otheruser and perform any action its working fine. otheruser@bubble-...
1
vote
0answers
69 views

dmesg + how to enable dmesg history logs

We have RHEL server version 7.2 and we noticed that dmesg files from previous sessions under /var/log are not created what we have under /var/log are only ls -ltr | grep dmesg -rw-r--r-- 1 root ...
1
vote
1answer
138 views

How to configure syslog in SuSE 12 [closed]

Can anyone help me or provide me guidance on how to configure syslog in SLES 12.3 to a log collector?
1
vote
1answer
65 views

How to record local3 with all severity levels to a file using system logger?

I'm using a VM. Ubuntu Linux. What I'm trying to do is use System logger to record the local3 facility with all severity levels to a file /var/log/local3.log I'm confused as to what the process is. Am ...
2
votes
1answer
690 views

Does Linux's rsyslog support RFC 5424?

For some reason, rsyslogd does not seem to be able to properly interpret a valid RFC 5424 message. Even the example given by the RFC does not work: $ echo "<165>1 2003-08-24T05:14:15.000003-...
3
votes
2answers
72 views

Append to file specific entries of syslog

As usual, I can inspect the contents of syslog entries in this way: cat /var/log/syslog | grep myentry I need to append all myentry rows to a specific file. Of course just redirecting the output of ...
0
votes
1answer
76 views

How to loop netcat for each line of input?

I am trying to send text log files to my remote syslog server. I need to be able to take a file, and for each line in that file (newline as the separator), send that line via netcat to a remote syslog ...
1
vote
1answer
94 views

How to configure rsyslogd to emit rfc5424 messages?

I want to configure my Linux machine using rsyslogd with the simplest yet standard way. I'll save all the logs to /var/log/syslog with rotation. From my research it looks like the standard syslog ...
0
votes
1answer
35 views

Missing syslog entries for OpenSSH

I would like to save the log for OpenSSH client. The manual says that I can use ssh -y example.com to turn on logging. Configuration manual says that the default Syslog facility is user; I didn't ...
0
votes
1answer
146 views

How to apply a Systemd change in the log level, after modifying the systemd configuration file?

How do I apply a Systemd change in the log level (from info to notice), after I've modified the related file /etc/systemd/system.conf? I didn't find the information in the systemd-system.conf manpage, ...
0
votes
1answer
12 views

Log specific command and send it to specific file with (r)syslog

Is it possible via /etc/syslog.conf to create a rule that log a specific command that user invoke and send it to a specified log file? For example, I want that when users types history -d syslogd ...
0
votes
1answer
97 views

How to combine template and outchannel together in rsyslog.conf?

i am try to play with rsyslog configuration. To my knowledge To enable log rotation: we should do something below: $outchannel log_rotation,/var/log/syslog.log, 1048576 ,/usr/bin/rotate.sh *.* :omfile:...
0
votes
1answer
117 views

dhcp-relay custom log file

I have isc-dhcp-relay/xenial-updates,now 4.3.3-5ubuntu12.10 amd64 [installed] working good, how i can move logging this daemon from syslog to custom log file?
0
votes
1answer
33 views

SUSE LINUX 11 - Being Able To Collect User Information (Audit)

I added the following lines to the /etc/audit/audit.rules file and restarted the machine: -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/...
0
votes
1answer
46 views

rainerscript: how to log to file named $programname substring?

How can I write a rainerscript rule to log to a file whose name is a substring of $programname? I want something along the lines of this pseudo-rule: if $programname startswith "foo" then /...
1
vote
0answers
286 views

How to analyze system errors when journalctl fails?

One of my KVM servers (2 Xeon E5-2680 v2, 1 AMD Vega 10 GPU, Ubuntu 20.04.1 LTS) became unresponsive last night. Of the 5 VMs running on the server, only one could be reached. The server itself ...
0
votes
1answer
970 views

rsyslogd[xxxx]: error during config processing: STOP is followed by unreachable statements

I have the following configuration in master syslog server: [root@STGSYSLOG ~]# egrep -v "^$|^#" /etc/rsyslog.conf $MaxMessageSize 32k $ModLoad imuxsock # provides support for local system ...
1
vote
0answers
46 views

rsyslog is creating empty directories

I have the following rsyslog configurations. SYSLOG MASTER(centos 7.x): [root@SYSLOGMASTER ~]# egrep -i "UDP|TCP|template" /etc/rsyslog.conf -A3 # Provides UDP syslog reception $ModLoad ...
4
votes
2answers
138 views

program output is different in console and in virtual terminal

when I execute command foo in console (ie tty1), the output is sent to the console. daemon foo started successfully When I execute the same command in virtual terminal (terminator), I see no output ...
0
votes
1answer
2k views

systemd-journald and rsyslogd: high cpu usage

This is a fresh Debian 10 installation that's two-three weeks old. For the last couple of days, my system has been acting up, it would just slow down and I would not be able to use sudo in the ...
0
votes
1answer
9 views

Full text of commands cut off in /var/log/secure

I've got a server that's using rsyslogd. When looking for commands run by specific users in /var/log/secure, I see that some commands appear to be cut off. For example, you can see that the beginning ...
0
votes
0answers
141 views

Configuring rsyslog for sending log files to diffrerent remote machines

I am newbie in using rsyslog - I have a scenario where in I want to send file1.log, file2.log to remote machine say 10.10.10.123 , and file3.log to a remote machine say 10.11.11.123. Is it possible ...
2
votes
1answer
180 views

How to stop truncate command safely

I am trying to empty my syslog.1 file which was flooded with some messages and has the size of 77 GB. I did sudo truncate -s 0 /var/log/syslog.1 but the command is taking more than 2 hours to return. ...
0
votes
1answer
27 views

syslog_ng cannot start succesfully

In our system, we try to start syslog_ng, but found it cannot start up succesfully. log here: sh-4.3# /usr/sbin/syslog-ng -Fedv 2>&1 | tee -a syslog-dbg.log WARNING: Configuration file format ...
1
vote
2answers
27 views

“Certificate authority” messages are not being recorded in /var/log/messages

I am running an openssl server on my CentOS device. I am using an expired certificate and expect to see a "Certificate authority error" msg in /var/log/messages, but there is no ...
0
votes
1answer
13 views

Transferring system logs to a remote port

I want to transfer all system logs to a remote machine's port. RHEL version : Red Hat Enterprise Linux Server release 5.11 The performed actions: Adding below line to /etc/syslog.conf *.* @10.100.7.2:...
0
votes
1answer
154 views

Temporarily disable all kernel logging?

I know it's generally a bad idea to disable all kernel logging and in any other situation I would not be attempting to do this, but for my current applications having a period of time where the kernel ...
0
votes
1answer
434 views

Changing of MAC Address with Network Manager on Debian 10

Looking at syslog files on Debian 10 form a previous session I have noticed a MAC Address change and I do not know why it is happening. Any ideas on how to stop this? Jun 8 15:43:46 NetworkManager[...
0
votes
0answers
28 views

Debian syslog-ng TCP server and auth logs from CentOS

Update 1 Looks like rsyslog AND syslog-ng are running on the client. I kicked syslog-ng and configured rsyslog to send it's logs to the server via TCP and it works. So, looks ok with this solution --...
1
vote
1answer
217 views

cron: send errors to syslog, instead of MTA

I don't have MTA installed on my desktop. Whenever there is a problem with a cronjob script, I see this in my logs: CRON: (CRON) info (No MTA installed, discarding output) A script that was ...
0
votes
0answers
52 views

Forward all Graylog logs to another Syslog collector

I am having a Graylog Syslog server v.3.3.0 which is collecting the logs of a couple of Linux machines. I want to forward all the captured syslogs to another syslog server. I was looking that in the ...
0
votes
1answer
320 views

How to replace timestamp of messages received on an rsyslog server with a local timestamp?

I have a router that forwards its logs to an rsyslog server and I'd like to configure the rsyslog server to replace the timestamp with a local timestamp. The message format looks like this: Jan 1 00:...
1
vote
0answers
16 views

Unable to create nested Syslog filter with NOT condition

I have a syslog filter setup in my syslog.conf file and data is getting filtered and coming in. source s_network { tcp(port(6514) max-connections(100) keep-alive(yes) tls( key_file("/opt/certs/cert....
0
votes
0answers
22 views

Redirecting log result into a file

I want to create a date stamped log file called e.g. log_file_10_11_2017 containing a list of who is logged into the system, the disk usage and my currently running processes. The file I want ...

1
2 3 4 5
8