Questions tagged [syslog]

syslog is a standard (RFC 5424) for message logging. Use this tag for syslog logging related messages. For generic logging messages use [logging] instead

Filter by
Sorted by
Tagged with
1
vote
2answers
41 views

Append to file specific entries of syslog

As usual, I can inspect the contents of syslog entries in this way: cat /var/log/syslog | grep myentry I need to append all myentry rows to a specific file. Of course just redirecting the output of ...
0
votes
1answer
27 views

How to loop netcat for each line of input?

I am trying to send text log files to my remote syslog server. I need to be able to take a file, and for each line in that file (newline as the separator), send that line via netcat to a remote syslog ...
0
votes
0answers
15 views

How to configure rsyslogd to emit rfc5424 messages?

I want to configure my Linux machine using rsyslogd with the simplest yet standard way. I'll save all the logs to /var/log/syslog with rotation. From my research it looks like the standard syslog ...
0
votes
1answer
25 views

Missing syslog entries for OpenSSH

I would like to save the log for OpenSSH client. The manual says that I can use ssh -y example.com to turn on logging. Configuration manual says that the default Syslog facility is user; I didn't ...
0
votes
1answer
20 views

How to apply a Systemd change in the log level, after modifying the systemd configuration file?

How do I apply a Systemd change in the log level (from info to notice), after I've modified the related file /etc/systemd/system.conf? I didn't find the information in the systemd-system.conf manpage, ...
0
votes
1answer
12 views

Log specific command and send it to specific file with (r)syslog

Is it possible via /etc/syslog.conf to create a rule that log a specific command that user invoke and send it to a specified log file? For example, I want that when users types history -d syslogd ...
0
votes
1answer
27 views

How to combine template and outchannel together in rsyslog.conf?

i am try to play with rsyslog configuration. To my knowledge To enable log rotation: we should do something below: $outchannel log_rotation,/var/log/syslog.log, 1048576 ,/usr/bin/rotate.sh *.* :omfile:...
0
votes
1answer
28 views

dhcp-relay custom log file

I have isc-dhcp-relay/xenial-updates,now 4.3.3-5ubuntu12.10 amd64 [installed] working good, how i can move logging this daemon from syslog to custom log file?
0
votes
1answer
19 views

SUSE LINUX 11 - Being Able To Collect User Information (Audit)

I added the following lines to the /etc/audit/audit.rules file and restarted the machine: -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/...
0
votes
0answers
13 views

rainerscript: how to log to file named $programname substring?

How can I write a rainerscript rule to log to a file whose name is a substring of $programname? I want something along the lines of this pseudo-rule: if $programname startswith "foo" then /...
1
vote
0answers
47 views

How to analyze system errors when journalctl fails?

One of my KVM servers (2 Xeon E5-2680 v2, 1 AMD Vega 10 GPU, Ubuntu 20.04.1 LTS) became unresponsive last night. Of the 5 VMs running on the server, only one could be reached. The server itself ...
0
votes
0answers
285 views

rsyslogd[xxxx]: error during config processing: STOP is followed by unreachable statements

I have the following configuration in master syslog server: [root@STGSYSLOG ~]# egrep -v "^$|^#" /etc/rsyslog.conf $MaxMessageSize 32k $ModLoad imuxsock # provides support for local system ...
1
vote
0answers
27 views

rsyslog is creating empty directories

I have the following rsyslog configurations. SYSLOG MASTER(centos 7.x): [root@SYSLOGMASTER ~]# egrep -i "UDP|TCP|template" /etc/rsyslog.conf -A3 # Provides UDP syslog reception $ModLoad ...
4
votes
2answers
121 views

program output is different in console and in virtual terminal

when I execute command foo in console (ie tty1), the output is sent to the console. daemon foo started successfully When I execute the same command in virtual terminal (terminator), I see no output ...
0
votes
1answer
353 views

systemd-journald and rsyslogd: high cpu usage

This is a fresh Debian 10 installation that's two-three weeks old. For the last couple of days, my system has been acting up, it would just slow down and I would not be able to use sudo in the ...
0
votes
1answer
8 views

Full text of commands cut off in /var/log/secure

I've got a server that's using rsyslogd. When looking for commands run by specific users in /var/log/secure, I see that some commands appear to be cut off. For example, you can see that the beginning ...
0
votes
0answers
50 views

Configuring rsyslog for sending log files to diffrerent remote machines

I am newbie in using rsyslog - I have a scenario where in I want to send file1.log, file2.log to remote machine say 10.10.10.123 , and file3.log to a remote machine say 10.11.11.123. Is it possible ...
2
votes
1answer
65 views

How to stop truncate command safely

I am trying to empty my syslog.1 file which was flooded with some messages and has the size of 77 GB. I did sudo truncate -s 0 /var/log/syslog.1 but the command is taking more than 2 hours to return. ...
0
votes
1answer
20 views

syslog_ng cannot start succesfully

In our system, we try to start syslog_ng, but found it cannot start up succesfully. log here: sh-4.3# /usr/sbin/syslog-ng -Fedv 2>&1 | tee -a syslog-dbg.log WARNING: Configuration file format ...
1
vote
2answers
21 views

“Certificate authority” messages are not being recorded in /var/log/messages

I am running an openssl server on my CentOS device. I am using an expired certificate and expect to see a "Certificate authority error" msg in /var/log/messages, but there is no ...
0
votes
1answer
11 views

Transferring system logs to a remote port

I want to transfer all system logs to a remote machine's port. RHEL version : Red Hat Enterprise Linux Server release 5.11 The performed actions: Adding below line to /etc/syslog.conf *.* @10.100.7.2:...
0
votes
1answer
61 views

Temporarily disable all kernel logging?

I know it's generally a bad idea to disable all kernel logging and in any other situation I would not be attempting to do this, but for my current applications having a period of time where the kernel ...
0
votes
1answer
112 views

Changing of MAC Address with Network Manager on Debian 10

Looking at syslog files on Debian 10 form a previous session I have noticed a MAC Address change and I do not know why it is happening. Any ideas on how to stop this? Jun 8 15:43:46 NetworkManager[...
0
votes
0answers
22 views

Debian syslog-ng TCP server and auth logs from CentOS

Update 1 Looks like rsyslog AND syslog-ng are running on the client. I kicked syslog-ng and configured rsyslog to send it's logs to the server via TCP and it works. So, looks ok with this solution --...
1
vote
1answer
102 views

cron: send errors to syslog, instead of MTA

I don't have MTA installed on my desktop. Whenever there is a problem with a cronjob script, I see this in my logs: CRON: (CRON) info (No MTA installed, discarding output) A script that was ...
0
votes
0answers
27 views

Forward all Graylog logs to another Syslog collector

I am having a Graylog Syslog server v.3.3.0 which is collecting the logs of a couple of Linux machines. I want to forward all the captured syslogs to another syslog server. I was looking that in the ...
0
votes
1answer
81 views

How to replace timestamp of messages received on an rsyslog server with a local timestamp?

I have a router that forwards its logs to an rsyslog server and I'd like to configure the rsyslog server to replace the timestamp with a local timestamp. The message format looks like this: Jan 1 00:...
1
vote
0answers
13 views

Unable to create nested Syslog filter with NOT condition

I have a syslog filter setup in my syslog.conf file and data is getting filtered and coming in. source s_network { tcp(port(6514) max-connections(100) keep-alive(yes) tls( key_file("/opt/certs/cert....
0
votes
0answers
22 views

Redirecting log result into a file

I want to create a date stamped log file called e.g. log_file_10_11_2017 containing a list of who is logged into the system, the disk usage and my currently running processes. The file I want ...
0
votes
0answers
33 views

How can a bash script detect in real time when an ARM error occurs?

How can a Linux bash script detect in real time when an error, such as Internal error: Oops: 37 [#1} ARM, occurs ? I'd rather my script not have to constantly scan system logs looking for such errors. ...
1
vote
1answer
23 views

What does the field MESSAGE_ID in systemd's journals signify?

When digging into logging from shell scripts and applications I found that the logger utility gives the option to log directly to systemd's journals. The man page advocates in these cases to fill in ...
0
votes
1answer
88 views

Is UDP data lost when executing kill -HUP on rsyslog?

I am very new to rsyslog and I am going through the documentation as well as seeing examples of what other people have done with their configuration and a question came to mind when the topic of log ...
0
votes
1answer
80 views

Understanding rsyslog log format and filtering

I am working on filtering logs from syslog and forwading to another log. I am able too capture/filter the log based on "internal-sftp". By using if $programname == 'internal-sftp' then /var/log/...
3
votes
0answers
304 views

Journald to rsyslog forwarding confusion

I do not really understand the forwarding from Journald to Rsyslog. Basically I understood it in the way that the 'pipeline' is built up as follows: Kernel logs through printk() → /proc/kmesg ← ...
0
votes
1answer
38 views

Rsyslog not saving logs from another servers into custom directories

I am receving logs on UDP 514 from another server and i have configured rsyslog.conf to save the logs to another custom directory but i am unable to do so, i confirmed through tcpdump logs are getting ...
1
vote
2answers
43 views

Cron task does not work

I am developing a backup script in my NAS running a docker container. Inside my container I have cron running with this /etc/crontab: root@backups-nas:/code# cat /etc/crontab SHELL=/bin/bash PATH=/...
0
votes
0answers
208 views

Is there something that can be done about these WARN messages or should I not worry about them?

I was using zoom and these messages popped up on my laptop's /var/log/syslog. I am using Ubuntu 19.10 on a Lenovo Thinkpad X220i. My kernel version is: 5.3.0-42-generic Mar 16 14:45:07 a thermald[617]...
1
vote
1answer
56 views

rsyslog logs are not stored in queue files

I’m using rsyslog 8.40 and I’m trying to setup logforwarding with queues. I was able to send logs to the forwarding servers using the following configurations. action(type="omfwd" target="host1" ...
1
vote
0answers
34 views

syslog tag for systemd dotnet service keeps changing between SyslogIdentifier and process name

I have a number of .NET Core applications running as systemd services on Ubuntu 18.04 (systemd 237). The unit files look like this: [Unit] Description=my-service dotnet service [Service] Type=simple ...
1
vote
1answer
70 views

How can I add lastlog support to Alpine Linux?

Apparently, musl, the default library for Alpine Linux does not support lastlog. Generally you will use Alpine to deploy containers that do not need that kind of support, but it could be used also to ...
0
votes
0answers
19 views

4G connection drop Airtel Syslog message (7/8)

My 4G device is on an automobile that travels around 500 kms in a night. The network disconnects sometimes. And this is the log I see in the Syslog. Can someone help me understand what is going on? ...
1
vote
0answers
52 views

My epoch time in syslog is 8 hours behind. How do I fix it?

I am in the PST (UTC -8) timezone. My syslog in stamping all messages as PST -8 instead of UTC, or even UTC -8 (so the timestamps are 8 hours behind my local time!). regular date command is correct ...
0
votes
0answers
133 views

Syslog-ng stops logging randomly after some time

I have a Linux server who forwards all the log flux to another central Syslog server. Both run Centos 7 with Syslog-ng 3.18.1. After some time (could be two hours, one day or two weeks...), the ...
0
votes
1answer
190 views

OpenSSH Server: Directive 'SyslogFacility' is not allowed within a Match block

I want a specific matched User to have its 'ssh/scp' activities logged in an alternative facility. The current default is AUTH, but I'd like to log stuff for user 'dummy' to syslog Facility 'LOCAL2'. ...
1
vote
0answers
337 views

What happens to rsyslog queue files after they have been processed?

I am working on a machine (ubuntu 18.04) that generates logs at times when it's not connected to a network. I have configured rsyslog to forward some of these logs to an aggregator service (fluentd) ...
1
vote
0answers
20 views

Log user status (archlinux)

I'd like to write a code that restricts myself from accessing the laptop for too long. To do that, I have to have access to user's active time. Currently, I use ac (a part of GNU accounting utils) to ...
12
votes
5answers
2k views

I don't know what is producing the gigabytes of error in syslog

The error is showing itself like this: Jan 11 16:39:52 pop-os org.gnome.Nautilus[1514]: [00007fa4fc465ce0] vdpau_chroma filter error: video mixer rendering failure: An invalid handle value was ...
0
votes
1answer
299 views

Using syslog for user/application logs on Centos 7/8

I want to use syslog(3) to write application logs to a central recorder. The application runs on a collection of computers on the same subnet. Not interested (at present) in capturing system (non-...
0
votes
0answers
53 views

Bash syslog events skip systemd-journald and send directly to syslog daemon

I want to send Bash history information to syslog on a Linux (CentOS 7 system) with systemd, but I want to skip the intrusive systemd-journal service which typically forwards to the syslog daemon, ...
0
votes
0answers
83 views

Faulty usb device: how to disable to get rid of dmesg errors

I bought a second hand computer, which seems to have a faulty USB port (or something - I haven't encountered it). The only real annoyance is that my syslogs are spammed with the same messages: [...

1
2 3 4 5
7