Questions tagged [syslog-ng]

Questions specific to the syslog-ng logging solution (https://syslog-ng.org/). Use this tag if your question relates to configuring or using syslog-ng, or if you'd like to know if you can solve a particular logging problem with syslog-ng.

Filter by
Sorted by
Tagged with
0 votes
1 answer
43 views

syslog-ng does not include severity in its lines

I'm trying to configure syslog-ng in an embedded distro. I added the syslog-ng package. I was expecting the /var/log/ files to include their log severity / log level, but it isn't to. Any way to ...
user avatar
  • 351
0 votes
1 answer
66 views

Howto log multiple sftpd server's activity which user's chrooted home is on shared NFS?

I have an Ubuntu server with sftpd running where /var/data/chroot/ is an NFS mount from a remote central NFS server, and each sftpd user's chroot home is /var/data/chroot/<username>/ and every ...
user avatar
  • 31
0 votes
0 answers
462 views

Switched from rsyslog to syslog-ng, but its not starting up

I wanted to switch logging from rsyslog to syslog-ng, but after configuration and startup, it faield to start up. This is the log file I am getting, but I cant find any clues there what is wrong: rrr-...
user avatar
  • 141
1 vote
1 answer
248 views

Any way to keep Stunnel from blowing up my logfiles?

I have stunnel v5.44 (Ubuntu 18.04 v3:5.44-1ubuntu3) configured on a client to connect to a server in a screened subnet. The remote host has syslog configured to listen for logfiles over the stunnel ...
user avatar
0 votes
0 answers
106 views

internal logrotate mechanism in syslog-ng

Does the syslog-ng has its own rotating mechanism? I am new to auditing and linux and I though I could use logrotate but I noticed that I need to restart the syslog-ng daemon every time when I use it ...
user avatar
1 vote
0 answers
37 views

Why using systemd-journal() on a syslog-ng client leads to two hostnames landing on a remote syslog-ng server?

I am facing an issue which I have worked around but I am struggling to find an explanation for. I have deployed a VMware server from a template which original name is template-centos7 and I have ...
user avatar
  • 11
0 votes
0 answers
336 views

Syslog-ng failing, unable to resolve 0.0.0.0

I am rebuilding my Raspberry Pi from scratch and following my docs that I keep with regards to what I install and configure, so that I can quickly get the system rebuilt. In this instance I am using ...
user avatar
  • 1
2 votes
1 answer
546 views

What is `tty10` used for in syslog-ng

syslog-ng has the option to include a config snippet: @include "`scl-root`/system/tty10.conf" and many examples on-line include that file; but I can't understand what it's for? The entire included ...
user avatar
  • 455
0 votes
0 answers
100 views

Syslog Ng detecting f5 logs as a directory due to hostname written attached as "local/" or "slot1/"

We have a system in place where we have a bunch of f5 devices sending logs to syslog-ng. We have syslog-ng configured to go to: /path/to/directory/$HOST. This is causing a problem because since /...
user avatar
  • 13
0 votes
0 answers
86 views

Program not working after setting script in init.d

I have two programs that need to run on start up. I am using init.d scripts because the virtual machine in my system does not have systemctl. With my configuration program_A is working but program_B ...
user avatar
0 votes
2 answers
1k views

Is there a way to send logs to a specific directory with syslog-ng?

I would like to send logs of each application to a remote collector with syslog-ng. If I have Apache, I'd like my Apache logs to be sent to my remote collector in the file /var/log/apache.log. I ...
user avatar
0 votes
1 answer
382 views

syslog-ng permissions to read /var/log

In our company, we are planning to use syslog-ng for the Centralized log aggregation. We have logs coming from Network devices and 100's of *nix systems(client) produces log files which sent it to ...
user avatar
0 votes
1 answer
408 views

syslog-ng modification issue for unix socket

I am having issue researching the right way to go about a problem. The problem is the syslog-ng file in the salt master server at the moment only enforces unix-stream as follows: source s_sys { ...
user avatar
  • 11
9 votes
1 answer
5k views

How copytruncate actually works?

we would like to understand copytruncate before rotating the file using logrotate with below configuration: /app/syslog-ng/custom/output/all_devices.log { size 200M copytruncate dateext ...
user avatar
  • 1,256
0 votes
0 answers
271 views

Syslog-NG filtering with tags - RHEL 7.x

In the below list of syslog messages: # tail -9 /var/log/messages Oct 9 14:15:39 machine1 puppet-agent[14371]: Finished catalog run in 6.68 seconds Oct 9 14:45:31 machine1 puppet-agent[12234]: The ...
user avatar
  • 1,256
0 votes
1 answer
849 views

How can I make syslog-ng to filter for a user name?

I've found a nice feature of the syslog-ng: if I use the logger to log things from the user process, I get the logging user name. Around so: peterh$ echo test log message|logger then I get this in /...
user avatar
  • 8,374
1 vote
0 answers
2k views

Logrotate syslog-NG logging - RHEL 7.x

/usr/sbin/logrotate is used to log rotate syslog-NG logging, as shown below: [root@machine1 output]# crontab -l # 00 23 * * * /TSM/bkup 1>/dev/null 2>&1 1 * * * * /usr/sbin/logrotate /app/...
user avatar
  • 1,256
-1 votes
1 answer
5k views

SyslogNG-How to optimise filter and log statements? [closed]

Below is the current configuration for Syslog-NG logging, locally, source s_network { udp( flags(syslog_protocol) keep_hostname(yes) ...
user avatar
  • 1,256
1 vote
1 answer
2k views

Deployment of haproxy between devices and Syslog server

Below is the current architecture of Syslog-NG to avoid single point of failure. Currently devices send same syslog message to two syslog servers listening on UDP port 514. Each server stores the ...
user avatar
  • 1,256
1 vote
1 answer
716 views

Message forwarding with de-duplication - SyslogNG

Based on the advice from answer that says: Simply adding both servers and always write to both is the easiest one, we have setup syslog-NG server on two machines that receive same syslog message and ...
user avatar
  • 1,256
0 votes
2 answers
6k views

syslog-ng won't start because error binding socket with permission denied

I've recently rebooted one of my machines after a long time and a now I'm having a lot of problems with configuration changes. syslog-ng service is not working anymore with the following error from ...
user avatar
0 votes
1 answer
468 views

Forwarding messages with certain filter

Scenario is to receive all incoming messages and store all of those messages in /app/syslog-ng/custom/output/all_devices.log, but forward only certain messages(by filtering). filter tag is used to ...
user avatar
  • 1,256
1 vote
1 answer
193 views

Changing group ownership of files - User management

Installed an application as root owner but not as non-root. why? Because we had to install this application in custom location(/app) So, after installing an application(Syslog-NG), below are the ...
user avatar
  • 1,256
1 vote
1 answer
578 views

syslog-ng configure on RHEL 7 fails with OpenSSL version 0.9.8 dependency

Building latest syslog-ng (3.17.2, rather than the packaged version in EPEL, which is 3.5.6, built 30-Dec-2015) from https://github.com/balabit/syslog-ng/releases Amidst ./configure --prefix=/app/...
user avatar
  • 1,256
0 votes
1 answer
485 views

Syslog-ng loggen

Here's the situation: I have syslog-ng version 3.15. I've noticed that when using TLS and non-TLS transmission, the logs are different. I have noticed that, when sending logs using the loggen -i (...
user avatar
0 votes
1 answer
501 views

Syslog-ng TLS error

I have an issue when trying to forward logs from a CentOS 7 [root@localhost ~]# hostnamectl Static hostname: localhost.localdomain Icon name: computer-vm Chassis: vm ...
user avatar
0 votes
1 answer
2k views

Forwarding syslog-ng logs over TLS

This is the scenario: I have a server that's listening on port 6514 on TCP for logs. I created the .key .crt files on the server as described here: https://www.logzilla.net/2014/10/17/configuring-tls-...
user avatar
0 votes
2 answers
687 views

syslog message format & syslog-ng

Case 1: For the below incoming message of syslog, <14>Mar 22 11:12:06 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.2.3.4/62963->23.58.169.35/443 0x0 junos-https 6.7.8.9/32359->23.58....
user avatar
  • 1,256
2 votes
0 answers
302 views

syslog-ng make error - final link failed: Nonrepresentable section on out

I am trying to install syslog-ng-3.13.2 from source code on embedded linux. I executed ./configure --with-ivykis=system successfully. After that, on executing make, I get the following error: /usr/...
user avatar
  • 261
0 votes
1 answer
312 views

syslog-ng make error - iv.h: No such file or directory

I am trying to install syslog-ng-3.13.2 from source code on embedded linux. The ./configure command worked without any error. When I do make, I get the following error: In file included from /...
user avatar
  • 261
1 vote
1 answer
812 views

syslog-ng startup failure when using /proc/kmsg [duplicate]

I have recently been updating syslog-ng from 3.7.3 to 3.13.2. After the upgrade, the daemon fails to start with this error message: [2017-12-23T20:42:40.635915] Error checking the uniqueness of the ...
user avatar
  • 191
2 votes
1 answer
1k views

Cannot start syslog-ng when apparmor is running

I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin: service apparmor start * Starting AppArmor ... * Loading AppArmor profiles ......
user avatar
  • 1,122
1 vote
1 answer
73 views

syslog-ng equivilent of pri-test of rsyslog

I have systems running syslog and rsyslog across my environment and I would like to have similar outputs. I have created a template in rsyslog that looks like the following: $template ...
user avatar
2 votes
1 answer
3k views

syslog-ng network() destination doesn't like transport("tcp")

I have installed syslog-ng v3.5.6 to the Debian GNU/Linux 8.7 (jessie): # syslog-ng --version syslog-ng 3.5.6 Installer-Version: 3.5.6 Revision: 3.5.6-2+b1 [@416d315] (Debian/unstable) Compile-Date: ...
user avatar
  • 2,034
0 votes
0 answers
754 views

Problem to send radius authentication logs to remote host

I have installed freeradius server on FreeBSD,it sends authentication logs to syslog's local1 # # Which syslog facility to use, if ${destination} == "syslog" # # The exact values permitted here are ...
user avatar
  • 359
0 votes
0 answers
307 views

Syslog overwrite-if-older doesn't seem to work for rotating every minute

The docs for syslog 3.1.1 show an option on the file destination that I'd like to use to create logs that overwrite themselves daily, hourly or minutely (that would be a small log). destination ...
user avatar
  • 1,464
0 votes
1 answer
1k views

Undefined symbol: SSL_library_init with Syslog-ng

I have OpenSSL installed from source and linked the GLIB_LIBS and GLIB_CFLAGS to the correct directories during configure and configured with-SSL When I try to start syslog-ng (Version 3.6.4) on ...
user avatar
0 votes
1 answer
423 views

syslog-ng balabit client keeps opened deleted journal log files

OS: CentOs 7 syslog-ng -V: syslog-ng-premium-edition 5 F6 (5.6.1b) Installer-Version: 5.6.1b Real problem: syslog-ng keeps in open state deleted journal log files: syslog-ng 15305 30257 ...
user avatar
0 votes
1 answer
141 views

Don't read specified file source in syslog-ng?

I find at versions syslog-ng-3.5 and syslog-ng-3.6 ,the syslog-ng will by default read from /dev/kmsg even if when I don't use file ("/proc/kmsg" program_override("kernel: ")); in source{ }, when ...
user avatar
  • 391
1 vote
1 answer
3k views

syslog-ng syslog connection broken on udp

We have following remote logging configuration: destination d_jenkins { network("x.x.x.x" transport("udp") port(514) template(t_jenkins)); }; log { source(s_system); destination(d_jenkins); }; This ...
user avatar
  • 352
0 votes
1 answer
1k views

Is there a way to rewrite parts of a message globally instead of inserting rewrite on all log paths?

I need to escape \n from the message. I can do this with "rewrite" but the problem is I have many log paths and I do not want to specify "rewrite" on all log paths. Is there a global way of setting a ...
user avatar
  • 352
1 vote
1 answer
701 views

parse Mongodb logs with syslog-ng

I'm receiving a lot of Mongodb logs with my Syslog-ng. below is the sample of logs parsed and stored like this: 2016-10-18 19:01:08 f:local1.p:info h:10.133.126.81 prog:sharmongo-log m:sharmongo-log ...
user avatar
  • 1,072
0 votes
1 answer
843 views

Syslog-ng destination not working

the default configuration in syslog-ng config file is working fine i.e the service is saving the incoming syslog events successfully. But when the syslog-ng config file is modified to save the syslog ...
user avatar
0 votes
1 answer
4k views

syslog-ng fail to start

centos 7(x64),syslog-ng v 3.5 Below is my syslog-ng.cfg @version:3.5 @include "scl.conf" options { flush_lines (0); time_reopen (10); log_fifo_size (1000); chain_hostnames (off); ...
user avatar
1 vote
0 answers
346 views

Date, Facility and Severity is missing in LogAnalyzer

I have install Syslog-NG with MongoDB and LogAnalyzer, and as the Title saying, im missing Date, Facility and Severity on a front page of the LogAnalyzer ( first page ). I get just Hostname and ...
user avatar
  • 113
-1 votes
2 answers
8k views

install syslog-ng on CentOS 7

I've just finished installing a fresh installation of syslog-ng on CentOS 7, but syslog-ng.service failed to start. It says: Failed to issue method call: Unit syslog.service failed to load: No such ...
user avatar
  • 1
2 votes
1 answer
10k views

Syslog service fails to start

I have installed syslog-ng 3.5 on RasperryPi Debian Jessie. When I try to start the service, it fails -- Unit syslog.socket has begun starting up. Feb 10 12:29:28 blackbox systemd[1]: Socket service ...
user avatar
  • 963
1 vote
2 answers
946 views

TLS with syslog-ng 3.2.5

Does syslog-ng 3.2.5 from EPEL 6 (for CentOS 6) support TLS? I cannot get it to work at all; here is what I'm using: source s_network { tcp(ip(0.0.0.0) port(514) tls( key_file("/etc/ssl/...
user avatar
0 votes
1 answer
123 views

soft-macros are empty in csv parser

I'm trying to parse log messages that are received from a udp port and insert them into a MYSQL database. My destination in my syslog-ng.conf file is as follows: source syslog_udp { udp(port(<...
user avatar
1 vote
1 answer
302 views

logrotate create group not working

cat /etc/issue Welcome to SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) - Kernel \r (\l). rpm -qf /etc/logrotate.conf logrotate-3.7.7-10.22 tail -n15 /etc/logrotate.d/syslog /var/log/...
user avatar
  • 31