Questions tagged [syslog-ng]
Questions specific to the syslog-ng logging solution (https://syslog-ng.org/). Use this tag if your question relates to configuring or using syslog-ng, or if you'd like to know if you can solve a particular logging problem with syslog-ng.
0
votes
1answer
38 views
syslog-ng permissions to read /var/log
In our company, we are planning to use syslog-ng for the Centralized log aggregation. We have logs coming from Network devices and 100's of *nix systems(client) produces log files which sent it to ...
0
votes
1answer
51 views
syslog-ng modification issue for unix socket
I am having issue researching the right way to go about a problem. The problem is the syslog-ng file in the salt master server at the moment only enforces unix-stream as follows:
source s_sys {
...
3
votes
1answer
305 views
How copytruncate actually works? [closed]
we would like to understand copytruncate before rotating the file using logrotate with below configuration:
/app/syslog-ng/custom/output/all_devices.log {
size 200M
copytruncate
dateext
...
0
votes
0answers
70 views
Syslog-NG filtering with tags - RHEL 7.x
In the below list of syslog messages:
# tail -9 /var/log/messages
Oct 9 14:15:39 machine1 puppet-agent[14371]: Finished catalog run in 6.68 seconds
Oct 9 14:45:31 machine1 puppet-agent[12234]: The ...
0
votes
0answers
37 views
How can I make syslog-ng to filter for a user name?
I've found a nice feature of the syslog-ng: if I use the logger to log things from the user process, I get the logging user name. Around so:
peterh$ echo test log message|logger
then I get this in /...
0
votes
0answers
185 views
Logrotate syslog-NG logging - RHEL 7.x
/usr/sbin/logrotate is used to log rotate syslog-NG logging, as shown below:
[root@machine1 output]# crontab -l
# 00 23 * * * /TSM/bkup 1>/dev/null 2>&1
1 * * * * /usr/sbin/logrotate /app/...
-1
votes
1answer
131 views
SyslogNG-How to optimise filter and log statements? [closed]
Below is the current configuration for Syslog-NG logging, locally,
source s_network {
udp(
flags(syslog_protocol)
keep_hostname(yes)
...
1
vote
1answer
137 views
Deployment of haproxy between devices and Syslog server
Below is the current architecture of Syslog-NG to avoid single point of failure.
Currently devices send same syslog message to two syslog servers listening on UDP port 514. Each server stores the ...
1
vote
1answer
112 views
Message forwarding with de-duplication - SyslogNG
Based on the advice from answer that says: Simply adding both servers and always write to both is the easiest one,
we have setup syslog-NG server on two machines that receive same syslog message and ...
0
votes
2answers
420 views
syslog-ng won't start because error binding socket with permission denied
I've recently rebooted one of my machines after a long time and a now I'm having a lot of problems with configuration changes.
syslog-ng service is not working anymore with the following error from ...
0
votes
1answer
79 views
Forwarding messages with certain filter
Scenario is to receive all incoming messages and store all of those messages in /app/syslog-ng/custom/output/all_devices.log, but forward only certain messages(by filtering).
filter tag is used to ...
1
vote
1answer
57 views
Changing group ownership of files - User management
Installed an application as root owner but not as non-root. why? Because we had to install this application in custom location(/app)
So, after installing an application(Syslog-NG), below are the ...
1
vote
1answer
136 views
syslog-ng configure on RHEL 7 fails with OpenSSL version 0.9.8 dependency
Building latest syslog-ng (3.17.2, rather than the packaged version in EPEL, which is 3.5.6, built 30-Dec-2015) from https://github.com/balabit/syslog-ng/releases
Amidst ./configure --prefix=/app/...
0
votes
1answer
93 views
Syslog-ng loggen
Here's the situation:
I have syslog-ng version 3.15. I've noticed that when using TLS and non-TLS transmission, the logs are different.
I have noticed that, when sending logs using the loggen -i (...
0
votes
1answer
174 views
Syslog-ng TLS error
I have an issue when trying to forward logs from a CentOS 7
[root@localhost ~]# hostnamectl
Static hostname: localhost.localdomain
Icon name: computer-vm
Chassis: vm
...
0
votes
1answer
381 views
Forwarding syslog-ng logs over TLS
This is the scenario: I have a server that's listening on port 6514 on TCP for logs. I created the .key .crt files on the server as described here: https://www.logzilla.net/2014/10/17/configuring-tls-...
0
votes
2answers
379 views
syslog message format & syslog-ng
Case 1:
For the below incoming message of syslog,
<14>Mar 22 11:12:06 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.2.3.4/62963->23.58.169.35/443 0x0 junos-https 6.7.8.9/32359->23....
2
votes
0answers
141 views
syslog-ng make error - final link failed: Nonrepresentable section on out
I am trying to install syslog-ng-3.13.2 from source code on embedded linux. I executed ./configure --with-ivykis=system successfully. After that, on executing make, I get the following error:
/usr/...
0
votes
1answer
105 views
syslog-ng make error - iv.h: No such file or directory
I am trying to install syslog-ng-3.13.2 from source code on embedded linux. The ./configure command worked without any error. When I do make, I get the following error:
In file included from /...
0
votes
1answer
338 views
syslog-ng startup failure when using /proc/kmsg [duplicate]
I have recently been updating syslog-ng from 3.7.3 to 3.13.2. After the upgrade, the daemon fails to start with this error message:
[2017-12-23T20:42:40.635915] Error checking the uniqueness of the ...
2
votes
1answer
529 views
Cannot start syslog-ng when apparmor is running
I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin:
service apparmor start
* Starting AppArmor ...
* Loading AppArmor profiles ......
1
vote
1answer
33 views
syslog-ng equivilent of pri-test of rsyslog
I have systems running syslog and rsyslog across my environment and I would like to have similar outputs.
I have created a template in rsyslog that looks like the following:
$template ...
2
votes
1answer
1k views
syslog-ng network() destination doesn't like transport(“tcp”)
I have installed syslog-ng v3.5.6 to the Debian GNU/Linux 8.7 (jessie):
# syslog-ng --version
syslog-ng 3.5.6
Installer-Version: 3.5.6
Revision: 3.5.6-2+b1 [@416d315] (Debian/unstable)
Compile-Date: ...
0
votes
0answers
269 views
Problem to send radius authentication logs to remote host
I have installed freeradius server on FreeBSD,it sends authentication logs to syslog's local1
#
# Which syslog facility to use, if ${destination} == "syslog"
#
# The exact values permitted here are ...
0
votes
0answers
117 views
Syslog overwrite-if-older doesn't seem to work for rotating every minute
The docs for syslog 3.1.1 show an option on the file destination that I'd like to use to create logs that overwrite themselves daily, hourly or minutely (that would be a small log).
destination ...
1
vote
0answers
492 views
Migrate config from syslog-ng to rsyslog
I need to migrate some rules from syslog-ng to rsyslog. The purpose of the rules is to collect the log files from the organization pcs. The initial syslog-ng config consists of the following filers ...
0
votes
1answer
615 views
Undefined symbol: SSL_library_init with Syslog-ng
I have OpenSSL installed from source and linked the GLIB_LIBS and GLIB_CFLAGS to the correct directories during configure and configured with-SSL
When I try to start syslog-ng (Version 3.6.4) on ...
0
votes
1answer
260 views
syslog-ng balabit client keeps opened deleted journal log files
OS: CentOs 7
syslog-ng -V:
syslog-ng-premium-edition 5 F6 (5.6.1b)
Installer-Version: 5.6.1b
Real problem:
syslog-ng keeps in open state deleted journal log files:
syslog-ng 15305 30257 ...
0
votes
1answer
83 views
Don't read specified file source in syslog-ng?
I find at versions syslog-ng-3.5 and syslog-ng-3.6 ,the syslog-ng will by default read from /dev/kmsg even if when I don't use
file ("/proc/kmsg" program_override("kernel: "));
in source{ },
when ...
1
vote
1answer
1k views
syslog-ng syslog connection broken on udp
We have following remote logging configuration:
destination d_jenkins { network("x.x.x.x" transport("udp") port(514) template(t_jenkins)); };
log { source(s_system); destination(d_jenkins); };
This ...
0
votes
1answer
711 views
Is there a way to rewrite parts of a message globally instead of inserting rewrite on all log paths?
I need to escape \n from the message. I can do this with "rewrite" but the problem is I have many log paths and I do not want to specify "rewrite" on all log paths. Is there a global way of setting a ...
1
vote
1answer
457 views
parse Mongodb logs with syslog-ng
I'm receiving a lot of Mongodb logs with my Syslog-ng. below is the sample of logs parsed and stored like this:
2016-10-18 19:01:08 f:local1.p:info h:10.133.126.81 prog:sharmongo-log m:sharmongo-log ...
0
votes
1answer
391 views
Syslog-ng destination not working
the default configuration in syslog-ng config file is working fine i.e the service is saving the incoming syslog events successfully. But when the syslog-ng config file is modified to save the syslog ...
0
votes
1answer
834 views
syslog-ng fail to start
centos 7(x64),syslog-ng v 3.5
Below is my syslog-ng.cfg
@version:3.5
@include "scl.conf"
options {
flush_lines (0);
time_reopen (10);
log_fifo_size (1000);
chain_hostnames (off);
...
1
vote
0answers
214 views
Date, Facility and Severity is missing in LogAnalyzer
I have install Syslog-NG with MongoDB and LogAnalyzer, and as the Title saying, im missing Date, Facility and Severity on a front page of the LogAnalyzer ( first page ). I get just Hostname and ...
-1
votes
2answers
7k views
install syslog-ng on CentOS 7
I've just finished installing a fresh installation of syslog-ng on CentOS 7, but syslog-ng.service failed to start.
It says:
Failed to issue method call: Unit syslog.service failed to load: No such ...
1
vote
1answer
6k views
Syslog service fails to start
I have installed syslog-ng 3.5 on RasperryPi Debian Jessie. When I try to start the service, it fails
-- Unit syslog.socket has begun starting up.
Feb 10 12:29:28 blackbox systemd[1]: Socket service ...
1
vote
2answers
728 views
TLS with syslog-ng 3.2.5
Does syslog-ng 3.2.5 from EPEL 6 (for CentOS 6) support TLS? I cannot get it to work at all; here is what I'm using:
source s_network {
tcp(ip(0.0.0.0) port(514)
tls( key_file("/etc/ssl/...
0
votes
1answer
67 views
soft-macros are empty in csv parser
I'm trying to parse log messages that are received from a udp port and insert them into a MYSQL database. My destination in my syslog-ng.conf file is as follows:
source syslog_udp {
udp(port(<...
1
vote
1answer
182 views
logrotate create group not working
cat /etc/issue
Welcome to SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) - Kernel \r (\l).
rpm -qf /etc/logrotate.conf
logrotate-3.7.7-10.22
tail -n15 /etc/logrotate.d/syslog
/var/log/...
0
votes
1answer
41 views
Upgrading `popt` requires to upgrade too many packages
I am currently in the process of upgrading syslog-ng using rpm.
In the upgrade process, I found out that syslog-ng has a dependency with rpm-libs which have a dependency with popt. The dependency tree ...
51
votes
2answers
49k views
Understand logging in Linux
As I understand, Linux kernel logs to /proc/kmsg file(mostly hardware-related messages) and /dev/log socket? Anywhere else? Are other applications also able to send messages to /proc/kmsg or /dev/log? ...
6
votes
5answers
31k views
syslog-ng service not starting with systemd but command works fine
I have a freshly installed version on CentOS 7 once which I have installed syslog-ng from the EPEL repositories.
~: yum list | grep syslog
syslog-ng.x86_64 3.5.6-1.el7 ...
0
votes
1answer
151 views
Log transfer using syslog-ng 3.3.5
I want to transfer client logs to a log server but the problem i am facing is that each time client's file gets modified , whole file is transfered to log server so i am getting redundant message at ...
2
votes
1answer
9k views
nginx send log to remote syslog server
I wnat to send nginx access log to a remote syslog-ng server. I installed syslog-ng on each side (server-client).
Client: 10.10.10.2
Server: 10.10.10.1
Some log files (messages,syslog,mail.log) are ...
2
votes
1answer
180 views
Preferred approaches to remote logging of a script / daemon?
I run a script as a daemon which gets started and stopped via /etc/init.d on a Raspberry Pi. For a number of reasons - including limited local file storage - I'd like to direct stdout and stderr from ...
5
votes
1answer
173 views
Separate messages of multiple sshds in syslog-ng
Is there a common way of distinguishing between the messages of multiple processes in syslog-ng beside setting different facilities?
+1 if filtering and therefore logging in different files would be ...
1
vote
1answer
3k views
syslog-ng won't write to log file - “No such file or directory”
I have set up a fresh instance of syslog-ng using the conf file included below. I can see that messages are trying to route to the right place (var/log/bash) when I look in val/log/messages. But I ...
3
votes
1answer
2k views
Failover with Syslog-ng?
Is it possible to set up a failover mechanism with Syslog-NG opensource edition?
I want that the syslog-ng Daemon logs to a remote Loghost and switches to an other server if the first would go down ...
4
votes
3answers
15k views
Log every command typed in any shell: output (from logger function to syslog-ng/journald) contains duplicate entries for commands?
I installed syslog-ng to use on my desktop (Gentoo 64bit, upgraded to systemd i.e. was OpenRC before, with Openbox and Slim only) with my normal user to log all commands I type in the shell (bash ...
