Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [syslog-ng]

Questions specific to the syslog-ng logging solution (https://syslog-ng.org/). Use this tag if your question relates to configuring or using syslog-ng, or if you'd like to know if you can solve a particular logging problem with syslog-ng.

0
votes
0answers
25 views

how to send only specific files to remote server using rsyslog

I using rsyslog. I have multiple servers(rsyslog servers) sending syslog to remote server(syslog-ng server). Right now, I am sending everything to remote server. I want to filter out and send logs ...
0
votes
1answer
28 views

syslog-ng modification issue for unix socket

I am having issue researching the right way to go about a problem. The problem is the syslog-ng file in the salt master server at the moment only enforces unix-stream as follows: source s_sys { ...
2
votes
1answer
91 views

How copytruncate actually works? [closed]

we would like to understand copytruncate before rotating the file using logrotate with below configuration: /app/syslog-ng/custom/output/all_devices.log { size 200M copytruncate dateext ...
0
votes
0answers
37 views

Syslog-NG filtering with tags - RHEL 7.x

In the below list of syslog messages: # tail -9 /var/log/messages Oct 9 14:15:39 machine1 puppet-agent[14371]: Finished catalog run in 6.68 seconds Oct 9 14:45:31 machine1 puppet-agent[12234]: The ...
0
votes
0answers
24 views

How can I make syslog-ng to filter for a user name?

I've found a nice feature of the syslog-ng: if I use the logger to log things from the user process, I get the logging user name. Around so: peterh$ echo test log message|logger then I get this in /...
0
votes
0answers
73 views

Logrotate syslog-NG logging - RHEL 7.x

/usr/sbin/logrotate is used to log rotate syslog-NG logging, as shown below: [root@machine1 output]# crontab -l # 00 23 * * * /TSM/bkup 1>/dev/null 2>&1 1 * * * * /usr/sbin/logrotate /app/...
-1
votes
1answer
33 views

SyslogNG-How to optimise filter and log statements? [closed]

Below is the current configuration for Syslog-NG logging, locally, source s_network { udp( flags(syslog_protocol) keep_hostname(yes) ...
1
vote
1answer
73 views

Deployment of haproxy between devices and Syslog server

Below is the current architecture of Syslog-NG to avoid single point of failure. Currently devices send same syslog message to two syslog servers listening on UDP port 514. Each server stores the ...
1
vote
1answer
72 views

Message forwarding with de-duplication - SyslogNG

Based on the advice from answer that says: Simply adding both servers and always write to both is the easiest one, we have setup syslog-NG server on two machines that receive same syslog message and ...
0
votes
2answers
188 views

syslog-ng won't start because error binding socket with permission denied

I've recently rebooted one of my machines after a long time and a now I'm having a lot of problems with configuration changes. syslog-ng service is not working anymore with the following error from ...
0
votes
1answer
78 views

Forwarding messages with certain filter

Scenario is to receive all incoming messages and store all of those messages in /app/syslog-ng/custom/output/all_devices.log, but forward only certain messages(by filtering). filter tag is used to ...
1
vote
1answer
54 views

Changing group ownership of files - User management

Installed an application as root owner but not as non-root. why? Because we had to install this application in custom location(/app) So, after installing an application(Syslog-NG), below are the ...
1
vote
1answer
83 views

syslog-ng configure on RHEL 7 fails with OpenSSL version 0.9.8 dependency

Building latest syslog-ng (3.17.2, rather than the packaged version in EPEL, which is 3.5.6, built 30-Dec-2015) from https://github.com/balabit/syslog-ng/releases Amidst ./configure --prefix=/app/...
0
votes
1answer
65 views

Syslog-ng loggen

Here's the situation: I have syslog-ng version 3.15. I've noticed that when using TLS and non-TLS transmission, the logs are different. I have noticed that, when sending logs using the loggen -i (...
0
votes
1answer
137 views

Syslog-ng TLS error

I have an issue when trying to forward logs from a CentOS 7 [root@localhost ~]# hostnamectl Static hostname: localhost.localdomain Icon name: computer-vm Chassis: vm ...
0
votes
1answer
264 views

Forwarding syslog-ng logs over TLS

This is the scenario: I have a server that's listening on port 6514 on TCP for logs. I created the .key .crt files on the server as described here: https://www.logzilla.net/2014/10/17/configuring-tls-...
0
votes
2answers
345 views

syslog message format & syslog-ng

Case 1: For the below incoming message of syslog, <14>Mar 22 11:12:06 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.2.3.4/62963->23.58.169.35/443 0x0 junos-https 6.7.8.9/32359->23....
2
votes
0answers
131 views

syslog-ng make error - final link failed: Nonrepresentable section on out

I am trying to install syslog-ng-3.13.2 from source code on embedded linux. I executed ./configure --with-ivykis=system successfully. After that, on executing make, I get the following error: /usr/...
0
votes
1answer
92 views

syslog-ng make error - iv.h: No such file or directory

I am trying to install syslog-ng-3.13.2 from source code on embedded linux. The ./configure command worked without any error. When I do make, I get the following error: In file included from /...
0
votes
1answer
308 views

syslog-ng startup failure when using /proc/kmsg [duplicate]

I have recently been updating syslog-ng from 3.7.3 to 3.13.2. After the upgrade, the daemon fails to start with this error message: [2017-12-23T20:42:40.635915] Error checking the uniqueness of the ...
2
votes
1answer
479 views

Cannot start syslog-ng when apparmor is running

I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin: service apparmor start * Starting AppArmor ... * Loading AppArmor profiles ......
1
vote
1answer
30 views

syslog-ng equivilent of pri-test of rsyslog

I have systems running syslog and rsyslog across my environment and I would like to have similar outputs. I have created a template in rsyslog that looks like the following: $template ...
2
votes
1answer
895 views

syslog-ng network() destination doesn't like transport(“tcp”)

I have installed syslog-ng v3.5.6 to the Debian GNU/Linux 8.7 (jessie): # syslog-ng --version syslog-ng 3.5.6 Installer-Version: 3.5.6 Revision: 3.5.6-2+b1 [@416d315] (Debian/unstable) Compile-Date: ...
0
votes
0answers
219 views

Problem to send radius authentication logs to remote host

I have installed freeradius server on FreeBSD,it sends authentication logs to syslog's local1 # # Which syslog facility to use, if ${destination} == "syslog" # # The exact values permitted here are ...
0
votes
0answers
98 views

Syslog overwrite-if-older doesn't seem to work for rotating every minute

The docs for syslog 3.1.1 show an option on the file destination that I'd like to use to create logs that overwrite themselves daily, hourly or minutely (that would be a small log). destination ...
1
vote
0answers
442 views

Migrate config from syslog-ng to rsyslog

I need to migrate some rules from syslog-ng to rsyslog. The purpose of the rules is to collect the log files from the organization pcs. The initial syslog-ng config consists of the following filers ...
0
votes
1answer
572 views

Undefined symbol: SSL_library_init with Syslog-ng

I have OpenSSL installed from source and linked the GLIB_LIBS and GLIB_CFLAGS to the correct directories during configure and configured with-SSL When I try to start syslog-ng (Version 3.6.4) on ...
0
votes
1answer
236 views

syslog-ng balabit client keeps opened deleted journal log files

OS: CentOs 7 syslog-ng -V: syslog-ng-premium-edition 5 F6 (5.6.1b) Installer-Version: 5.6.1b Real problem: syslog-ng keeps in open state deleted journal log files: syslog-ng 15305 30257 ...
0
votes
1answer
74 views

Don't read specified file source in syslog-ng?

I find at versions syslog-ng-3.5 and syslog-ng-3.6 ,the syslog-ng will by default read from /dev/kmsg even if when I don't use file ("/proc/kmsg" program_override("kernel: ")); in source{ }, when ...
1
vote
1answer
1k views

syslog-ng syslog connection broken on udp

We have following remote logging configuration: destination d_jenkins { network("x.x.x.x" transport("udp") port(514) template(t_jenkins)); }; log { source(s_system); destination(d_jenkins); }; This ...
0
votes
1answer
648 views

Is there a way to rewrite parts of a message globally instead of inserting rewrite on all log paths?

I need to escape \n from the message. I can do this with "rewrite" but the problem is I have many log paths and I do not want to specify "rewrite" on all log paths. Is there a global way of setting a ...
1
vote
1answer
439 views

parse Mongodb logs with syslog-ng

I'm receiving a lot of Mongodb logs with my Syslog-ng. below is the sample of logs parsed and stored like this: 2016-10-18 19:01:08 f:local1.p:info h:10.133.126.81 prog:sharmongo-log m:sharmongo-log ...
0
votes
1answer
359 views

Syslog-ng destination not working

the default configuration in syslog-ng config file is working fine i.e the service is saving the incoming syslog events successfully. But when the syslog-ng config file is modified to save the syslog ...
0
votes
1answer
712 views

syslog-ng fail to start

centos 7(x64),syslog-ng v 3.5 Below is my syslog-ng.cfg @version:3.5 @include "scl.conf" options { flush_lines (0); time_reopen (10); log_fifo_size (1000); chain_hostnames (off); ...
1
vote
0answers
208 views

Date, Facility and Severity is missing in LogAnalyzer

I have install Syslog-NG with MongoDB and LogAnalyzer, and as the Title saying, im missing Date, Facility and Severity on a front page of the LogAnalyzer ( first page ). I get just Hostname and ...
-1
votes
2answers
7k views

install syslog-ng on CentOS 7

I've just finished installing a fresh installation of syslog-ng on CentOS 7, but syslog-ng.service failed to start. It says: Failed to issue method call: Unit syslog.service failed to load: No such ...
1
vote
1answer
5k views

Syslog service fails to start

I have installed syslog-ng 3.5 on RasperryPi Debian Jessie. When I try to start the service, it fails -- Unit syslog.socket has begun starting up. Feb 10 12:29:28 blackbox systemd[1]: Socket service ...
1
vote
2answers
695 views

TLS with syslog-ng 3.2.5

Does syslog-ng 3.2.5 from EPEL 6 (for CentOS 6) support TLS? I cannot get it to work at all; here is what I'm using: source s_network { tcp(ip(0.0.0.0) port(514) tls( key_file("/etc/ssl/...
0
votes
1answer
65 views

soft-macros are empty in csv parser

I'm trying to parse log messages that are received from a udp port and insert them into a MYSQL database. My destination in my syslog-ng.conf file is as follows: source syslog_udp { udp(port(<...
1
vote
1answer
152 views

logrotate create group not working

cat /etc/issue Welcome to SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) - Kernel \r (\l). rpm -qf /etc/logrotate.conf logrotate-3.7.7-10.22 tail -n15 /etc/logrotate.d/syslog /var/log/...
0
votes
1answer
41 views

Upgrading `popt` requires to upgrade too many packages

I am currently in the process of upgrading syslog-ng using rpm. In the upgrade process, I found out that syslog-ng has a dependency with rpm-libs which have a dependency with popt. The dependency tree ...
51
votes
2answers
47k views

Understand logging in Linux

As I understand, Linux kernel logs to /proc/kmsg file(mostly hardware-related messages) and /dev/log socket? Anywhere else? Are other applications also able to send messages to /proc/kmsg or /dev/log? ...
6
votes
5answers
28k views

syslog-ng service not starting with systemd but command works fine

I have a freshly installed version on CentOS 7 once which I have installed syslog-ng from the EPEL repositories. ~: yum list | grep syslog syslog-ng.x86_64 3.5.6-1.el7 ...
0
votes
1answer
150 views

Log transfer using syslog-ng 3.3.5

I want to transfer client logs to a log server but the problem i am facing is that each time client's file gets modified , whole file is transfered to log server so i am getting redundant message at ...
2
votes
1answer
9k views

nginx send log to remote syslog server

I wnat to send nginx access log to a remote syslog-ng server. I installed syslog-ng on each side (server-client). Client: 10.10.10.2 Server: 10.10.10.1 Some log files (messages,syslog,mail.log) are ...
2
votes
1answer
174 views

Preferred approaches to remote logging of a script / daemon?

I run a script as a daemon which gets started and stopped via /etc/init.d on a Raspberry Pi. For a number of reasons - including limited local file storage - I'd like to direct stdout and stderr from ...
5
votes
1answer
170 views

Separate messages of multiple sshds in syslog-ng

Is there a common way of distinguishing between the messages of multiple processes in syslog-ng beside setting different facilities? +1 if filtering and therefore logging in different files would be ...
1
vote
1answer
3k views

syslog-ng won't write to log file - “No such file or directory”

I have set up a fresh instance of syslog-ng using the conf file included below. I can see that messages are trying to route to the right place (var/log/bash) when I look in val/log/messages. But I ...
3
votes
1answer
2k views

Failover with Syslog-ng?

Is it possible to set up a failover mechanism with Syslog-NG opensource edition? I want that the syslog-ng Daemon logs to a remote Loghost and switches to an other server if the first would go down ...
4
votes
3answers
15k views

Log every command typed in any shell: output (from logger function to syslog-ng/journald) contains duplicate entries for commands?

I installed syslog-ng to use on my desktop (Gentoo 64bit, upgraded to systemd i.e. was OpenRC before, with Openbox and Slim only) with my normal user to log all commands I type in the shell (bash ...