Questions tagged [syslog-ng]
Questions specific to the syslog-ng logging solution (https://syslog-ng.org/). Use this tag if your question relates to configuring or using syslog-ng, or if you'd like to know if you can solve a particular logging problem with syslog-ng.
71
questions
0
votes
1
answer
43
views
syslog-ng does not include severity in its lines
I'm trying to configure syslog-ng in an embedded distro.
I added the syslog-ng package.
I was expecting the /var/log/ files to include their log severity / log level, but it isn't to.
Any way to ...
- 351
0
votes
1
answer
66
views
Howto log multiple sftpd server's activity which user's chrooted home is on shared NFS?
I have an Ubuntu server with sftpd running where /var/data/chroot/ is an NFS mount from a remote central NFS server, and each sftpd user's chroot home is /var/data/chroot/<username>/ and every ...
- 31
0
votes
0
answers
462
views
Switched from rsyslog to syslog-ng, but its not starting up
I wanted to switch logging from rsyslog to syslog-ng, but after configuration and startup, it faield to start up.
This is the log file I am getting, but I cant find any clues there what is wrong:
rrr-...
- 141
1
vote
1
answer
248
views
Any way to keep Stunnel from blowing up my logfiles?
I have stunnel v5.44 (Ubuntu 18.04 v3:5.44-1ubuntu3) configured on a client to connect to a server in a screened subnet. The remote host has syslog configured to listen for logfiles over the stunnel ...
- 497
0
votes
0
answers
106
views
internal logrotate mechanism in syslog-ng
Does the syslog-ng has its own rotating mechanism?
I am new to auditing and linux and I though I could use logrotate but I noticed that I need to restart the syslog-ng daemon every time when I use it ...
1
vote
0
answers
37
views
Why using systemd-journal() on a syslog-ng client leads to two hostnames landing on a remote syslog-ng server?
I am facing an issue which I have worked around but I am struggling to find an explanation for.
I have deployed a VMware server from a template which original name is template-centos7 and I have ...
- 11
0
votes
0
answers
336
views
Syslog-ng failing, unable to resolve 0.0.0.0
I am rebuilding my Raspberry Pi from scratch and following my docs that I keep with regards to what I install and configure, so that I can quickly get the system rebuilt. In this instance I am using ...
- 1
2
votes
1
answer
546
views
What is `tty10` used for in syslog-ng
syslog-ng has the option to include a config snippet:
@include "`scl-root`/system/tty10.conf"
and many examples on-line include that file; but I can't understand what it's for?
The entire included ...
- 455
0
votes
0
answers
100
views
Syslog Ng detecting f5 logs as a directory due to hostname written attached as "local/" or "slot1/"
We have a system in place where we have a bunch of f5 devices sending logs to syslog-ng. We have syslog-ng configured to go to:
/path/to/directory/$HOST.
This is causing a problem because since /...
- 13
0
votes
0
answers
86
views
Program not working after setting script in init.d
I have two programs that need to run on start up. I am using init.d scripts because the virtual machine in my system does not have systemctl. With my configuration program_A is working but program_B ...
- 245
0
votes
2
answers
1k
views
Is there a way to send logs to a specific directory with syslog-ng?
I would like to send logs of each application to a remote collector with syslog-ng.
If I have Apache, I'd like my Apache logs to be sent to my remote collector in the file /var/log/apache.log.
I ...
H3ll0_Fr13nd
0
votes
1
answer
382
views
syslog-ng permissions to read /var/log
In our company, we are planning to use syslog-ng for the Centralized log aggregation. We have logs coming from Network devices and 100's of *nix systems(client) produces log files which sent it to ...
- 31
0
votes
1
answer
408
views
syslog-ng modification issue for unix socket
I am having issue researching the right way to go about a problem. The problem is the syslog-ng file in the salt master server at the moment only enforces unix-stream as follows:
source s_sys {
...
- 11
9
votes
1
answer
5k
views
How copytruncate actually works?
we would like to understand copytruncate before rotating the file using logrotate with below configuration:
/app/syslog-ng/custom/output/all_devices.log {
size 200M
copytruncate
dateext
...
- 1,256
0
votes
0
answers
271
views
Syslog-NG filtering with tags - RHEL 7.x
In the below list of syslog messages:
# tail -9 /var/log/messages
Oct 9 14:15:39 machine1 puppet-agent[14371]: Finished catalog run in 6.68 seconds
Oct 9 14:45:31 machine1 puppet-agent[12234]: The ...
- 1,256
0
votes
1
answer
849
views
How can I make syslog-ng to filter for a user name?
I've found a nice feature of the syslog-ng: if I use the logger to log things from the user process, I get the logging user name. Around so:
peterh$ echo test log message|logger
then I get this in /...
- 8,374
1
vote
0
answers
2k
views
Logrotate syslog-NG logging - RHEL 7.x
/usr/sbin/logrotate is used to log rotate syslog-NG logging, as shown below:
[root@machine1 output]# crontab -l
# 00 23 * * * /TSM/bkup 1>/dev/null 2>&1
1 * * * * /usr/sbin/logrotate /app/...
- 1,256
-1
votes
1
answer
5k
views
SyslogNG-How to optimise filter and log statements? [closed]
Below is the current configuration for Syslog-NG logging, locally,
source s_network {
udp(
flags(syslog_protocol)
keep_hostname(yes)
...
- 1,256
1
vote
1
answer
2k
views
Deployment of haproxy between devices and Syslog server
Below is the current architecture of Syslog-NG to avoid single point of failure.
Currently devices send same syslog message to two syslog servers listening on UDP port 514. Each server stores the ...
- 1,256
1
vote
1
answer
716
views
Message forwarding with de-duplication - SyslogNG
Based on the advice from answer that says: Simply adding both servers and always write to both is the easiest one,
we have setup syslog-NG server on two machines that receive same syslog message and ...
- 1,256
0
votes
2
answers
6k
views
syslog-ng won't start because error binding socket with permission denied
I've recently rebooted one of my machines after a long time and a now I'm having a lot of problems with configuration changes.
syslog-ng service is not working anymore with the following error from ...
- 101
0
votes
1
answer
468
views
Forwarding messages with certain filter
Scenario is to receive all incoming messages and store all of those messages in /app/syslog-ng/custom/output/all_devices.log, but forward only certain messages(by filtering).
filter tag is used to ...
- 1,256
1
vote
1
answer
193
views
Changing group ownership of files - User management
Installed an application as root owner but not as non-root. why? Because we had to install this application in custom location(/app)
So, after installing an application(Syslog-NG), below are the ...
- 1,256
1
vote
1
answer
578
views
syslog-ng configure on RHEL 7 fails with OpenSSL version 0.9.8 dependency
Building latest syslog-ng (3.17.2, rather than the packaged version in EPEL, which is 3.5.6, built 30-Dec-2015) from https://github.com/balabit/syslog-ng/releases
Amidst ./configure --prefix=/app/...
- 1,256
0
votes
1
answer
485
views
Syslog-ng loggen
Here's the situation:
I have syslog-ng version 3.15. I've noticed that when using TLS and non-TLS transmission, the logs are different.
I have noticed that, when sending logs using the loggen -i (...
0
votes
1
answer
501
views
Syslog-ng TLS error
I have an issue when trying to forward logs from a CentOS 7
[root@localhost ~]# hostnamectl
Static hostname: localhost.localdomain
Icon name: computer-vm
Chassis: vm
...
0
votes
1
answer
2k
views
Forwarding syslog-ng logs over TLS
This is the scenario: I have a server that's listening on port 6514 on TCP for logs. I created the .key .crt files on the server as described here: https://www.logzilla.net/2014/10/17/configuring-tls-...
0
votes
2
answers
687
views
syslog message format & syslog-ng
Case 1:
For the below incoming message of syslog,
<14>Mar 22 11:12:06 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.2.3.4/62963->23.58.169.35/443 0x0 junos-https 6.7.8.9/32359->23.58....
- 1,256
2
votes
0
answers
302
views
syslog-ng make error - final link failed: Nonrepresentable section on out
I am trying to install syslog-ng-3.13.2 from source code on embedded linux. I executed ./configure --with-ivykis=system successfully. After that, on executing make, I get the following error:
/usr/...
- 261
0
votes
1
answer
312
views
syslog-ng make error - iv.h: No such file or directory
I am trying to install syslog-ng-3.13.2 from source code on embedded linux. The ./configure command worked without any error. When I do make, I get the following error:
In file included from /...
- 261
1
vote
1
answer
812
views
syslog-ng startup failure when using /proc/kmsg [duplicate]
I have recently been updating syslog-ng from 3.7.3 to 3.13.2. After the upgrade, the daemon fails to start with this error message:
[2017-12-23T20:42:40.635915] Error checking the uniqueness of the ...
- 191
2
votes
1
answer
1k
views
Cannot start syslog-ng when apparmor is running
I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin:
service apparmor start
* Starting AppArmor ...
* Loading AppArmor profiles ......
- 1,122
1
vote
1
answer
73
views
syslog-ng equivilent of pri-test of rsyslog
I have systems running syslog and rsyslog across my environment and I would like to have similar outputs.
I have created a template in rsyslog that looks like the following:
$template ...
- 307
2
votes
1
answer
3k
views
syslog-ng network() destination doesn't like transport("tcp")
I have installed syslog-ng v3.5.6 to the Debian GNU/Linux 8.7 (jessie):
# syslog-ng --version
syslog-ng 3.5.6
Installer-Version: 3.5.6
Revision: 3.5.6-2+b1 [@416d315] (Debian/unstable)
Compile-Date: ...
- 2,034
0
votes
0
answers
754
views
Problem to send radius authentication logs to remote host
I have installed freeradius server on FreeBSD,it sends authentication logs to syslog's local1
#
# Which syslog facility to use, if ${destination} == "syslog"
#
# The exact values permitted here are ...
- 359
0
votes
0
answers
307
views
Syslog overwrite-if-older doesn't seem to work for rotating every minute
The docs for syslog 3.1.1 show an option on the file destination that I'd like to use to create logs that overwrite themselves daily, hourly or minutely (that would be a small log).
destination ...
- 1,464
0
votes
1
answer
1k
views
Undefined symbol: SSL_library_init with Syslog-ng
I have OpenSSL installed from source and linked the GLIB_LIBS and GLIB_CFLAGS to the correct directories during configure and configured with-SSL
When I try to start syslog-ng (Version 3.6.4) on ...
0
votes
1
answer
423
views
syslog-ng balabit client keeps opened deleted journal log files
OS: CentOs 7
syslog-ng -V:
syslog-ng-premium-edition 5 F6 (5.6.1b)
Installer-Version: 5.6.1b
Real problem:
syslog-ng keeps in open state deleted journal log files:
syslog-ng 15305 30257 ...
- 101
0
votes
1
answer
141
views
Don't read specified file source in syslog-ng?
I find at versions syslog-ng-3.5 and syslog-ng-3.6 ,the syslog-ng will by default read from /dev/kmsg even if when I don't use
file ("/proc/kmsg" program_override("kernel: "));
in source{ },
when ...
- 391
1
vote
1
answer
3k
views
syslog-ng syslog connection broken on udp
We have following remote logging configuration:
destination d_jenkins { network("x.x.x.x" transport("udp") port(514) template(t_jenkins)); };
log { source(s_system); destination(d_jenkins); };
This ...
- 352
0
votes
1
answer
1k
views
Is there a way to rewrite parts of a message globally instead of inserting rewrite on all log paths?
I need to escape \n from the message. I can do this with "rewrite" but the problem is I have many log paths and I do not want to specify "rewrite" on all log paths. Is there a global way of setting a ...
- 352
1
vote
1
answer
701
views
parse Mongodb logs with syslog-ng
I'm receiving a lot of Mongodb logs with my Syslog-ng. below is the sample of logs parsed and stored like this:
2016-10-18 19:01:08 f:local1.p:info h:10.133.126.81 prog:sharmongo-log m:sharmongo-log ...
- 1,072
0
votes
1
answer
843
views
Syslog-ng destination not working
the default configuration in syslog-ng config file is working fine i.e the service is saving the incoming syslog events successfully. But when the syslog-ng config file is modified to save the syslog ...
0
votes
1
answer
4k
views
syslog-ng fail to start
centos 7(x64),syslog-ng v 3.5
Below is my syslog-ng.cfg
@version:3.5
@include "scl.conf"
options {
flush_lines (0);
time_reopen (10);
log_fifo_size (1000);
chain_hostnames (off);
...
- 335
1
vote
0
answers
346
views
Date, Facility and Severity is missing in LogAnalyzer
I have install Syslog-NG with MongoDB and LogAnalyzer, and as the Title saying, im missing Date, Facility and Severity on a front page of the LogAnalyzer ( first page ). I get just Hostname and ...
- 113
-1
votes
2
answers
8k
views
install syslog-ng on CentOS 7
I've just finished installing a fresh installation of syslog-ng on CentOS 7, but syslog-ng.service failed to start.
It says:
Failed to issue method call: Unit syslog.service failed to load: No such ...
- 1
2
votes
1
answer
10k
views
Syslog service fails to start
I have installed syslog-ng 3.5 on RasperryPi Debian Jessie. When I try to start the service, it fails
-- Unit syslog.socket has begun starting up.
Feb 10 12:29:28 blackbox systemd[1]: Socket service ...
- 963
1
vote
2
answers
946
views
TLS with syslog-ng 3.2.5
Does syslog-ng 3.2.5 from EPEL 6 (for CentOS 6) support TLS? I cannot get it to work at all; here is what I'm using:
source s_network {
tcp(ip(0.0.0.0) port(514)
tls( key_file("/etc/ssl/...
user26053
0
votes
1
answer
123
views
soft-macros are empty in csv parser
I'm trying to parse log messages that are received from a udp port and insert them into a MYSQL database. My destination in my syslog-ng.conf file is as follows:
source syslog_udp {
udp(port(<...
1
vote
1
answer
302
views
logrotate create group not working
cat /etc/issue
Welcome to SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) - Kernel \r (\l).
rpm -qf /etc/logrotate.conf
logrotate-3.7.7-10.22
tail -n15 /etc/logrotate.d/syslog
/var/log/...
- 31