Questions tagged [syslog]

syslog is a standard (RFC 5424) for message logging. Use this tag for syslog logging related messages. For generic logging messages use [logging] instead

Filter by
Sorted by
Tagged with
0
votes
1answer
8 views

Log specific command and send it to specific file with (r)syslog

Is it possible via /etc/syslog.conf to create a rule that log a specific command that user invoke and send it to a specified log file? For example, I want that when users types history -d syslogd ...
0
votes
1answer
18 views

How to combine template and outchannel together in rsyslog.conf?

i am try to play with rsyslog configuration. To my knowledge To enable log rotation: we should do something below: $outchannel log_rotation,/var/log/syslog.log, 1048576 ,/usr/bin/rotate.sh *.* :omfile:...
0
votes
1answer
16 views

dhcp-relay custom log file

I have isc-dhcp-relay/xenial-updates,now 4.3.3-5ubuntu12.10 amd64 [installed] working good, how i can move logging this daemon from syslog to custom log file?
1
vote
1answer
2k views

VSFTP user login & activity monitoring

We have a linux box that is configured with vsftp for our ftp sessions. Unfortunately, for the last few days, we've found that files served by vsftpd have been lost (deleted). I would like to know: ...
0
votes
1answer
190 views

systemd-journald and rsyslogd: high cpu usage

This is a fresh Debian 10 installation that's two-three weeks old. For the last couple of days, my system has been acting up, it would just slow down and I would not be able to use sudo in the ...
0
votes
1answer
18 views

SUSE LINUX 11 - Being Able To Collect User Information (Audit)

I added the following lines to the /etc/audit/audit.rules file and restarted the machine: -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/...
10
votes
5answers
2k views

I don't know what is producing the gigabytes of error in syslog

The error is showing itself like this: Jan 11 16:39:52 pop-os org.gnome.Nautilus[1514]: [00007fa4fc465ce0] vdpau_chroma filter error: video mixer rendering failure: An invalid handle value was ...
0
votes
0answers
11 views

rainerscript: how to log to file named $programname substring?

How can I write a rainerscript rule to log to a file whose name is a substring of $programname? I want something along the lines of this pseudo-rule: if $programname startswith "foo" then /...
1
vote
0answers
31 views

How to analyze system errors when journalctl fails?

One of my KVM servers (2 Xeon E5-2680 v2, 1 AMD Vega 10 GPU, Ubuntu 20.04.1 LTS) became unresponsive last night. Of the 5 VMs running on the server, only one could be reached. The server itself ...
4
votes
2answers
118 views

program output is different in console and in virtual terminal

when I execute command foo in console (ie tty1), the output is sent to the console. daemon foo started successfully When I execute the same command in virtual terminal (terminator), I see no output ...
10
votes
3answers
10k views

Examining /dev/log

/dev/log is the default entry for system logging. In the case of a systemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix ...
0
votes
0answers
148 views

rsyslogd[xxxx]: error during config processing: STOP is followed by unreachable statements

I have the following configuration in master syslog server: [root@STGSYSLOG ~]# egrep -v "^$|^#" /etc/rsyslog.conf $MaxMessageSize 32k $ModLoad imuxsock # provides support for local system ...
1
vote
1answer
1k views

iptables does not generates log

I have this script make_firewall.sh with rules for iptables: iptables -F iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT iptables -A INPUT -s 127.0.0....
1
vote
0answers
23 views

rsyslog is creating empty directories

I have the following rsyslog configurations. SYSLOG MASTER(centos 7.x): [root@SYSLOGMASTER ~]# egrep -i "UDP|TCP|template" /etc/rsyslog.conf -A3 # Provides UDP syslog reception $ModLoad ...
9
votes
2answers
22k views

What does “kernel:NMI watchdog: BUG: soft lockup” followed by other errors mean?

I have my terminal always opened (Fedora 22), because all my work I do from there. Sometimes I search some info in browser or just have fun. After 20-30 minutes of browsing (browser starts not from ...
3
votes
1answer
4k views

Is it possible to reduce systemd-journald size stored format (and thus size)?

I'm using systemd on raspberrypi machine with yocto based system. Recently I had some problems with redirecting messages to rsyslog.socket so I decided to get rid of rsyslog completely in favour of of ...
0
votes
1answer
8 views

Full text of commands cut off in /var/log/secure

I've got a server that's using rsyslogd. When looking for commands run by specific users in /var/log/secure, I see that some commands appear to be cut off. For example, you can see that the beginning ...
2
votes
3answers
8k views

syslog-ng.conf under SLES 12

Where can I find the syslog config file under SLES 12? rsyslog and syslog-service are installed according to YaST2 and rcsyslog status outputs: ServerName:~ # rcsyslog status Usage: /sbin/rcsyslog {...
1
vote
1answer
1k views

How to interpret SCSI device (sd) timeout logs

In /var/log/messages, I find the following log: Oct 23 21:48:53 localhost kernel: sd 3:0:0:0: timing out command, waited 180s Please explain the values that are separated by colons. Also where ...
3
votes
0answers
205 views

Journald to rsyslog forwarding confusion

I do not really understand the forwarding from Journald to Rsyslog. Basically I understood it in the way that the 'pipeline' is built up as follows: Kernel logs through printk() → /proc/kmesg ← ...
0
votes
0answers
30 views

Configuring rsyslog for sending log files to diffrerent remote machines

I am newbie in using rsyslog - I have a scenario where in I want to send file1.log, file2.log to remote machine say 10.10.10.123 , and file3.log to a remote machine say 10.11.11.123. Is it possible ...
1
vote
1answer
1k views

Skip syslog/rsyslog logging of certain cron jobs

In most GNU/Linux distributions the default is to log start (and many different events) of every cron job to syslog. It's rather convenient, but not for a very frequent jobs, which started, say, every ...
2
votes
1answer
40 views

How to stop truncate command safely

I am trying to empty my syslog.1 file which was flooded with some messages and has the size of 77 GB. I did sudo truncate -s 0 /var/log/syslog.1 but the command is taking more than 2 hours to return. ...
1
vote
1answer
1k views

Separate SSHD Authpriv logs into /var/log/sshd, all other authpriv logging goes to messages

Right now, sshd is using the authpriv facility. The level of logging is fine, but I don't want it in the syslog, I want it to go to /var/log/sshd (which doesn't yet exist) on Red Hat Linux/Enterprise ...
0
votes
1answer
2k views

syslog-ng fail to start

centos 7(x64),syslog-ng v 3.5 Below is my syslog-ng.cfg @version:3.5 @include "scl.conf" options { flush_lines (0); time_reopen (10); log_fifo_size (1000); chain_hostnames (off); ...
0
votes
1answer
15 views

syslog_ng cannot start succesfully

In our system, we try to start syslog_ng, but found it cannot start up succesfully. log here: sh-4.3# /usr/sbin/syslog-ng -Fedv 2>&1 | tee -a syslog-dbg.log WARNING: Configuration file format ...
1
vote
1answer
1k views

/var/lib/puppet/state/agent_catalog_run.lock exists

I'm seeing the following error on CentOS 6.4: # puppet agent --test Run of Puppet configuration client already in progress; skipping (/var/lib/puppet/state/agent_catalog_run.lock exists) What should ...
1
vote
1answer
2k views

how to have syslog not log particular warnings?

Short Version: I want to stop the following message from appearing in my syslog. They pertain to a USB port on my keyboard that can be ignored: Feb 9 23:33:45 sunfire kernel: [ 8163.156041] usb 3-6.2....
1
vote
2answers
17 views

“Certificate authority” messages are not being recorded in /var/log/messages

I am running an openssl server on my CentOS device. I am using an expired certificate and expect to see a "Certificate authority error" msg in /var/log/messages, but there is no ...
0
votes
1answer
11 views

Transferring system logs to a remote port

I want to transfer all system logs to a remote machine's port. RHEL version : Red Hat Enterprise Linux Server release 5.11 The performed actions: Adding below line to /etc/syslog.conf *.* @10.100.7.2:...
7
votes
4answers
2k views

How to implement logwatch functionality on top of systemd journal?

Logwatch scans logfiles with regular intervals, collects errors and stuff, then mails it to the admin. This was back in syslog and logfiles days. What's the corresponding solution for systemd's ...
0
votes
1answer
1k views

Understanding network problem (syslog)

I am running a lubuntu 14.04 server and its always worked well, except for the last couple of days it keeps dropping off the LAN. I am using a couple of powerlink adapters to connect it up as WiFi was ...
3
votes
1answer
230 views

Separate server's hostname appearing in this server's cron logs

I get entries like these in /var/log/cron, in a host named SERV2 (RHEL 6.2): Apr 21 14:50:01 SERV1 CROND[14799]: (root) CMD (/usr/lib64/sa/sa1 -S DISK 1 1) Apr 21 15:20:01 serv2 CROND[24438]: (root) ...
0
votes
1answer
53 views

Temporarily disable all kernel logging?

I know it's generally a bad idea to disable all kernel logging and in any other situation I would not be attempting to do this, but for my current applications having a period of time where the kernel ...
0
votes
2answers
2k views

Constant UFW Block in Syslog

In reviewing my syslog, I've found that 99% of it consists of UFW BLOCK statements from 3 or 4 IP's (see below; edited for space). Is this normal? What do these entries mean? If they are safe, how can ...
0
votes
1answer
74 views

Changing of MAC Address with Network Manager on Debian 10

Looking at syslog files on Debian 10 form a previous session I have noticed a MAC Address change and I do not know why it is happening. Any ideas on how to stop this? Jun 8 15:43:46 NetworkManager[...
1
vote
1answer
84 views

cron: send errors to syslog, instead of MTA

I don't have MTA installed on my desktop. Whenever there is a problem with a cronjob script, I see this in my logs: CRON: (CRON) info (No MTA installed, discarding output) A script that was ...
0
votes
0answers
20 views

Debian syslog-ng TCP server and auth logs from CentOS

Update 1 Looks like rsyslog AND syslog-ng are running on the client. I kicked syslog-ng and configured rsyslog to send it's logs to the server via TCP and it works. So, looks ok with this solution --...
5
votes
2answers
7k views

centos 6.8: Deleted /var/log/messages … it didn't come back?

To make debugging an issue easier, I deleted /var/log/messages .... and it hasn't come back! I thought debug messages from kernel and modules like autofs were routed to this file. But even after I ...
0
votes
0answers
22 views

Forward all Graylog logs to another Syslog collector

I am having a Graylog Syslog server v.3.3.0 which is collecting the logs of a couple of Linux machines. I want to forward all the captured syslogs to another syslog server. I was looking that in the ...
0
votes
1answer
56 views

How to replace timestamp of messages received on an rsyslog server with a local timestamp?

I have a router that forwards its logs to an rsyslog server and I'd like to configure the rsyslog server to replace the timestamp with a local timestamp. The message format looks like this: Jan 1 00:...
1
vote
0answers
12 views

Unable to create nested Syslog filter with NOT condition

I have a syslog filter setup in my syslog.conf file and data is getting filtered and coming in. source s_network { tcp(port(6514) max-connections(100) keep-alive(yes) tls( key_file("/opt/certs/cert....
0
votes
0answers
22 views

Redirecting log result into a file

I want to create a date stamped log file called e.g. log_file_10_11_2017 containing a list of who is logged into the system, the disk usage and my currently running processes. The file I want ...
6
votes
4answers
7k views

Can I stop IPv6 “Router Advertisement” filling syslog without disabling IPv6?

My syslog looks like this: Apr 1 19:05:25 raspberrypi dhcpcd[699]: eth0: Router Advertisement from fe80::c23e:fff:fe63:5170 Apr 1 19:07:35 raspberrypi dhcpcd[699]: eth0: Router Advertisement from ...
0
votes
0answers
33 views

How can a bash script detect in real time when an ARM error occurs?

How can a Linux bash script detect in real time when an error, such as Internal error: Oops: 37 [#1} ARM, occurs ? I'd rather my script not have to constantly scan system logs looking for such errors. ...
1
vote
1answer
21 views

What does the field MESSAGE_ID in systemd's journals signify?

When digging into logging from shell scripts and applications I found that the logger utility gives the option to log directly to systemd's journals. The man page advocates in these cases to fill in ...
0
votes
1answer
63 views

Understanding rsyslog log format and filtering

I am working on filtering logs from syslog and forwading to another log. I am able too capture/filter the log based on "internal-sftp". By using if $programname == 'internal-sftp' then /var/log/...
0
votes
1answer
69 views

Is UDP data lost when executing kill -HUP on rsyslog?

I am very new to rsyslog and I am going through the documentation as well as seeing examples of what other people have done with their configuration and a question came to mind when the topic of log ...
0
votes
1answer
473 views

How can I make syslog-ng to filter for a user name?

I've found a nice feature of the syslog-ng: if I use the logger to log things from the user process, I get the logging user name. Around so: peterh$ echo test log message|logger then I get this in /...
191
votes
4answers
817k views

Where are Apache file access logs stored?

Does anyone know where file access logs are stored, so I can run a tail -f command in order to see who is accessing a particular file. I have XAMPP, which is an Apache server installed on my machine, ...

1
2 3 4 5
7