Questions tagged [syslog]

syslog is a standard (RFC 5424) for message logging. Use this tag for syslog logging related messages. For generic logging messages use [logging] instead

93 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
1answer
4k views

Why does journalctl say “— no entries --”?

For example: ┌─[10:50:38/hypership/root/~] └─╼ journalctl -b No journal files were found. -- No entries -- ┌─[10:50:46/hypership/root/~] └─╼ journalctl --verify No journal files were found. /var/...
3
votes
1answer
4k views

Is it possible to reduce systemd-journald size stored format (and thus size)?

I'm using systemd on raspberrypi machine with yocto based system. Recently I had some problems with redirecting messages to rsyslog.socket so I decided to get rid of rsyslog completely in favour of of ...
3
votes
0answers
2k views

exception Emask 0x10 SAct 0x0 SErr 0x4060000 action 0xe frozen t2

I get all those errors in kern.log and I don't know how to investigate them. I'm not even sure which one is the most relevant for a title to this question. AFAIU, this is likely to be hardware ...
2
votes
0answers
26 views

Removed debug.log, and it is not generating again

Using RHEL 7.2, due to larger file size I've removed debug.log (from /var/log/debug.log). And after that debug.log file is not generating automatically. I've checked "messages" log it's working fine.
2
votes
0answers
269 views

Nvidia-persistenced in syslog

On boot, I saw multiple lines about nvidia flashing on-screen before the X login screen. Looking at the /var/log/syslog, grep showed many entries about nvidia-persistenced on boot. It seems to start ...
2
votes
1answer
48 views

How to find out why server turned on

I have a PC running as debian server. Usually, the server is shut down until I press the power button or send a Magic Packet via WakeOnLan. But sometimes, the server turns on alone. How can I find ...
2
votes
0answers
450 views

accessing old data from syslog

I look after various MySQL DB's which we have recently moved to Linux servers (from Windows). They run fine and everything is good. However, this morning i needed to check the error logs, but these ...
2
votes
3answers
7k views

syslog-ng.conf under SLES 12

Where can I find the syslog config file under SLES 12? rsyslog and syslog-service are installed according to YaST2 and rcsyslog status outputs: ServerName:~ # rcsyslog status Usage: /sbin/rcsyslog {...
2
votes
0answers
826 views

Is there a “supported” way in RHEL/CentOS 7 to union-mount a directory tree on top of an NFS mount point?

I have an NFS share containing almost 500 chrooted (s)ftp user's home directories. This NFS share is mounted on several FTP servers forming a highly available FTP cluster. I would like to enable ...
2
votes
0answers
165 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
0answers
251 views

Nested filtering in rsyslogd

I'm using rsyslogd and trying to figure out why things like if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/bla2app work just fine, but if $hostname startswith 'd....
2
votes
0answers
1k views

After ubuntu install + software raid 0 config, we see: rejecting I/O to offline device

I'm trying to pin down what this error rejecting I/O to offline device is, as seen towards the end of this syslog. Ideas: Problem with RAID-0 configuration (we have 2 4TB disks in RAID-0 and I do ...
2
votes
0answers
921 views

To what does the byte sequence in this kerneloops (syslogd@hostname) message refer?

Message from syslogd@ROOROO at Mar 22 19:36:12 ... kernel:[13988.165672] Oops: 0000 [#1] SMP Message from syslogd@ROOROO at Mar 22 19:36:12 ... kernel:[13988.169607] Stack: Message from syslogd@...
1
vote
0answers
92 views

Auditd, Syslog and Journald

I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me. According to the things I read, auditd audits events in the ...
1
vote
0answers
22 views

Duplicate entry in /var/log/syslog … sh vs dhcpd

Whenever I run tail -F /var/log/syslog, I notice there is duplicate entry in the log. user@svr01:~$ tail -F /var/log/syslog Jun 19 03:13:37 svr01 dhcpd[2361]: in your dhcpd.conf file for the ...
1
vote
0answers
242 views

How to monitor system with `snort` and send emails about `alerts`

PROBLEM: I have been configuring snort on my systems and would like to get emails from the systems if there are any alerts. What I have tried is swatch but I can't find much documentation on it, can ...
1
vote
0answers
47 views

Docker Debian, getting some specific syslog in the docker container log

I have been installing SSH in the Debian Docker. Since I wanted to have some extra log, I also installed the Rsyslog as described in this question. Result was that some extra logs are created e.g. ...
1
vote
0answers
162 views

CentOS: Collecting and analysing logs using NXlog and OSSIM

Objective: Forward logs from all servers to OSSIM, correctly formatted and readable. Steps: Deploying one NXlog Collector/proxy node in each network zone - DONE Deploying one NXlog Collector/master ...
1
vote
0answers
537 views

Files in /var/log are only writing to file.1 (syslog is empty, but not syslog.1 )

The host is a docker container running Ubuntu 14.04 I am trying to figure out why the primary log files are not being written too, I have attached output of the files and permissions. I am hoping to ...
1
vote
1answer
811 views

How to append the date to log file before it's name?

I want to append the date to my log file before its name. /opt/logs/myapp.log { rotate 6 hourly dateext dateformat %Y-%m-%d ifempty postrotate ...
1
vote
0answers
74 views

MacOS: USB history (name and timestamp of connected devices)

My external HDD was stolen from me a few weeks ago but I just realised this recently. I really need to know when was the last time I connected this device to my computer. I know it's name, is there ...
1
vote
0answers
581 views

How do I use a serial port as a source for Syslog?

I'm trying to log another server's serial console port to a central syslog server, so I have connected a laptop running CentOS. I can read the port with minicom or even do something like cat /dev/...
1
vote
2answers
521 views

How to log PostgreSQL table data changes into syslog?

I have a program which uses these tables, and I want to add some additional functionality to its logging without modifying the program. groups ------ id bigint not null name character varying(100) ...
1
vote
0answers
247 views

Adding the related username to syslog logging

I'm managing a server running Debian 7 Wheezy. I'd like to add a new feature to the /var/log/syslog file. That is a sample current output: Jul 31 13:06:35 myserver mod_evasive[7629]: Couldn't open ...
1
vote
0answers
603 views

fail to log from my app through rsyslogd in a linux container

Running an archlinux container on an archlinux host, both using rsyslog with the same configuration file: $ cat /etc/rsyslog.conf # Minimal config $ModLoad imuxsock # provides support for local ...
1
vote
0answers
696 views

Arch Linux - Cronie is not working and nestat does not output logs?

I added a cronjob via crontab -e which is to be executed every minute. I enabled and started cronie on systemctl. Set editor $ export EDITOR=vim Add cront tasks $ crontab -e * * * * * Rscript /...
1
vote
1answer
2k views

how to have syslog not log particular warnings?

Short Version: I want to stop the following message from appearing in my syslog. They pertain to a USB port on my keyboard that can be ignored: Feb 9 23:33:45 sunfire kernel: [ 8163.156041] usb 3-6....
1
vote
0answers
600 views

Error cannot open tty-output Linux

I have installed one paravirtualized image, Debian 8, in XenServer, and I'm adding a script to create a template that come. Added in the startup script with the command systemctl enable script. Scritp ...
1
vote
0answers
46 views

Syslog config syntax

I have setup a syslog server to test it out and its working perfectly fine. I want to understand what this syntax is actually doing in the rsyslog.conf file of the server that I added as guided by ...
1
vote
0answers
88 views

Suppress Rsyslog to terminal

When I use Rsyslog (in bash using logger and in Node using winston-syslog), all log levels are also shown on the terminal window. I only want to log these events, and silent the output unless they ...
1
vote
0answers
778 views

Where do these boot log entries come from and who creates them?

I'm wondering what kind of code writes these first two lines into /var/log/syslog while booting my machine: Aug 4 10:13:48 HOSTNAME kernel: imklog 5.8.11, log source = /proc/kmsg started. Aug 4 10:...
1
vote
0answers
1k views

VSFTP user login & activity monitoring

We have a linux box that is configured with vsftp for our ftp sessions. Unfortunately, for the last few days, we've found that files served by vsftpd have been lost (deleted). I would like to know: ...
1
vote
0answers
322 views

Failed umount /home (ZFS) on shutdown

During shutdown I notice an error reported in the logging messages on the screen that the umounting of /home (a ZFS filesystem) failed. (After restart I don't find any respective log entry in the ...
1
vote
0answers
847 views

Syslog flooded with “pci 0000:00:14.4: PCI bridge to [bus 04” messages, what's going on here?

I operate an HP Microserver N54L for offsite backups operated by Ubuntu 14.04 LTS (running Linux 3.16), which I recently equipped with an HP MicroServer Remote Access Card 615095-B21. Since plugging ...
1
vote
1answer
1k views

Skip syslog/rsyslog logging of certain cron jobs

In most GNU/Linux distributions the default is to log start (and many different events) of every cron job to syslog. It's rather convenient, but not for a very frequent jobs, which started, say, every ...
1
vote
1answer
1k views

/var/lib/puppet/state/agent_catalog_run.lock exists

I'm seeing the following error on CentOS 6.4: # puppet agent --test Run of Puppet configuration client already in progress; skipping (/var/lib/puppet/state/agent_catalog_run.lock exists) What should ...
1
vote
0answers
573 views

Why doesn't syslog traffic show up in netstat and lsof output?

I've noticed on my CentOS 5.x system that outbound syslog traffic (UDP) doesn't show up in lsof or netstat results. I've even tried stuff like watch -n .1 'netstat -l -u -n --program' to make sure ...
1
vote
1answer
288 views

Syslog log analyzer

Is there any syslog log analyzer script I can install on hosting to track user activity? I have giant user log and I need more specific log details.
1
vote
1answer
1k views

Separate SSHD Authpriv logs into /var/log/sshd, all other authpriv logging goes to messages

Right now, sshd is using the authpriv facility. The level of logging is fine, but I don't want it in the syslog, I want it to go to /var/log/sshd (which doesn't yet exist) on Red Hat Linux/Enterprise ...
1
vote
0answers
120 views

Smarter log rotation

I want to reduce the amount of logs in my system, but reduce them smartly. The general idea is, each time you rotate, look for any warning/error/critical level logs, and keep 2 minutes of log context ...
1
vote
0answers
391 views

really basic bootstrap logger - (preferably syslog, cascade to http/raw)

I have a bootstrap shell script that is run as the very first thing when a fresh Linux server is booted up to multi-user mode with networking. Once it is complete, I would like to report the error ...
0
votes
0answers
2 views

Pipe systemd StandardOutput and StandardError to both Syslog and File?

I have a systemd process that currently runs with the options StandardOutput=syslog StandardError=syslog I would like to continue sending logs to syslog, while also sending each to a different log ...
0
votes
0answers
29 views

Best way to intercept dnsmasq query logs

I have a Dnsmasq server, on which I want to parse query logs to be able to build stats based on queries / responses. The Dnsmasq provides two logging mechanisms: By default, it logs to syslog If a ...
0
votes
0answers
13 views

Tomcat 7 / logback produces logs to /var/log/message & journactl

Since we change our server from Centos 6 / Tomcat 6 to Centos 7 / Tomcat 7, tomcat's logs have changed places. Before the were located inside catalina.out and now they are in /var/log/message (and ...
0
votes
0answers
18 views

Disconnect desktop apps output from going to journald/syslog

At our university/department we run a bunch of Debian 10 labs. When people start applications from their desktop environment, some output goes to systemd journal + syslog (+ remote syslog collection) -...
0
votes
1answer
19 views

mysqldump cron job filling up my syslog

I have the following job in my crontab: 0 */4 * * * /usr/bin/mysqldump -u root -p'PASSWORD' --all-databases | /bin/gzip -9 > /home/USER/_mysql_backup/`date "+\%F--\%H-\%M"`.databases.sql.gz ; rm -...
0
votes
0answers
7 views

stop hddtemp syslog

I am using hddtemp to log the temperatures of my HDDs. Firstly I set it to log it every 60 secs, but that's too much, so after that I set that to 600 seconds, but now it logs every 60 and 600 seconds. ...
0
votes
0answers
14 views

How to read from syslog using systemd service

Does anyone know what the proper way is to create a systemd service and read from syslog write the logs out to the network? I had this in a service: tail -f /var/log/syslog | ...
0
votes
0answers
10 views

rsyslogd missing message?

I set up a logging host in the ryslogd config using python, restart daemon etc and get a correct message: Sep 20 09:03:20 Desk-r6 CLI[13845]: (admin) (root) (192.168.1.10) startup : Success Code to ...
0
votes
0answers
29 views

How to mute syslog from console, without using actual syslog daemon?

I usually switch between Xorg and (framebuffer) text console a lot. But every time I switch to text console, I got a message like this on the text console: acpid: client 7251[0:0] has disconnected ...