Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [syslog]

syslog is a standard (RFC 5424) for message logging. Use this tag for syslog logging related messages. For generic logging messages use [logging] instead

Filter by
Sorted by
Tagged with
0
votes
0answers
135 views

rsyslog: send logs to different file by filtering syslogs

I have a CentOS based rsyslog server which have the below settings, where it's getting all the remote NATing events from multiple hosts. $template TmplcpFW, "/var/log/%HOSTNAME%.log" if ($hostname == ...
2
votes
1answer
227 views

Source of this error: udevd [ PID ]: inotify_add_watch(6, /dev/sda, 10) failed: operation not permitted

We have this log in our syslog: udevd [ PID ]: inotify_add_watch(6, /dev/sda, 10) failed: operation not permitted Why do we get this error and how do we solve it? Our environment: Ubuntu 12.04; LXC;...
1
vote
1answer
48 views

Track active logging to log files

Is there a way to track which service/file is actively logging to a log file? In this case taking info from the syslog file and creating a file called filtered.log. I'm not seeing a process for ...
1
vote
1answer
1k views

rsyslog: send logs to different file using custom template

So, I'm using systemd to send the logs to rsyslog, and I want to write the logs to /var/log/app.log. Since it is a Java app with its own log format, I don't want to have timestamps or anything on it,...
1
vote
1answer
128 views

My attempts to use rsyslog to route messages to a log file

In myapp.service, I have : StandardOutput=syslog StandardErr=syslog When I do : $ journalctl -e -u myapp I can see each line of log contains "myapp[PID]". I've tried to set up /etc/rsyslog.d/...
0
votes
1answer
208 views

syslog-ng modification issue for unix socket

I am having issue researching the right way to go about a problem. The problem is the syslog-ng file in the salt master server at the moment only enforces unix-stream as follows: source s_sys { ...
3
votes
1answer
45 views

Find what program accessed a kernel module

How do I access a list of users/programs that accessed a certain module? I run: lsmod | grep ^uvcvideo This returns this line when no application is using my video camera: uvcvideo ...
-1
votes
1answer
179 views

Could I disable syslog.service after installing rsyslog on Ubuntu 18.04 server?

I am making a minimal Ubuntu for embedded system starting from Ubuntu base. Our samba-related script code relies on rsyslog so I installed this package. systemctl shows there is also a syslog.service,...
0
votes
1answer
1k views

Why is there no /var/log/kern.log?

I have an embedded system running a slim installation of Buildroot Linux with kernel 3.10.105. Apparently most commands come from BusyBox here, and it seems those do not always implement the full ...
1
vote
1answer
2k views

Where does cron log by default?

On Ubuntu 18.04, man cron says cron logs its action to the syslog facility 'cron', and logging may be controlled using the standard syslogd(8) facility Also, the default configuration of ...
0
votes
1answer
295 views

syslog forwarding

I'm using Solaris and have an application that writes to a log file /app/data/log/foo_log.021118. Am I able to use syslog to forward that specific log file to a remote server? Should I put ...
1
vote
2answers
625 views

Rsyslog - How to disable udp syslog?

Currently rsyslog is listening on both UDP socket and UNIX socket, as shown below: [root@machine ~]# netstat -ap | grep rsyslog udp 0 0 0.0.0.0:59018 0.0.0.0:* ...
2
votes
1answer
43 views

Possibility to disable or hide CRON notification about starting one specific process

I was wondering if it is possible to having multiple cron jobs in crontab active, but only one of them starts each minute. The problem here is I wish to keep log of all others jobs informations with ...
1
vote
1answer
289 views

Encryption of syslog & auditd in local disk? [closed]

We need to use encrypted syslog and auditd in local disk. Is it possible to save syslog and auditd message encrypted in disk ?
0
votes
0answers
268 views

How can I make syslog-ng to filter for a user name?

I've found a nice feature of the syslog-ng: if I use the logger to log things from the user process, I get the logging user name. Around so: peterh$ echo test log message|logger then I get this in /...
-1
votes
1answer
1k views

SyslogNG-How to optimise filter and log statements? [closed]

Below is the current configuration for Syslog-NG logging, locally, source s_network { udp( flags(syslog_protocol) keep_hostname(yes) ...
1
vote
1answer
436 views

Deployment of haproxy between devices and Syslog server

Below is the current architecture of Syslog-NG to avoid single point of failure. Currently devices send same syslog message to two syslog servers listening on UDP port 514. Each server stores the ...
1
vote
1answer
299 views

Message forwarding with de-duplication - SyslogNG

Based on the advice from answer that says: Simply adding both servers and always write to both is the easiest one, we have setup syslog-NG server on two machines that receive same syslog message and ...
0
votes
2answers
2k views

syslog-ng won't start because error binding socket with permission denied

I've recently rebooted one of my machines after a long time and a now I'm having a lot of problems with configuration changes. syslog-ng service is not working anymore with the following error from ...
0
votes
1answer
42 views

How can a syslog configuration be set to place a log in the users home directory?

I want to use one of Drupal's syslog modules but place the log in a the user's home directory so there are not permissions issues when the user wants to view or analyze the file. Is there a way a ...
0
votes
1answer
578 views

How to omit PAM log messages for specific user (pam_succeed_if quiet)

I'm using a monitoring agent (telegraf) to monitor fail2ban. Unfortunately, it requires SuperUser rights to execute fail2ban-client, which causes 24 system log messages every 10 seconds... Do the math,...
0
votes
3answers
74 views

How to ensure syslog captures maximum possible log before abrupt system power off

I observe that syslog file (/var/log/messages) doesn't seem to capture the latest possible log before abrupt system shutdown. (My Linux system is running and then abruptly there is a power loss.) How ...
0
votes
1answer
121 views

Forwarding messages with certain filter

Scenario is to receive all incoming messages and store all of those messages in /app/syslog-ng/custom/output/all_devices.log, but forward only certain messages(by filtering). filter tag is used to ...
6
votes
2answers
5k views

Examining /dev/log

/dev/log is the default entry for system logging. In the case of a sytemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix ...
0
votes
1answer
23 views

Configuring event log - RHEL

In the Readme, it mentions to invoke ./configure before make & make install of eventlog on RHELinux. But, I do not see configure script except configure.in. Do I need to rename configure.in to ...
0
votes
1answer
27 views

Why is 'logger' always executed as the same user?

I'm using rsyslog 8.24 on debian. Each time I trigger logger "some message" the syslog refers to the same and only system user - it does not matter if I switch user (even as root), the messages are ...
4
votes
1answer
3k views

Sending bash history to syslog

Bash version 4.N has apparently the ability to write command-history to syslog, but I can't find information about how to configure this. I have read several pages which offer hacks using the ...
1
vote
2answers
521 views

Pass kernel and boot logs to syslog

I have a systemd based system and for some services I had to set up remote logging. The simplest way to set this was to use rsyslog and set the StandardOutput=syslog in the unit file. Now I also ...
2
votes
2answers
704 views

nvme fstrim causing crash on linux, disabling with systemctl doesn't help

I have a Linux (Ubuntu 18, kernel 4.15) desktop booting from an M2 nvme disk. Once a week, it will crash around midnight. The relevant log file output from /var/log/syslog.* is below: Jul 16 00:00:...
0
votes
0answers
50 views

React to a writing error

Hi there, I'm curently working on a debian system, this system (under Jessie) write datas to an SDcard really often, sometimes (i'm working on it but it is not the question here) the system is unable ...
1
vote
2answers
533 views

OpenVPN riddling syslog with errors, but otherwise seems to work flawlessly

Yesterday I configured OpenVPN on a Ubuntu 18.04 server which seems to work. I can connect no problem and systemctl status openvpn gives me green. However, my syslog is being riddled with errors which ...
0
votes
1answer
424 views

Syslog-ng not sending messages to localhost port 514 on centos 7.5

tcpdump -nnAs0 -i eth0 port 514 As I understand it this should display any logging msgs sent to syslog locally. However I send many via python syslog module, which I can tail via /var/log/messages ...
1
vote
1answer
989 views

How to set up syslog to log to both file && buffer

I'm using an embedded Linux OS which was built using yocto. I'm trying to alter busybox syslogd in order to have it output to both a file & buffer. so I can use logread -f as well as have the ...
0
votes
2answers
134 views

Grep/sed/awk or pull certain information in a file using regex/linux commands

I have file with this output, and I am trying to collect useful data from my file. R1#show ip route 192.168.5.130 Routing Descriptor Blocks: * 192.168.5.128, from 192.168.5.162, 00:20:16 ago, via ...
1
vote
2answers
5k views

Why is kill -HUP used in logrotate in RHEL? Is it necessary in all cases?

I see for syslog logging, kill -HUP is used. /var/log/cron /var/log/maillog /var/log/messages /var/log/secure /var/log/spooler { sharedscripts postrotate /bin/kill -HUP `cat /var/run/...
0
votes
1answer
30 views

Set up remote logging with Syslogd

How do you configure the syslogd service to listen on UDP port 514? Do you specify the port with the -r option in the /etc/sysconfig/syslog file?
0
votes
0answers
25 views

Log files - skip writing some unimportant (but frequent) strings

I have a lot of unimportant similar (or even the same) reports in log files. I want to have my log files simple and transparent, so my idea is that some strings shouldn't be written in log files. An ...
0
votes
1answer
163 views

Logger -f command killed opening /var/log/messages in tail

I'm trying to run this command on CentOS. logger -t AUDIT_LOG -f <MY_AUDIT_LOG_FILE> & It works correctly for 10/20 seconds. Opening /var/log/messages in tail I can correctly see messages ...
0
votes
2answers
546 views

syslog message format & syslog-ng

Case 1: For the below incoming message of syslog, <14>Mar 22 11:12:06 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.2.3.4/62963->23.58.169.35/443 0x0 junos-https 6.7.8.9/32359->23....
0
votes
2answers
89 views

Linux command to search files using pipes

Problem: I need to find the 5 services that have produced most logging messages in files /var/log/syslog and /var/log/syslog.1. tr - to remove process numbers, so that all processes seem equal. cut - ...
4
votes
0answers
2k views

How to change the log file for sshd in Ubuntu 16.4 LTS? [duplicate]

i am trying to direct sshd log to /var/log.auth.log but instead it goes to /var/log/secure My current log of sshd goes to /var/log/secure, and I want to separate the sshd for a different log (for ...
2
votes
1answer
1k views

Daemon spamming system.log and daemon.log

I'm having an issue with a specific daemon filling up daemon.log and system.log in minutes. The lines spammed are: Mar 6 05:07:32 lin openconnect[2309]: Connect UDP socket#012: Bad address I'm not ...
0
votes
0answers
412 views

/var/log mounted as a tmpfs failing to get umounted on FreeBSD

I have /var/log mounted as a tmpfs, where log files are synced periodically to the disk by the cron on FreeBSD. The process is done by the rc script. I am mounting it like: mount -t tmpfs -o nosuid,...
-1
votes
3answers
112 views

Listing a Summary with limits

I am trying to list a number of offending IP's with a one line command, and am not sure how to do the last little bit, maybe someone can point me in the right direction. cat /var/log/syslog* | grep "...
0
votes
0answers
273 views

Configure syslog file in Raspbian Stretch Lite

I am working with a Raspberry Pi Zero W and Raspbian OS and use the log file syslog which is located in /var/log/syslog/ to track specific events. My problem is, that the syslogfile is overwritten ...
0
votes
1answer
2k views

Can the logrotate descriptor handle multiple wildcards?

For example, on a syslog collector, where remote syslog is coming into /var/syslog/<host>/*.log, can I have something like the following in my logrotate config: /var/syslog/*/*.log { daily ...
2
votes
1answer
48 views

How to find out why server turned on

I have a PC running as debian server. Usually, the server is shut down until I press the power button or send a Magic Packet via WakeOnLan. But sometimes, the server turns on alone. How can I find ...
4
votes
1answer
291 views

Is there a syslog daemon that implements RFC 5848 “Signed Syslog Messages”?

I was looking at the Syslog standards and found RFC 5848 "Signed Syslog Messages". I then tried to find out which syslog daemons supported this standard. But to my surprise syslog-ng and rsyslog both ...
1
vote
1answer
539 views

Is it possible to customize iptables logging to syslog?

Let's say I have the following log entry from iptables to syslog: Nov 3 12:04:12 mypc kernel: [ 296.274134] Packet: IN=enp0s9 OUT=enp0s8 MAC=08:00:27:2f:77:23:08:00:27:86:42:0e:08:00 SRC=192.168....
0
votes
1answer
905 views

How to interpret SCSI device (sd) timeout logs

In /var/log/messages, I find the following log: Oct 23 21:48:53 localhost kernel: sd 3:0:0:0: timing out command, waited 180s Please explain the values that are separated by colons. Also where ...