Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [syslog-ng]

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions. The main features of syslog-ng are summarized below.

  • Reliable log transfer: The syslog-ng application enables you to send the log messages of your hosts to remote servers using the latest protocol standards. The logs of different servers can be collected and stored centrally on dedicated log servers. Transferring log messages using the TCP protocol ensures that no messages are lost.
  • Secure logging using TLS: Log messages may contain sensitive information that should not be accessed by third parties. Therefore, syslog-ng supports the Transport Layer Security (TLS) protocol to encrypt the communication. TLS also allows the mutual authentication of the host and the server using X.509 certificates.
  • Direct database access: Storing your log messages in a database allows you to easily search and query the messages and interoperate with log analyzing applications. The syslog-ng application supports the following databases: MSSQL, MySQL, Oracle, PostgreSQL, and SQLite.
  • Heterogeneous environments: The syslog-ng application is the ideal choice to collect logs in massively heterogeneous environments using several different operating systems and hardware platforms, including Linux, Unix, BSD, Sun Solaris, HP-UX, Tru64, and AIX.
  • Filter and classify: The syslog-ng application can sort the incoming log messages based on their content and various parameters like the source host, application, and priority. Directories, files, and database tables can be created dynamically using macros. Complex filtering using regular expressions and boolean operators offers almost unlimited flexibility to forward only the important log messages to the selected destinations.
  • Parse and rewrite: The syslog-ng application can segment log messages to named fields or columns, and also modify the values of these fields.
  • IPv4 and IPv6 support: The syslog-ng application can operate in both IPv4 and IPv6 network environments; it can receive and send messages to both types of networks.
195 questions
2
votes
1 answer

using syslog-ng and patterndb, how do I specify an "empty" pattern?

When I receive kernel traces in my logs, the last line is empty. I'd like to filter/ignore these empty kernel messages using syslog-ng and patterndb. Here is the pattern I have so far that is not matching empty:
EdwardTeach
  • 632
  • 9
  • 20
2
votes
2 answers

Managing and configuring syslog-ng for very large logs

I have the logs traditionally kept in /var/log/ piped through syslog-ng. The logs can reach to the terabyte size on a daily basis. In order to make them more manageable. I would like break them out by server and app cluster. Is this the best way…
Thomas Vincent
  • 1,110
  • 6
  • 13
2
votes
1 answer

How does syslog-ng handles flush_lines(0)?

I wanted to make sure my syslog-ng was doing async logging. Reading through the documentation I see the flush_lines() option for file() destinations, if unspecified, will use the global default. Then I see that the global setting defaults to 0 but…
Luke404
  • 5,826
  • 4
  • 47
  • 58
2
votes
1 answer

Syslog-NG Error processing log message using IETF format

we've just changed our logging application on our AS/400 partitions and are now using a product called PowerTech SIEM agent for IBM I The tool used to format messages using the old syslog convention and is apparently now capable of sending IETF…
olivierg
  • 524
  • 2
  • 8
  • 27
1
vote
1 answer

syslog-ng configuration works in debug mode, but not without

I am trying to run syslog-ng as an OCF resource in an HA cluster. I am encountering some terribly strange behavior - when I start a single instance in debug mode, the filters match and it forwards appropriately. However when I remove the debug…
matoro
  • 31
  • 4
1
vote
1 answer

syslog-ng freezes/doesnt log when it encounters log messages with older time stamp

we are seeing issue with syslog-ng 3.8.1 dropping logs with older timestamp. Our system has an issue in persisting hardware clock after a reboot however, it might be an issue even with ntp jitter as well. It appears that if syslog-ng sees a log with…
Srinadh Penugonda
  • 11
  • 2
1
vote
2 answers

syslog-ng execute script on syslog pattern

I have a simple requirement. I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script. I have the following configuration, destination…
David Calderon
  • 11
  • 2
1
vote
1 answer

Syslog-ng: Hostnames with slashes

We have a problem where we have a device type logging with hostnames like slot1/devicename. Unfortunately, when the logs are written to disk, only the slot1 is written; since we have a number of devices, this prevents us from knowing which device…
W3t Tr3y
  • 141
  • 7
1
vote
2 answers

How can I extract tag from syslog message, and us it as path variable?

I have severals servers logging to the central syslog server, which collect the logs using syslog-ng. I send logs with a tag using the logger command : $ logger -n 01.02.03.04 "Hello from $HOST at $(date)" -t MY_SPECIFIC_TAG -p local2.error Using…
Jean
  • 123
  • 8
1
vote
1 answer

rsyslog/syslog-ng pattern to log ssh and related sftp session for an user

I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename: I have this: Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port 50512 on 199.xx.xx.xx port 2222 rdomain "0" Jan 8…
Jiri B
  • 547
  • 2
  • 15
1
vote
1 answer

Splitting a syslog-ng message

I want to save the source IP address from an sshd log entry into a mysql database from within syslog-ng. Currently, I have a filter defined which matches on a substring of the desired log entry. I can save the log entry, in it's entirety, to the DB…
Server Fault
  • 3,714
  • 12
  • 54
  • 89
1
vote
1 answer

Identifying who is logging to my device

I have a machine that aggregates syslog data from many devices, I keep all the devices that I want to have logging to my device in /etc/hosts so that they all have names that I understand. If a device logs to my machine that is not in /etc/hosts, I…
Peter Turner
  • 2,178
  • 9
  • 33
  • 45
1
vote
1 answer

syslog-ng, create logging sequence with file creation

I have been assigned to configure syslog-ng on a linux device to perform in a certain way. I am fairly new to working with syslog-ng, so please have that in consideration when replying. Following statements explain the prerequisites for the…
PerryBerry
  • 11
  • 1
1
vote
1 answer

Syslog-ng loggen behavior

Here's the situation: I have syslog-ng version 3.15. I've noticed that when using TLS and non-TLS transmission, the logs are different. I have noticed that, when sending logs using the loggen -i (non-TLS, old RFC3164 format) command, I receive the…
Aiurea Adica tot YO
  • 31
  • 6
1
vote
1 answer

AMQPS To Syslog

Currently I'm using basic API gets to pull down logs from a cloud security vendor but it's not a very clean process. I would like to transition over to the event streaming (AMQPS) service they provide. I've already setup the queue and have the…
Eric
  • 1,383
  • 3
  • 17
  • 34
1 2 3
…
12 13