Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [syslog-ng]

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions. The main features of syslog-ng are summarized below.

  • Reliable log transfer: The syslog-ng application enables you to send the log messages of your hosts to remote servers using the latest protocol standards. The logs of different servers can be collected and stored centrally on dedicated log servers. Transferring log messages using the TCP protocol ensures that no messages are lost.
  • Secure logging using TLS: Log messages may contain sensitive information that should not be accessed by third parties. Therefore, syslog-ng supports the Transport Layer Security (TLS) protocol to encrypt the communication. TLS also allows the mutual authentication of the host and the server using X.509 certificates.
  • Direct database access: Storing your log messages in a database allows you to easily search and query the messages and interoperate with log analyzing applications. The syslog-ng application supports the following databases: MSSQL, MySQL, Oracle, PostgreSQL, and SQLite.
  • Heterogeneous environments: The syslog-ng application is the ideal choice to collect logs in massively heterogeneous environments using several different operating systems and hardware platforms, including Linux, Unix, BSD, Sun Solaris, HP-UX, Tru64, and AIX.
  • Filter and classify: The syslog-ng application can sort the incoming log messages based on their content and various parameters like the source host, application, and priority. Directories, files, and database tables can be created dynamically using macros. Complex filtering using regular expressions and boolean operators offers almost unlimited flexibility to forward only the important log messages to the selected destinations.
  • Parse and rewrite: The syslog-ng application can segment log messages to named fields or columns, and also modify the values of these fields.
  • IPv4 and IPv6 support: The syslog-ng application can operate in both IPv4 and IPv6 network environments; it can receive and send messages to both types of networks.
195 questions
1
vote
2 answers

rsyslog Text File Input Module error

I'm using: root@u1210: /etc () # lsb_release -d Description: Ubuntu 12.10 root@u1210: /etc () # dpkg -l | grep rsyslog ii rsyslog 5.8.6-1ubuntu9 amd64 reliable system…
HVNSweeting
  • 534
  • 2
  • 10
  • 17
1
vote
0 answers

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option enabled at receiving side. THe syslog-ng servers…
Abhijeet Rastogi
  • 236
  • 3
  • 20
1
vote
1 answer

Syslog-ng log template \\011 character

I have a problem with syslog-ng. I want to make syslog-ng to format the logs like below: template("$YEAR-$MONTH-$DAY\\011$HOUR:$MIN:$SEC\\011$HOST\\011$MSGHDR$MSGONLY\n") But it logs without the "\". Just "011". Example: Expected:…
0xmtn
  • 360
  • 3
  • 15
1
vote
1 answer

/var/log/messages spammed with POLLERR messages

I've started seeing /var/log/messages growing in size indefinitely with these lines: Aug 1 12:47:27 linux-jblp syslog-ng[1947]: POLLERR occurred while idle; fd='16' Process 1947 is this: root 1947 1 1 12:45 ? 00:00:03…
Daniel
  • 11
  • 1
  • 3
1
vote
2 answers

Almost-live copy of log from one server to another

We have an authentication daemon on a Debian 6.0 box generating logs at a rate of about 4-6 lines\entries every second. For legal reasons this log file has to be written to disk locally first, before we can back it up or transfer it anywhere. These…
Tim Jones
  • 13
  • 2
1
vote
2 answers

Squid logging to syslog-ng - program name has brackets

Using Ubuntu 10.04.4 LTS and Squid3 I want to log to syslog-ng Edited /etc/squid3/squid.conf and added the following line: access_log syslog squid Logs are being written but the program name "squid" is being added in brackets, while for other logs…
Nick Sturgess
  • 190
  • 2
  • 7
1
vote
1 answer

Syslog-ng duplicate log lines

I have a very annoying situation concerning apache access/error logs on a remote log server. Webserver: Stock apache logging with: ErrorLog "|/usr/bin/logger -p local7.err -t www.sitename.com" CustomLog "|/usr/bin/logger -p local7.info -t…
Johan Kooijman
  • 13
  • 1
  • 3
1
vote
1 answer

Can I create a new syslog-ng file() source and tell syslog-ng to ignore existing data and process only new data

I have a large amount of existing data stored in files on a NAS (stored in hierarchical date-based directories, not that I think that matters). These directories are still being written to. I have created a new syslog-ng file() source to process…
Marc Harris
  • 11
  • 2
1
vote
2 answers

Syslog-ng: how to change a message before sending to a remote host

I'm using syslog-ng 1.6.8 on SLES 10. From this machine, I need to forward all events to the remote host 10.30.38.115. But preliminary I have to change messages a little bit, adding "MyMark" prefix to the end of the event. I tried the…
user54614
  • 379
  • 2
  • 6
  • 18
1
vote
0 answers

how to filter syslog messages by interfaced received

with a server assigned two interfaces, .234 and .235, how can I create a filter separating the incoming messages ? This configuration, only outputs to one folder ---- list interfaces ---- eth0:234 - 10.10.10.234 eth0:235 - 10.10.10.235 ----…
netsirk
  • 11
  • 1
1
vote
1 answer

using syslog-ng and patterndb, how do I specify an "empty" ruleset pattern?

In a similar vein to my previous question regarding syslog-ng's patterndb patterns to match an empty description, I am now trying to match "--MARK--" messages. The messages look like this: -- MARK -- Their ${PROGRAM} is apparently set to…
EdwardTeach
  • 632
  • 9
  • 20
1
vote
1 answer

Why is syslog-ng randomly change the logging file from messages to messages.yyyymmddhhmm?

Sometimes syslog-ng will change from logging to the file messages to filename with timestamp appended like this messages.yyyymmddhhmm. Of course this then breaks anything I have that is reviewing incoming logs in messages. This on Ubuntu 10.04.3 LTS…
Adam
  • 581
  • 3
  • 8
1
vote
2 answers

SyslogNG message format

I am reading through some syslog-ng documentation, and in the section about filter functions, it says that the program() filter matches... ...messages by using a regular expression against the program name field of log messages. The documentation…
Rich
  • 1,343
  • 7
  • 28
  • 39
1
vote
1 answer

Log "date -s" command

I know that the date -s command sets the time described by the string STRING. What i want is to log the above command whenever it is used to set the time into the file /tmp/log/user.log. In my Linux distribution the logging is done by…
LinuxPenseur
  • 443
  • 1
  • 6
  • 16
1
vote
2 answers

Syslog - capturing event logs from Win2k boxes

I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist. We have a central syslog server and we want it to capture event log events from Windows hosts. We are specifically interested in logging…
molecule
  • 83
  • 1
  • 4
  • 12
1 2 3
…
12 13