Questions tagged [syslog]
syslog is a standard (RFC 5424) for message logging. Use this tag for syslog logging related messages. For generic logging messages use [logging] instead
444 questions
2 votes
1 answer
101 views
How to disable Journald's ForwardToSyslog=yes on Ubuntu 24.04?
I have Ubuntu 24.04 servers with this Journald config by default: user@server:~$ systemd-analyze cat-config systemd/journald.conf # /etc/systemd/journald.conf # This file is part of systemd. ... [...
- 302
0 votes
0 answers
127 views
/dev/log is a socket not a symbolic link
I am trying to understand why one of my system has /dev/log as a socket and other has /dev/log as a symbolic link. [ec2-user@ip-171-31-12-17 log]$ file /dev/log /dev/log: symbolic link to /run/systemd/...
0 votes
1 answer
80 views
Why syslogd receives the message and not journald?
I have tried to log into journald using logger. logger test, journalctl |grep test does not show any output. The message does not reach journald even though it listening and logger is writing (I ...
1 vote
1 answer
113 views
Logging Cisco logs on remote linux syslog
Good evening, I am running multiple cisco routers/switches and a virtualized debian install. In order to have proper forensic capabilities in cse of attack/breach/malfunction I wish to have remote ...
- 11
0 votes
1 answer
65 views
How to increase the number of log files: /var/log/mail.log* on macOS?
On my actual macOS, there are every day 7 flat files in /var/log of name mail.log* rotating at 23:00: ### 18:20 milky-way:/etc/asl # ls -al /var/log/mail.log* -rw-r-----@ 1 root admin ...
- 1,095
-1 votes
1 answer
499 views
syslog logging driver giving the error protocol wrong type for socket
I have a service defined via docker compose (see definition below). When I tried to start this service via docker-compose -f up --wait -d my_service, I get the error Error response from daemon: ...
- 3
0 votes
1 answer
905 views
How do I change the date/time format in syslog-ng from `mmm [d]d hh:mm:ss` to `yyyy-mm-dd hh:mm:ss`?
I noticed that the default datetime format for logs in /var/log/messages is mmm [d]d hh:mm:ss, for example: Jan 4 03:46:50 1.2.3.4 ntpclient[6952]: Failed resolving address to hostname pool.ntp.org: ...
- 159
0 votes
2 answers
673 views
How do I check which conf file was loaded by syslog-ng when starting?
I am running syslog-ng on debian. How do I check which conf file was loaded upon startup? Neither systemctl status syslog-ng nor systemctl show syslog-ng tell me.
- 159
0 votes
1 answer
464 views
rsyslog variable from mmnormalize as part of omfile filename
I have a log line that looks like this: May 20 10:25:42 192.168.20.100 Timestamp="2024-05-20 10:25:42",LogId="535666280",NodeId="192.168.1.100",Facility="Packet ...
- 1,020
-1 votes
1 answer
632 views
How to preserve log contents across reboots?
As far as I can tell, syslogd in its default configuration throws away all log data on reboot. I have observed this data on Raspbian (Debian Linux-based) and on OPNsense (FreeBSD-based). From my point ...
- 1,575
-1 votes
1 answer
327 views
Portable logging from Python?
I am writing a small plugin for Postfix using python and want to it to emit logging messages. I am not particularly familiar with python and was advised to use loguru. This was certainly easy when I ...
- 6,360
0 votes
1 answer
74 views
rsyslogd v3.x.x unexpectedly closes write connection to named pipe target
I've configured rsyslog to forward certain log messages to a named pipe /tmp/logger.pipe. I then have a separate process reading from the named pipe. Relevant section from /etc/rsyslog.conf # Remote ...
- 1,023
2 votes
1 answer
808 views
pfSense (FreeBSD 14.0) - Prometheus Node Exporter gives log errors - fix or suppress in log
On pfSense, I've enabled Prometheus Node Exporter, but it gives the following log errors each 15 seconds: Feb 15 09:53:57 vault node_exporter[25559]: ts=2024-02-15T08:53:57.164Z caller=collector.go:...
- 792
0 votes
2 answers
558 views
Root partition is running out of disk space due to too large syslog files
This is occurring while backing up whole drive with rsync. I'm trying to sync two large hard drives as a backup and I'm doing so exactly as described here using the Grsync GUI. While doing so I get ...
- 4,980
1 vote
0 answers
3k views
PAM - Disabling "check pass; user unknown" syslog messages
TLDR: We use PAM with SSHD. CentOS and Ubuntu exist in the environment. For every SSHD failure of an unknown user, it creates two messages. One of the messages doesn't provide the unknown username and ...
