General :: Installing Syslog -ng In Backtrack5
Jun 29, 2011i am looking to install syslog-ng on my backtrack5 linux.
View 2 Repliesi am looking to install syslog-ng on my backtrack5 linux.
View 2 RepliesI'm writing this post from the BT5 Live CD. However, after install and reaching a CLI (on the HDD), when I run startx, my monitor simply displays 'invalid format' (obviously this works fine via the LiveCD)... I've installed Ubuntu and Fedora a few times on a few machines, and have never had any issues with the display... not sure where to start troubleshooting.
View 4 Replies View RelatedI am looking for an open source syslog server which accumulate the each and every log of Windows, Solaris, Linux and network devices. Currently I am using Syslog-ng which is not fulfiling my requirement in Windows clients, as I need the logs of every action which user performed after logon.
View 2 Replies View Relatedtrying to replace syslog with syslog-ng. When I:
yum erase syslog,
wants to remove everything else that (presumably) has syslog as a dependency. how do I replace the dependency on syslog with a dependency on syslog-ng?
I noticed in my system that my root partition is getting full. I found a lot of old compacted syslogfiles. Had a look at etc/sysconfig editor eg cron but could not find a setting which allows to delete files older than a month. Where and how could I influence this ? I deleted manually all syslog files older than a month. Approx 6GB
View 9 Replies View RelatedI am configuring syslog-ng on my server.
I suspect something to be wrong.
Is there a tool I can use in the shell to generate a log? So I can check that the log appear in the syslog file.
How do I get syslog using serial port?
View 2 Replies View RelatedI was reading around the web and saw that someone mentioned that the default syslog configuration should be adjusted. Is that true?
View 3 Replies View RelatedI know about syslog and /var/log/* log files but I don't know what kind of events means particular problem.
E.g.
- hardware issues (?)
- security problem (/var/log/security)
[code]....
I'm reading about how to set log options and I can't find /etc/syslog.conf?
I'm using fedora12 , ubutnu 10.04 and suse 11.2.
And Can't find syslog.conf anywhere.
I have a Tomato router and it has the capability to have its logs go to a external server. syslog is the obvious choice for this. So I enabled remote logging on my linux server's syslogd (syslogd -r) and I can see all of the logs in /var/log/syslog. What I want to do is take everything that comes from the IP of my router (10.0.0.1) and divert it to its own file like /var/log/tomato to avoid polluting my syslog with external logs.
I can't find any examples of someone doing this. My only solution is to get a script together that strips out any line in /var/log/syslog with 10.0.0.1 in it and puts the line into /var/log/tomato and have the script run as a cron job, but that seems unnecessarily messy.
Unless someone knows that there is a solution, I'm 95% sure that syslog doesn't support this after reading more in-depth of the man page. So I need to migrate to syslog-ng or make a crazy script that runs with cron.
i installed php-syslog-ng 2.9.8m in RHEL5 box. I saw logs from the local machine once the cron execute in every one minute.I dont need to appear those in my syslog console. I want to disable these from my linux box.How can i archive this
View 1 Replies View RelatedI am running a syslogd on my ubuntu 10.10 system. I have a apache2 server on the same machine. I have configured my apache2.conf file to send the error logs to the local syslog server.
The config is as under :-
LogLevel notice
ErrorLog syslog:local1
I have also configured the /etc/syslog.conf as under :-
local1.info /var/log/apache2/error_logs
I have created a file in the /var/log/apache2 dir with the ownerships and permissions as under:-
-rwxrwxrwx 1 syslog adm 77 2011-08-11 18:14 /var/log/apache2/error_logs
Next I restarted the sysklogd and apache2 servers with a service command as under:-
sudo service sysklogd restart
sudo service apache2 restart
I thereafter observed the /var/log/apache2/error_logs file and found the entries for apache2 closing down and coming up as under:-
Aug 11 18:14:14 cc apache2[4940]: [notice] caught SIGTERM, shutting down
Aug 11 18:14:19 cc apache2[5282]: [notice] ModSecurity for Apache/2.5.12 [URL] configured.
Aug 11 18:14:19 cc apache2[5282]: [notice] Original server signature: Apache/2.2.16 (Ubuntu) mod_ssl/2.2.16 OpenSSL/0.9.8o
Aug 11 18:14:20 cc apache2[5285]: [notice] Apache/2.2.16 (Ubuntu) mod_ssl/2.2.16 OpenSSL/0.9.8o Microsoft-IIS/5.0 configured -- resuming normal operations
Now the problem is I donot get any other messages thereafter. So it is hardly useful. How can I increase the logged messages from apache. I tried the facility:
local1.*
Then restarted the sysklogd and apache2, but the contents of the /var/log/error_logs file remained similar. Next, I followed the link. I created the perl script for recording access logs of apache2. I then restarted the apache2 and sysklogd. when I opened my website from a browser, the access log did not work. I think I am getting something wrong with the facility value , in apache2.conf it is ErrorLog syslog:local1 ! but the script is suggesting that it should be local2 in the line 4
openlog('apache','cons','pid','local2');
I therefore changed the script to local1 in above line. But still no access log?
I noticed there're lots of "usb 3-1: reset low speed USB device using uhci_hcd and address 2" warnings in two of our server's syslog. They occur roughly every 20min. The server is a Dell R710 with CentOS 5.4 X86_64 installed. I suspect it's the virtual CD device of the iDrac6 but not sure. How Can I identify which USB device triggering these warning? The related syslog is as following:
Code:
Apr 13 23:32:47 bak2 kernel: usb 3-1: reset low speed USB device using uhci_hcd and address 2
Apr 13 23:42:44 bak2 kernel: usb 2-3: USB disconnect, address 3
Apr 13 23:45:53 bak2 kernel: usb 2-3: new high speed USB device using ehci_hcd and address 4
[code]....
How to configure a syslog client on ubuntu I don't have a syslog.conf file in ubunut client.also how to transfer log from windows xp to syslog server
View 1 Replies View RelatedI'm running Ubuntu Desktop 9.10. How do I get it to forward its logs to a syslog server (its running on a different machine)?
View 2 Replies View RelatedI am facing a problem while trying to log SSH messages in a separate file, say, /var/log/ssh_logs. I have tried modifying the syslog-ng.conf file as follows:
filter f_ssh { facility(auth, authpriv) and match("sshd[[0-9]+]:"); };
destination d_ssh { file ("/var/logs/sshd_logs"); };
log {
[code]....
But still I am not able to get the ssh logs in the new file. They continue to go to /var/log/auth.
Syslog is used to store simple log files or we can manage them too? Well, the thing is, that I need to run a software (like syslog) to collect my logs and put them in order and organize them so it makes them "understandable". I have been told that syslog can do the job and that it doesn't need a complex configuration to work.
View 12 Replies View RelatedI am using vsyslog() function in my application to write logs to syslog. I could see the logs in /var/log/syslog as follows.
Oct 6 11:25:23 machine application [4544]: cleanup code starts
What is this number [4544] stands for?
I configured syslog.conf to send logs to kiwi syslog server. After resetting (/etc/init.d/syslog restart),the server got log the message: "syslog 1.4.2 restart". But am getting just resetting message, nor other syslog message (using code or using logger command). I have other computer that send all the syslog messages.
View 2 Replies View RelatedI set up rsyslog for the first time on my sole Linux server (Debian Lenny), and I am using one PC to test it over the next few days. I currently have the Windows syslog daemon disabled so only the client is active.Before I recommend using it to collect logs from our production servers, has anyone heard of or had any problems with Syslog for Windows (URL...) running on XP/2003/etc? From what I've read is that since it sends the data over the network using UDP instead of TCP or an NFS mount, there should be no potential for problems.
View 2 Replies View RelatedTrying to figure out why the following two are treated differently...
Code:
*.warn;
kern.!=debug;auth.none;
authpriv.none;cron.none;mail.none;news.none -/var/log/syslog
and
[Code]....
According to man syslog.conf "You can specify multiple facilities with the same priority pattern in one statement using the comma (``,'') operator. You may specify as much facilities as you want. Remember that only the facility part from such a statement is taken, a priority part would be skipped."
Can someone confirm that this statement means that kern.!=debug is ignored in the first part because it's priority is not the same as the trailing facilities ending in .none?
I need to be able to send snmp traps based on certain severity or content of syslog messages. Can this be done from standard linux? Alternatively, are there MIB's out there that support syslog events so I can get the status from snmp?
View 1 Replies View RelatedIs there an easy way to prevent the logging of commands run into syslog as post-shell expansion?
I.e log a command of "ls *.log" as just that, rather than "ls a.log b.log c.log d.log" It makes rather a mess of the log files.
Trying to remove lines from a syslog text file that have duplicate strings
Mar 10 06:51:11[http-8080-1] INFO com.MYCOMPANY.webservices.userservice.web.UserServiceController [u:2533274802474744|360] Authorize [platformI$tformIdAndOs=2533274802474744|360, userRegion=America|360]
then a few lines down
Mar 10 06:52:03 [http-8080-1] INFO com.MYCOMPANY.webservices.userservice.web.UserServiceController [u:2533274802474744|360] Authorize [platformI$tformIdAndOs=2533274802474744|360, userRegion=America|360
got the same thing in terms of a u: number but the issue is I need to remove duplicates and just leave one and the file has multiple duplicates of different u: numbers and it's 14,000 lines long. can anyone tell me if I can use awk? sed? or sort for something like this to? removing lines that have a certain string in there that's a duplicate.
I'm running a cobalt raq550 web server (Linux version 2.6) and I want to install a syslog program on it, something that could log messages and send me an instant email in response to certain messages it receives. Is there such a program?
View 6 Replies View RelatedI can not find the syslog.conf in the /etc,what should I do?
View 3 Replies View RelatedI am a Novell (now defunct) CNE tring to learn Linux and am having a lot of trouble finding out where the WB 6-6 is wrong in the syntax for adding local4... the the syslog-ng config file. In the instructions there are discrepancies between commas and simi-comma, they are both in the statements in no particular order. there is no pattern to them. Here is what the book shows:
filter f_local4debug { level(debug) and facility(local4); };
When I try to input this in the Gnome terminal window to try and find out where it goes wrong I get the following: -bash: syntax error near unexpected token "(" If I can get the correct syntax I belive I can use the info to get past the rest of this portion of the lesson. I am desperate to learn Linux as the only jobs out there for a Novell CNE are migrations to MS, which really sucks, since MS really really sucks.
Recently I had to login to OS 11.3 via tty, but was unable to. Tty screen was flooded with syslog output. Instead of outputting info only on tty10 it was throwing it on every tty (1-6), I switched to.
How to fix this behaviour and restrict syslog output only to tty10?
I wonder how I can filter the syslog? i.e. there is a message that I don't want to see logged in there etc?
View 3 Replies View Related