When building 8.04 servers, I reconfigure snmpd's logging options to prevent copious low priority messages being logged whenever our network management workstation polls them. I edit /etc/default/snmpd and change line 11 from:
Code:
SNMPDOPTS='-Lsd -Lf /dev/null ...'
to:
[code]....
I have the following BIND messages filling up my SysLog that I'm hoping someone can explain to me:
Code:
Dec 9 09:35:44 dns2 named[30103]: client 67.130.224.5#49551: query (cache) 'www.domain.com/A/IN' denied
Dec 9 09:35:47 dns2 named[30103]: client 67.130.224.5#64561: query (cache) 'www.domain.com/A/IN' denied
[code].....
I would expect this behavior if "domain.com and anotherdomain.com" wasn't a domain that I hosted. But this is a valid domain that this server should be answering for. In my named.conf I do have the
Quote:
allow-query { any; };
option on every zone. This is my slave server and I have the primary shut off so I can test this slave server. FYI: So far queriers still seem to be working. The pages for the sites are still coming up via the internet.
I have six linux Centos 5.0 Servers. I had to configure the snmp client. I just created a pretty basic configuration snmpd.conf file
Code: rocommunity CompanyCom 10.1.1.10
I installed all of these
lm_sensors-2.10.7-4.el5.i386.rpm
net-snmp-libs-5.3.2.2-7.el5.i386.rpm
net-snmp-5.3.2.2-7.el5.i386.rpm
net-snmp-utils-5.3.2.2-7.el5.i386.rpm
4 of them are working fine, the application installed on 10.1.1.10 can query 4 servers but I got 2 Linux Centos that are in a DMZ, and my networking team already opened ports and configured NAT but the SNMP Server 10.1.1.10 is not able to query them how can I check the snmpd is really running apart from service snmpd status? might be related with the DMZ configuration?
I am using my ubuntu server as my home router.Everything is working as expected with one exception.y DSL modem is a POS and every now and again it looses connection to the router. Sometimes it needs to be reset and sometimes it does not.Either way, when this happens my ubuntu server needs to reacquire an IP from my ISP. If it screws up when I'm at home it's no big deal, but if it happens when I'm not around my housemates have taken to hitting the reset switch on the server. I'm not a big fan of this so I wrote a script to ping my ISP's gateway. If it's unavailable it bounces the eth0 interface and tries to get an IP. I am running this script every couple of minutes in a cron job. Now I'm getting syslog entries like
Code:
Aug 9 20:31:01 portal CRON[9602]: (root) CMD (/opt/ChkAndFixNetwork.sh)
every few minutes. This is annoying and makes the logs useless for troubleshooting. I
[code]...
My filesystem is almost full and the problem is in the proc folder.What does that folder contain and can I delete something from it?
View 1 Replies View RelatedI have a number of servers I manage, and one of them is archiving old data that is never modified on a separate partition. This partition is at 100% capacity. A friend of mine says this is an unsafe way to keep this partition, even tho I don't plan to add any more data to it or change anything within. I know I can archive the data to dvd, but I'd like to keep the data online for my users.
What are your opinions on this? Can I keep this archive partition at 100% capacity? Or do I risk some sort of data corruption? Should I mount this partition as read-only to help prevent any corruption?
I'm getting the following messages sent to my root account mailbox. It appears to be reporting an issue finding ntpdate, however when running the following command:
aptitude show ntpdate | grep State
It shows as installed and any ntpdate commands work with no issues, so I have no idea why this is getting regularly reported?
From root@mydomain.co.uk Wed Feb 03 18:20:01 2010
Return-path: <root@mydomain.co.uk>
Envelope-to: root@mydomain.co.uk
Delivery-date: Wed, 03 Feb 2010 18:20:01 +0000
[Code]....
I have a directory /var/log/data its about 80 GB,It filling up quit rapidly.I don't have much space left in the system them So i will attaching another External HDD.My question is that i need to mount /var/log/data to new HDD.So i have old data and pulse new coming up.I don't want to copy data from /var/log/data then mount new HDD to /var/log/data you know what i am taking about is there a simple way like linking or any other.
View 4 Replies View RelatedOk so I just installed Ubuntu server 9.10. It started out as cmd line only, I ended up installing ubuntu-desktop package from apt ran startx, and from that point on when ever I start the server I get the gui login screen instead of the original cmd line prompt. Now Ive been surfing around the net trying to figure out how to get it back to the original cmd prompt login screen, I really want to use startx when i need a gui.. the main reason I installed this package is really for all the libraries that it contains as i will use a few programs (firestarter, powertweak etc) that use a gui and I figured to make my life simpler i would just install the entire gnome desktop package so i will have everything i need when i try to run these misc programs (most of them will be run thru x11 forwarding as this server will only have internet and power plugged into it) Ive tried disabling gdm startup Ive even removed the /etc/init.d/gdm file all together and it still starts X (i moved it to /usr really but it should(?) work the same as deleting it). there is no other desktop manager to my knowledge (kdm etc).
Ive tried rcconf it says gdm is disabled (i tried disabling it before removing gdm from init.d and nothing), I went thru trying to disable anything that has to do with xserver so far I have only found x11-common I dont think it starts up x but i disabled it anyway. Ive also tried "update-rc.d -f gdm remove" that doesn't do anything either seems no matter what i try i cant stop the gui login screen from popping up.How do i get it to start with the original cmd prompt login?? i am considering reinstalling to get it back but i will lose all my work and that will defeat the purpose
Ive been asked by my boss to set up a ubuntu machine that will be used as a syslog server. He wants a GUI as a posed to a CLI. He would also perfer to have it non web based. We already have cati installed but he is not keen on the syslog side of that. Does anyone know of any other syslog programs?
View 1 Replies View RelatedOn this Ubuntu 8.04.4 LTS server, I want to log the messages from a Linksys router. So I made this change to "/etc/init.d/sysklogd" SYSLOGD="-r" Then in "/etc/syslog.conf" I added the following to the top of the file: Code: if $fromhost isequal 'Linksys' then /var/log/Linksys.log & ~
Then I rebooted the server. But there is no "/var/log/Linksys.log" file.
I wish it was under better circumstances...very morning at 6:25am syslog-ng stops logging, right after it attempts to log rotate. its odd... the daemon doesnt die... it gets a new PID, but doesnt write the output to /var/log/syslog.Yet if I manually restart or reload syslog-ng it works great... its just like it doesnt like the logrotate...I have googled around and tried a few things...first I changed the postrotate in the logrotate.d/syslog-ng
--------/etc/logrotate.d/syslog-ng---------
/var/log/syslog {
rotate 7
[code]....
Is there a way to force the syslog ie /var/log/messages to restart at say 1:00 am instead of 7:55 or so each morning?
View 4 Replies View RelatedI'm guessing its possible but I can't seem to find any documentation on how to do this.I've tried playing with entries at the top of my syslog.conf file like:
*.* @172.20.10.1 # 1 server, works file
*.* @172.20.10.1,172.20.20.11 # doesn't work
*.* @172.20.10.1 172.20.20.11 # nor this
*.* @172.20.10.1,@172.20.20.11 # nor this
*.* @172.20.10.1 @172.20.20.11 # nor this
I am looking for an open source syslog server which accumulate the each and every log of Windows, Solaris, Linux and network devices. Currently I am using Syslog-ng which is not fulfiling my requirement in Windows clients, as I need the logs of every action which user performed after logon.
View 2 Replies View RelatedBoot of a new minimal system hangs on "Stopping save kernel messages" or "stopping system v runlevel compatibility". I have ubuntu minimal iso x86_64 from usb stick created with unetbootin (don't have a cd drive on the machine in question), and after that I didsudo aptitude install gnome-terminal network-manager-gnome gdm geditsudo rebootnever got a system back. Annoyingly I can't boot into the recovery mode either, and it seems the keyboard is only semi-responsive (i.e. many dead keys when at the grub menu).qualms about reinstalling, but I've done this a few times and ended up at the same place every time.
View 6 Replies View RelatedI'm running a syslog server on ubuntu 7.04. Can I somehow have it email me if it finds a certain thing in the log? For example. I'm running a PRI and when the PRI goes down, it logs a "DEACTIVED" in the log. I would like an email telling me this so I know to get on it and fix it.
View 9 Replies View RelatedI recently upgraded a Ubuntu server from version 8.04 to 10.04 and after a reboot the webmin and syslog-ng server do not start at boot anymore. I can start them manually by doing /etc/init.d/webmin start and /etc/init.d/syslong-ng start and everything works fine until I root again. Granted this machine is rarely rebooted but when it is, I don't want to have to remember to start these services. I have tried a full removal of syslog-ng and reinstall but to no avail. The entries are in the rc directories like they should and the links are valid.
View 1 Replies View RelatedI am running a headless Ubuntu 10.04 server with the 2.6.32-28-generic kernel. For what I can figure out no single direct cause I get a high load average and the following syslog output at random intervals. Generally the load average will drop back down to normal however the kernel errors will still continue What little I have been able to find has pointed to memory issues. I am not totaly convinced this is the cause as the server will be showing >50% free when the errors are happening.
[code]...
I guess with major changes to syslog-ng, php-syslog going to licensing cost, and major overhaul to the syslog plugin with cacti - alot of documention was either disjointed, outdated or I just couldn't find it.this was performed on an 11.04 Ubuntu Server tall. I already had Cacti up and running and just needed to make it also a syslog collector.This guide assumes you already have mysql running, and cacti is already in place. If something looks wrong - please correct me. I am doing this from memory - trying to remember what all I had to do, and not a super admin.Required ubuntu install packages:libdbd-mysql syslog-ngcacti install packages:[URL]
Stop syslog-ng if you want. Changes should not take effect until you restart it.Should save the default syslog-ng configuration if you want to be safe. Below is the absolute minimum you need to get this working.Configuration on ubuntu is location in /etc/syslog/syslog-ng.conf Also make sure you fill in the proper username and password for mysql.
Code:
@version: 3.1
#Bare minimum syslog-ng configuration
[code]....
How do clients handle offline syslog servers?Will the log files be buffered locally to be sent to the syslog server when it comes back online, or will any log data generated during downtime be lost in cyber space?
View 1 Replies View Relatedturn up the level of logging that my DHCP Server is writing to SYSLOG?I can't seem to find a syslog.conf file to edit.
View 1 Replies View RelatedCurrently Im having a syslog server that consolidate firewall logs on port 514 udp. Im also having a IDS device that I wish to push its logs to this particular syslog server so that I can retrieve my IDS logs on this server as well.
Is it possible to do so?Having syslog listening on port 514 for both firewall and IDS logs? If it is possible will the logs be recorded in a single log file?Or will it be recorded in a separate log file ie. firewall.log, IDS.log etc?? I wish to have them in separate individual log files or else there will be hard time segregating the log entries in a single file. Can anyone advice on how to achieve this??
I have installed Mysql in Ubuntu 9, for the use of roundcube database.After installing iam getting the error like this
* Stopping MySQL database server mysqld [ OK ]
* Starting MySQL database server mysqld [ OK ]
* Checking for corrupt, not cleanly closed and upgrade needing tables.
So because of this in the roundcube configuration its giving the error message that MYSQL is not installed. So Kindly give me a idea how to solve this.
In December I finally filled up my root partition and broke Suse 11.1. I therefore resized my partitions and installed Suse 11.3 on /root. I didn't not touch my /home partition.
I notice that when I leave my machine and come back the screen has locked. I have tried to turn off the screensaver, but it hasn't worked. I have Googled, but unfortunately the screen shots don't look like what I have and the instructions to stop this do not seem to match what I am seeing on the screen.
Is there a way to do this via the command line?
I installed Gnome on my server using the gnome-core and xinit packages so I could use MySQL Workbench.I start up Gnome when I need it via startx./etc/init.d/gdm doesn't exist so I can't use gdm start or gdm stopHow can I stop Gnome and the X server in this situation?
View 1 Replies View Relatedtrying to replace syslog with syslog-ng. When I:
yum erase syslog,
wants to remove everything else that (presumably) has syslog as a dependency. how do I replace the dependency on syslog with a dependency on syslog-ng?
I noticed in my system that my root partition is getting full. I found a lot of old compacted syslogfiles. Had a look at etc/sysconfig editor eg cron but could not find a setting which allows to delete files older than a month. Where and how could I influence this ? I deleted manually all syslog files older than a month. Approx 6GB
View 9 Replies View RelatedI would like to know if what this log error mean and how i can resolve this matter. I would like to verify if this is a misconfiguration or a bug on my settings
the log error is:
snmpd:error parsing ', skipping
the RHEL version used was 4 update 4 64 bit
the snmp packages installed were:
net-snmp-5.2.1-0.2
net snmp-lib - 5.1.2-11
net-snmp-lib - 5.2.1-0.2
I wanted to make a SysLog Server in Ubuntu 10.04 Desktop to collect the startup log of all the workstation inside the local area network,which should have a similar functionality to this guide here:Debian Syslog Server..However, when editing the sysklogd, i noticed it was empty and does not have any default values, along with the /etc/syslog.conf, which does not also exist.
View 2 Replies View Related