My syslog shows hundreds of successive messages:
... Jun 4 09:18:21 www kernel: [55101.038066] testing the buffer Jun 4 09:18:21 www kernel: [55101.038181] testing the buffer Jun 4 09:18:21 www kernel: [55101.040872] testing the buffer ...
Where are these coming from? Ubuntu 20.
so, playing with centralized logging and i just cannot get syslogd to send the messages to a remote syslog server.
background:
syslog server is setup and working, tested with other devices sending logs into it.
networking both server and client reside in the same subnet, firewalls are off on server, from what i can tell ubuntu has no firewall configured. tested 514 open on the server from the client and get a successful connection.
setup/test process
syslogd didn't seem to exist on my install, so i installed it:
sudo apt-get install -y inetutils-syslogd
modified the config file in /etc/syslogd.conf to include 2 lines:
*.* /home/lee/test
*.* @10.120.1.20
saved and reloaded syslogd by sending the hangup signal
killall -s SIGHUP syslogd
testing with the logger function:
logger "test"
inserts lines into the local file, but nothing gets to the server.
tried setting up a tcpdump on 512 outbound to see if anything is going through:
tcpdump -n -s 1500 -X port 514 -w /home/lee/tcpdump.pcap
the file is empty, tried tracing the PID as such:
strace -s 500 -tfp 188341 -o /home/lee/strace_syslog
the output of the file indicates it sees the test messages, and writes to some outputs, but nothing seems to indicate writing out to the remote syslog address...
1446 10:27:52 restart_syscall(<... resuming interrupted poll ...>) = 1
1446 10:28:03 recvfrom(21, "<13>May 18 10:28:03 lee: test", 1024, 0, 0x7ffd918070e0, [110->0]) = 29
1446 10:28:03 rt_sigprocmask(SIG_BLOCK, [HUP ALRM], [], 8) = 0
1446 10:28:03 writev(22, [{iov_base="May 18 10:28:03", iov_len=15}, {iov_base=" ", iov_len=1}, {iov_base="ubuntu-docker", iov_len=13}, {iov_base=" ", iov_len=1}, {iov_base="lee: test", iov_len=9}, {iov_base="\n", iov_len=1}], 6) = 40
1446 10:28:03 writev(20, [{iov_base="May 18 10:28:03", iov_len=15}, {iov_base=" ", iov_len=1}, {iov_base="ubuntu-docker", iov_len=13}, {iov_base=" ", iov_len=1}, {iov_base="lee: test", iov_len=9}, {iov_base="\n", iov_len=1}], 6) = 40
1446 10:28:03 writev(11, [{iov_base="May 18 10:28:03", iov_len=15}, {iov_base=" ", iov_len=1}, {iov_base="ubuntu-docker", iov_len=13}, {iov_base=" ", iov_len=1}, {iov_base="lee: test", iov_len=9}, {iov_base="\n", iov_len=1}], 6) = 40
1446 10:28:03 writev(6, [{iov_base="May 18 10:28:03", iov_len=15}, {iov_base=" ", iov_len=1}, {iov_base="ubuntu-docker", iov_len=13}, {iov_base=" ", iov_len=1}, {iov_base="lee: test", iov_len=9}, {iov_base="\n", iov_len=1}], 6) = 40
1446 10:28:03 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
1446 10:28:03 poll([{fd=3, events=POLLIN|POLLPRI}, {fd=21, events=POLLIN|POLLPRI}], 2, -1) = ? ERESTART_RESTARTBLOCK (Interrupted by signal)
1446 10:28:10 --- SIGALRM {si_signo=SIGALRM, si_code=SI_KERNEL} ---
1446 10:28:10 alarm(30) = 0
1446 10:28:10 rt_sigreturn({mask=[]}) = -1 EINTR (Interrupted system call)
1446 10:28:10 poll([{fd=3, events=POLLIN|POLLPRI}, {fd=21, events=POLLIN|POLLPRI}], 2, -1) = ? ERESTART_RESTARTBLOCK (Interrupted by signal)
1446 10:28:40 --- SIGALRM {si_signo=SIGALRM, si_code=SI_KERNEL} ---
1446 10:28:40 alarm(30) = 0
1446 10:28:40 rt_sigreturn({mask=[]}) = -1 EINTR (Interrupted system call)
what have i missed???
i just cannot get it to output to a remote host.... from my testing i am confident that it is a configuration issue in /etc/syslogd.conf but i cannot see what!
I'm moving a Solaris box from syslogd to syslog-ng, because the Solaris version of syslogd obliterates the original source hostname on the logs. I'm looking through the syslogng.conf documentation, but am not sure I understand it all fully. We have a relatively simple syslog.conf, I was hoping a syslog-ng expert out there could tell me how to 'convert' it to a workable syslogng.conf?
#ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */
#
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
#
# syslog configuration file.
#
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words. Also, within ifdef's, arguments
# containing commas must be quoted.
#
*.err;kern.notice;auth.notice /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages
#*.alert;kern.err;daemon.err operator
#*.alert root
*.emerg *
local7.debug /var/log/ncolog
audit.debug /var/log/ncolog
local7.debug @nimitz
audit.debug @nimitz
# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)
mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)
#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err /dev/sysmsg
user.err /var/adm/messages
#user.alert `root, operator'
user.emerg *
)
I'd like to redirect all messages from dhcpd to their own log file, rather than having them appear in /var/log/messages.
Here is the configuration on /etc/syslog.conf:
!dhcpd
*.* /var/log/dhcpd.log
The messages are redirected to dhcpd.log, but they're also going to /var/log/messages.
What's the configuration to exclude them from /var/log/messages?
Centos 5.x
I'd like to have my syslog traffic use TCP instead of UDP.
Does the stock syslog daemon for CentOS support this? If so, where would I set that option?
-M