search for: loghost

...like to submit, one example is sqlgrey. /usr/share/doc/logcheck/README.maintainer talks about shipping the rules inside the package itself, so I could file a request with sqlgrey. However, that doesn't work because of course I don't have all the packages I use on my network installed on my loghost. In fact, I believe that usually the default is that the loghost doesn't do (many) other tasks than logging and logcheck, so those per-package shipped files do never end up on the loghost. How are these files supposed to end up on the loghost? Or would it be better if all ignore.d files would...

.../var/log/console.log # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work *.* /var/log/all.log # uncomment this to enable logging to a remote loghost named loghost #*.* @loghost The file /var/log/caioa.log exists and is 600. I got the syntax off a web page, but it is not working for me and I don't see anything in the man page that expalins how to do it. Any help would really be appreciated. Thanks. --...

...0); } /* END OF SCRIPT */ This should print out the array of (upto 4) pointers to h_aliases and then dereference each one. However if it fails to derefrence them is stops the target program and exits. : va64-v40zh-gmp03.eu TS 14 $; getent hosts va64-v40zh-gmp03 129.156.213.204 va64-v40zh-gmp03 loghost spamhost : va64-v40zh-gmp03.eu TS 15 $; pfexec /usr/sbin/dtrace -32 -wZCs gethostbynam> dtrace: script ''gethostbyname.d'' matched 0 probes dtrace: allowing destructive actions CPU ID FUNCTION:NAME 0 55085 gethostbyname_r:return 4489 Host: va64...

...al The included filters for cyrus (/etc/logcheck/ignore.d.server/cyrus) are very minimal. The cyrus-imapd-2.2 has a more extensive ruleset (there's a /etc/logcheck/ignore.d.server/cyrus2_2 file in that package). Please copy over the filters from cyrus-imapd-2.2. I'm running logcheck on a loghost, which doesn't run cyrus itself. There might be a better alternative to copying the file, but anyhow it should be in logcheck-database. Thanks, Alex -- System Information: Debian Release: 4.0 APT prefers stable APT policy: (500, 'stable') Architecture: i386 (i686) Shell: /bin/...

Hi Friends, I am running most of my company's Linux Servers on Centos 4.x/5.x 32 and 64-bit. I am now trying to configure a centralized logging server where logs of all the linux servers will be stored and also I want to store all the logs on the local server aka means logs will be sent to the central log server but also will be stored on the local server. The reason for storing the logs

I was looking at the manpage for rsyslog.conf, primarily because I need to filter my manager's new fedora 22 logs coming to our loghost, because of the bug that I forwarded (if it gets through). At any rate, I am surprised: under selectors, I see that " The keywords error, warn and panic are deprecated and should not be used anymore." Huh? If I only want warn or more severe, how am I supposed to filter - write a muc...

On Thu, Jul 23, 2015 at 01:19:44PM -0400, m.roth at 5-cent.us wrote: > I really am going crazy, trying to deal with the hourly logs from the > loghost. We've got 170+ servers and workstations... but a *very* large > percentage of what's showing up is from his bloody new fedora 22, with its > idiot systemd logging of *ever* selinux message to /var/log/messages. systemctl enable auditd systemctl start auditd Now your SELinux (and ot...

...ent -L //paulxp added interface ip=161.217.10.13 bcast=161.217.10.255 nmask=255.255.255.0 session request to PAULXP failed (Called name not present) session request to *SMBSERVER failed (Called name not present) pahto% cat /etc/hosts # # Internet host table # 127.0.0.1 localhost 161.217.10.13 pahto loghost pahto.yakama.com 161.217.7.3 dnr 161.217.10.3 hp 161.217.7.4 wildlife 161.217.10.4 dj1120 161.217.9.10 biafor 161.217.7.2 forestry 161.217.7.4 yakama 161.217.10.26 larry 161.217.10.19 loowit 161.217.10.22 tahoma 161.217.20.17 paul 161.217.20.18 paulxp 161.217.13.103 lindtop 161.217.20.07 lindnelso...

Has anyone been seeing IO lockup problems on EL4? I've tried multiple IO scheduler options (elevator=) in the boot... I'm seeing the same behavior regardless. Independent of hardware. Whitebox ATA, HA enclosure with dedicated SCSI, megaraid RAID hardware, Dell 2850s... same behavior: A semi-busy system will suddenly go into some kind of IO la-la land where nothing can be written

On Thu, July 23, 2015 13:19, m.roth at 5-cent.us wrote: > Physically dragging the thread back on topic... > > I really am going crazy, trying to deal with the hourly logs from the > loghost. We've got 170+ servers and workstations... but a *very* large > percentage of what's showing up is from his bloody new fedora 22, with > its idiot systemd logging of *ever* selinux message to > /var/log/messages. > > I tried creating a rule, /etc/rsyslog.d/audit.conf, that r...

...t be because I'd gracefully shut down the original server, and it mounted ok on the other server? Mounting it on /mnt, I found no driver errors being reported in the logs, nor anything happening, including logons, before an automated contact from another server, which failed. AND I checked our loghost, and nothing odd shows there, neither in message nor in secure. At this point, I *think* it's filesystem corruption, rather than a compromised system, but I'd really like to hear anyone's thoughts on this. mark

Windsor Dave (AdP/TEF7) wrote: >> Behalf Of Leon Fauster >>Am 22.07.2015 um 17:41 schrieb Windsor Dave (AdP/TEF7) >> <Dave.Windsor at us.bosch.com>: >>> Sorry for the top post, Outlook defaults strike again..... >> >>Outlook forces you to write above ? :-) > > Perhaps I should say instead that it "strongly encourages" top posting, >

Hello all I have set up a Debian etch server with a samba and ldap integration. domain master = yes domain logons = yes os level = 33 preferred master = yes local master = yes passdb backend = ldapsam:ldap://localhost/ ldap admin dn = cn=admin,dc=test,dc=net ldap suffix =dc=test,dc=net ldap user suffix = ou=users ldap machine suffix = ou=machines ldap group

...uld mean that we end up scanning a large file on both servers every 10 minutes. I've played around on paper and come up with a reversed version of the rolling checksum (i.e. given a_k, b_k calculate a_k-1 and b_k-1). The idea is that I calculate the checksum of the final block of the log on the loghost and pass that to the remote host. A program there starts reading backwards through the logfile, until it finds a checksum match. It then feeds back everything in the file after that point. If rotation has happened on the remote host, the client could start reading backwards through the rotated log...

...ne replicate this issue? Here's the smb.conf: [global] ??????? security??????????????? = ads ??????? workgroup?????????????? = IB ??????? realm??????????????? ???= INVESTEC.CORP ??????? smb encrypt???????????? = yes ??????? announce version??????? = 6.1 ??????? server string?????????? = "Loghost Server" ??????? netbios name??????????? = invmappllog3 ??????? netbios aliases???????? = invjhbpllog ??????? interfaces????????????? = 10.0.42.102/24 ??????? allow trusted domains?? = yes ??????? log file??????????????? = /var/log/samba/%I.log ??????? log level?????????????? = 10 ??????? syslo...

Hi all, I am installing a zone onto two different V445s running S10U4 and the zones are taking hours to install (about 1000 packages), that is, the problem is identical on both systems. A bit of trussing and dtracing has shown that the pkginstalls being run by the zoneadm install are making door_call calls to nscd that are taking very long, so far observed to be 5 to 40 seconds, but always in

.../var/log/console.log # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work #*.* /var/log/all.log # uncomment this to enable logging to a remote loghost named loghost #*.* @loghost # uncomment these if you're running inn # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice...

Hi, I have installed b_78 on a Dell 2950 and booting to bare metal works fine but when I try to boot using the grub entry Solaris xVM it will boot to the point where it displays the uname info and then just stays there. It will not boot past that point. I have enabled VT technology in the BIOS (but only after the installation). Where/what can I look at to trouble shoot this? I am new to xen and

Hello, We have a S10U5 server sharing with zfs sharing up NFS shares. While using the nfs mount for a log destination for syslog for 20 or so busy mail servers we have noticed that the throughput becomes severly degraded shortly. I have tried disabling the zil, turning off cache flushing and I have not seen any changes in performance. The servers are only pushing about 1MB/s of constant

...at centos.org [mailto:centos-bounces at centos.org] On Behalf Of m.roth at 5-cent.us Sent: Wednesday, July 22, 2015 11:07 AM To: CentOS Subject: [CentOS] rsyslog.conf I was looking at the manpage for rsyslog.conf, primarily because I need to filter my manager's new fedora 22 logs coming to our loghost, because of the bug that I forwarded (if it gets through). At any rate, I am surprised: under selectors, I see that " The keywords error, warn and panic are deprecated and should not be used anymore." Huh? If I only want warn or more severe, how am I supposed to filter - write a muc...