similar to: Bug#590684: [logcheck-database] rules for rsyslog

centos 6.4, setup to be syslog server. Doing remote syslog using tcp works fine, so now want to add relp. I installed the rsyslog-relp package and told rsyslog.conf to use it: # RELP Syslog Server: $ModLoad imrelp # provides RELP syslog reception $InputRELPServerRun 20514 when I restart rsyslog I am told it does not like my InputRELPServerRun line: Oct 28 13:43:54 scan rsyslogd: [origin

Package: xen-hypervisor-4.0-amd64 Version: 4.0.1-2 Severity: normal Tags: upstream When creating Xen DomU's, at some point xend invokes the oom-killer and the entire machine restarts: Sep 5 12:04:59 arbiter kernel: [259697.101212] __ratelimit: 136 callbacks suppressed Sep 5 12:04:59 arbiter kernel: [259697.101218] xend invoked oom-killer: gfp_mask=0x200da, order=0, oom_adj=0 Sep 5

Dear All I am using a centos server for cdr billing and mediation device on a remote network. I am experiencing problem that I am suspicious it comes from main supply power cut at the remote site. The power supply to the remote site comes from battery charger that will be automatically switched in circuit under main supply power cut but cannot provide adequate power for more than 2 hours . I am

On 10/29/2016 10:12 PM, Hadi Motamedi wrote: > I am using a centos server for cdr billing and mediation device on a remote > network. I am experiencing problem that I am suspicious it comes from main > supply power cut at the remote site. The power supply to the remote site > comes from battery charger that will be automatically switched in circuit > under main supply power cut but

Hi, Recently I have installed Debian Lenny on two different machines (different ram size, disks, Xeon dual and quad core, filesystems both xfs and ext3, etc). Packages versions: Dom0: ii libc6-xen 2.7-18lenny4 GNU C Library: Shared libraries [Xen version] ii libxenstore3.0 3.2.1-2 Xenstore communications

Package: logcheck-database Severity: wishlist Tags: patch Hi, some rules for ntpd as i couldn't find any: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: time reset [+-]*[0-9]{1,2}\.[0-9]{6} s$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronisation lost$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: no servers reachable$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+

Hi, My rsyslog is not working as expected. I have some thing in rsyslog.d that do well, like this: # Log all iptables stuff separately :msg, contains, "iptables: " { action(type="omfile" file="/var/log/iptraf/info") } No problems with that. Bu what's in /etc/rsyslog.conf like: mail.* /var/log/mail/info don't do anything at all. Rsyslogd -N1 is OK,

Thank you very much for your reply . So you mean under the /var/log/messages it is distinguishable that which logs come from operator initiated reboot and which ones come from sudden power cut and then booting from scratch when power resumed ? Am I correct ? On Sat, Oct 29, 2016 at 11:44 PM, John R Pierce <pierce at hogranch.com> wrote: > On 10/29/2016 10:12 PM, Hadi Motamedi wrote:

Package: logcheck-database Severity: wishlist Tags: patch Hi, check_radius output filter: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ check_radius: rc_avpair_gen: received VSA attribute with unknown Vendor-Id [[:digit:]]+$ Hendrik -- Hendrik Jaeger Linux Systemadministrator Init Seven AG Elias-Canetti-Strasse 7 CH-8050 Z?rich phone: +41 44 315 44 00 fax: +41 44 315 44 01 http://www.init7.net/

I have a server thats been running fine for a year or two lock up a few times recently, requiring power cycling. The /var/log/messages after a lockup last night is appended to this message. hardware is a pretty typical server, Supermicro X8DTE-F motherboard, dual Xeon X5650, 48GB ECC memory, LSI SAS 2008 for the boot disks, and LSI MegaRAID SAS 9261-8i for the data volume. Lots of 3TB

Hello Rowland, >> --- >> # Global parameters >> [global] >> >> username map = /etc/samba/user.map >> > > I am sure this has nothing to do with your problem, but you should > remove the 'username map' line, it has no place on a DC. > ok, did so. >> >> It really does not listen: >> >> root at dc2:~# netstat

Package: logcheck Version: 1.3.13 Severity: minor Tags: patch Hi, Logcheck reports messages of the form: Mar 15 06:25:26 foohost rsyslogd: [origin software="rsyslogd" swVersion="5.7.6" x-pid="3301" x-info="http://www.rsyslog.com"] rsyslogd was HUPed I suggest the following tweak to /etc/logcheck/ignore.d.server/rsyslog: diff -u

CentOS Linux release 7.2.1511 (Core) Hi, Last night our CentOS 7 server rebooted. Seemingly it's a very clean reboot. I can't find a shred of evidence as to why it happened though. Things I've checked: * sa reports * /var/log/{messages,secure,dmesg,cron} * /var/log/audit/audit.log * lastlog The host is used for KVM virtualisation and connects via multipathing to our OmniOS SAN via

Hello there, I installed a dc1 using debian jessie-packages strictly following the samba-manual "Setting up Samba as an Active Directory Domain Controller". I installed a dc2 using debian jessie-packages, also strictly following the manual for "Joining a Samba DC to an Existing Active Directory". It worked for a few weeks but then it quit working without having changed the

Hi, everyone I have some questions with the OCFS2 when using it as vm-store. With Ubuntu 1204, kernel version is 3.2.40, and ocfs2-tools version is 1.6.4. As the network configure change, there are some issues as the log below. Why is there the information of "Node 255 (he) is the Recovery Master for the dead node 255" in the syslog? Why the host ZHJD-VM6 is blocked until it reboot

Hi, everyone I have some questions with the OCFS2 when using it as vm-store. With Ubuntu 1204, kernel version is 3.2.40, and ocfs2-tools version is 1.6.4. As the network configure change, there are some issues as the log below. Why is there the information of "Node 255 (he) is the Recovery Master for the dead node 255" in the syslog? Why the host ZHJD-VM6 is blocked until it reboot

Hi all, Somebody knows how can I bind rsyslogd to a specific ip adress?? I have two different interfaces on a centos5.5 host and I need to bind rsyslog to only one. Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Hello, I recently upgraded a server from CentOS 6.2 to 6.3 I found a change in the behavior of rsyslog's configuration file that I found particularly interesting. The "$PreserveFQDN on" directive was not being recognized as the config remained unchanged during the upgrade. This incorrect behavior caused the host to syslog with only the host name and not it's fully qualified

Hi, I decided to test new Xen pv-ops Dom0 kernel. I have a 64 bit VT machine there in it Vmware work station installed Ubuntu 10.04 64 bit and then apt-get install libcurl4-openssl-dev xserver-xorg-dev mercurial gitk build-essential libncurses5-dev uuid-dev gawk gettext texinfo bcc libncurses5-dev dpkg-dev debhelper iasl texinfo bridge-utils bison flex apt-get build-dep xen-3.3 cd /usr/src

Attempting to lookup why rsyslogd is listening on the high port UDP/51427. Have not succeeded in what this port is used for and what directive controls what interface it binds to. [root at bedrock ~]# netstat --listen --inet --program --numeric | grep syslog udp??0??0 0.0.0.0:51427??0.0.0.0:*???66655/rsyslogd? -- Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383