similar to: journalctl and log server

On 10/14/2015 01:56 PM, Jonathan Billings wrote: > lsof /dev/log Uhmm ... that is not what I expect: lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs Output information may be incomplete. COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root 27u unix 0xffff880250ea0f00 0t0 1436 /dev/log systemd-j 263 root 5u

On 10/13/2015 02:59 PM, Jonathan Billings wrote: > On Tue, Oct 13, 2015 at 02:39:24PM +0000, C. L. Martinez wrote: >> Nop, because binary logs (using journalctl) are disabled in this host >> ... But under /var/log/messages, there is no error ... > > How did you disable journald? > Changing Storage's option under /etc/systemd/journald.conf to none.

Once upon a time, Chris Murphy <lists at colorremedies.com> said: > On Tue, Apr 26, 2016, 2:09 PM Chris Adams <linux at cmadams.net> wrote: > > I have several recently-installed CentOS 7 servers that keep having > > systemd-journald corruption > > Determined with 'journalctl --verify' or another way? I get messages like this in dmesg: [4756650.489117]

Once upon a time, Chris Murphy <lists at colorremedies.com> said: > On Tue, Apr 26, 2016 at 3:01 PM, Chris Adams <linux at cmadams.net> wrote: > > Once upon a time, Chris Murphy <lists at colorremedies.com> said: > >> On Tue, Apr 26, 2016, 2:09 PM Chris Adams <linux at cmadams.net> wrote: > >> > I have several recently-installed CentOS 7

I have several recently-installed CentOS 7 servers that keep having systemd-journald corruption (which stops ALL logging, including syslog). Interestingly, they are all spam-scanning servers running amavisd-new (so could be some particular pattern is triggering it). Is there a "supported" way to just cut systemd-journald out of the picture and have log entries go straight to rsyslogd?

On 18.03.23 14:34, David Lang wrote: > modern syslog daemons (including rsyslog, which is default on just > about every linux system) allow you to filter efficiently on the > message contents, not just the severity, so you can opt to throw out > the messages you don't want. > > I advocate for a slightly different way of dealing with it, filter > these messages from

modern syslog daemons (including rsyslog, which is default on just about every linux system) allow you to filter efficiently on the message contents, not just the severity, so you can opt to throw out the messages you don't want. I advocate for a slightly different way of dealing with it, filter these messages from your main logstream, but put them into either a script directly, or a

On Tue, Oct 13, 2015 at 2:35 PM, Jonathan Billings <billings at negate.org> wrote: > On Tue, Oct 13, 2015 at 02:04:49PM +0000, C. L. Martinez wrote: >> And according to systemd, without problems: >> >> crond.service - Command Scheduler >> Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled) >> Active: active (running) since Tue 2015-10-13

On 10/14/2015 06:42 PM, Gordon Messmer wrote: > On 10/14/2015 07:09 AM, C.L. Martinez wrote: >> Uhmm ... that is not what I expect: >> >> lsof: WARNING: can't stat() fuse.gvfsd-fuse file system >> /run/user/1000/gvfs >> Output information may be incomplete. >> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME >> systemd

Hi, My rsyslog is not working as expected. I have some thing in rsyslog.d that do well, like this: # Log all iptables stuff separately :msg, contains, "iptables: " { action(type="omfile" file="/var/log/iptraf/info") } No problems with that. Bu what's in /etc/rsyslog.conf like: mail.* /var/log/mail/info don't do anything at all. Rsyslogd -N1 is OK,

So I have asterisk 1.8.23 and want to send my logs to rsyslog. I tell asterisk to use syslog in addition to messages: root at voip:~# tail -10 /etc/asterisk/logger.conf ;debug => debug console => notice,warning,error ;console => notice,warning,error,debug messages => notice,warning,error ;full => notice,warning,error,debug,verbose,dtmf,fax ;syslog keyword : This special keyword

One of my boxes has stopped logging some of the things it's supposed to.? I use rsyslog which used to send named and dhcpd entries to separate log files.? Both named and dhcpd are working. I have shut down the DHCPD server and run it in debug mode and the output is produced as expected. I have shut down rsyslog and run that in debug mode and it looks like everything is running, but

I asked a similar question about a year ago and didn't get any answers. So I thought I'd try again. What do people do to get their syslog messages on CentOS 7 into a remote ELK stack. I've tried lots of things involving rsyslog, filebeat, redis, logstash and so on in lots of different configurations but nothing really works. I can get rsyslog to talk directly to logstash (acting as

On 10/14/2015 07:09 AM, C.L. Martinez wrote: > Uhmm ... that is not what I expect: > > lsof: WARNING: can't stat() fuse.gvfsd-fuse file system > /run/user/1000/gvfs > Output information may be incomplete. > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME > systemd 1 root 27u unix 0xffff880250ea0f00 0t0 1436 /dev/log > systemd-j

Hi, I have problems with rsyslog on C7. In /etc/rsyslog.d/iptables.conf I have: # Log all iptables stuff separately :msg, contains, "iptables: " { action(type="omfile" file="/var/log/iptraf/info") stop } THis works fine. In /etc/rsyslog.d/mail.conf I have: # Log all the mail messages in one place. if ($syslogfacility-text == 'mail') then {

Am 09.07.2016 um 17:19 schrieb Rowland penny: > On 09/07/16 10:27, Marc Muehlfeld wrote: >> What is different afterwards when using with/without? Does it create a >> systemd service file? >> > Do not know about '--with-systemd', but there are no (horrible) systemd > components if you use '--without-systemd' there is nothing horrible in a systemd

On Tue, Apr 26, 2016, 2:09 PM Chris Adams <linux at cmadams.net> wrote: > I have several recently-installed CentOS 7 servers that keep having > systemd-journald corruption Determined with 'journalctl --verify' or another way? (which stops ALL logging, including syslog). > Interestingly, they are all spam-scanning servers running amavisd-new > (so could be some

Once upon a time, Chris Murphy <lists at colorremedies.com> said: > Also I wonder if merely restarting the journal daemon solves it: > > systemctl restart systemd-journald > > What should happen is it realizes its own logs are corrupt and ignores > them, and starts working on new copies. And journalctl should still > try to read the old ones but skips the corrupt

On Wed, Apr 27, 2016 at 7:05 AM, Chris Adams <linux at cmadams.net> wrote: > Once upon a time, Chris Murphy <lists at colorremedies.com> said: >> On Tue, Apr 26, 2016 at 3:01 PM, Chris Adams <linux at cmadams.net> wrote: >> > Once upon a time, Chris Murphy <lists at colorremedies.com> said: >> >> On Tue, Apr 26, 2016, 2:09 PM Chris Adams

This implements new guestfish only command called journal-view. There seems to be a minor issue when user wants to run it through pager (more) and wants cancel it. User will end up with stuck guestfish until journal-view transfers all journal items. Output is not yet configurable, it's the same format as virt-log has. Maros Zatko (1): fish: add journal-view command fish/Makefile.am