4

I am using Amazon Linux AMI release 2015.03, I am trying to configure rsyslog to redirect logs to a remote logging server (in this case, logstash) by dropping a conf file in /etc/rsyslog.d.

The remote logging configuration seems to work fine, but the logs are still written to /var/log/messages as well. Which is a problem because they are filling up the disk.

My conf file looks like this:

# Log docker generated log messages to logstash
:syslogtag, startswith, "docker" @x.x.x.x:5000    
& ~

After some investigation with some other systems, I found that the rsyslog.conf file that exists by default in Amazon Linux is including this directive at the very end of the conf file:

$IncludeConfig /etc/rsyslog.d/*.conf

Other systems I have used have this directive higher up in the config file.. definitely before the default log configs. It appears to me that the defaults cannot be overridden because of this. Am I missing something?

1 Answer 1

2

It appears to me that the defaults cannot be overridden because of this. Am I missing something?

Don't think of it as overriding defaults, but you are otherwise correct. In your file, the & ~ is discarding the log message preventing further processing. If this occurs above the built-in processing for /var/log/messages, the log message will be dropped and thus excluded from that file. Since your $IncludeConfig is occurring after, so is your drop statement.

You have two options;

  1. Move the $IncludeConfig statement up.
  2. Fix log rotation so that your disk does not fill.

I would personally prefer the latter because I like to keep logs locally (for a reasonable period of time) as well as forward them to a remote server for aggregation/retention. Having log messages available in /var/log/messages will make troubleshooting more convenient as well as easier for anyone else using the system due to this being the expected location.

2
  • Do you think this could be considered a bug for the Amazon Linux distro? It just seems like putting that IncludeConfig last negates any drop-in config that might use & ~
    – habelson
    Jul 6, 2015 at 19:31
  • It was probably done intentionally to protect against someone breaking the standard logging statements while still allowing for additional configurations. The Amazon engineers may agree with the last point I was trying to make. Jul 6, 2015 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .