rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

3
votes
0answers
22 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
0
votes
0answers
11 views

How to select only specific log from records with imfile module?

We have a Logstash agent that writes its internal logs to a file in fixed format (a message written in a single row, here it's formatetd for readability): { :timestamp => ...
0
votes
0answers
5 views

Rsyslog 8.12 doesn't like my TLS config

Rsyslog 8.11 -> 8.12 update stopped logging, but only when using TLS. I send to one destination without TLS (destination A) and to another with TLS (destination B). Destination A kept on working ...
0
votes
0answers
15 views

Changing ownership of a file rsyslog is writing to

I have rsyslog writing rails logs to rails.log, but it will only do so if ownership is syslog:adm. Ideally, it would be owned by www-data, but I'm having trouble getting it to work the way I'd like. ...
0
votes
1answer
44 views

Use syslog service to capture data logged to a file not managed by syslog?

Some services (nginx, buildbot, et cetera) only support logging to a file. Is there a way to reliably capture these log messages using syslog and friends, so that the log message can be reflected in ...
1
vote
0answers
20 views

Rotation and continuous writing of large log files with rsyslogd

I have an extremely busy log file (let's call it /var/log/service.log) that is also frequently searched for troubleshooting reasons. Output to it is nearly continuous and 24/7. It probably puts out ...
-1
votes
0answers
14 views

Stop crontab from filling syslog Ubuntu 15.04 [duplicate]

How can I prevent (certain cronjobs) from filling my syslog in Ubuntu 15.04? I have some jobs that run 4 times a minute and quickly fill up my syslog files. I've tried adding: cron.* ...
1
vote
2answers
77 views

Stop crontab from filling syslog Ubuntu 15.04

How can I prevent (certain cronjobs) from filling my syslog in Ubuntu 15.04? I have some jobs that run 4 times a minute and quickly fill up my syslog files. I've tried adding: cron.* ...
0
votes
0answers
7 views

Filtering on syslog-ng from rsyslogd syslogtag

I have CentOS servers that are configured to send certain log files to a central log host, with each log being tagged vi the inputfiletag parameter. The client/sender configuration looks like this... ...
0
votes
1answer
27 views

Rsyslog failed to start CentOS 6.6 Final

I'm getting the following error message when trying to run: service rsyslog restart # service rsyslog restart : command not foundlog: line 2: : command not foundlog: line 3: : command not ...
0
votes
0answers
28 views

Run a script if an error in syslog appears

Is it possible to run a shell script if a specified string is found in rsyslog 5.8.11? I couldn't find any examples so I tried this but it doesn't work: $Template MyAlert,":msg" :msg, contains, ...
0
votes
2answers
44 views

Send all linux logs to remote rsyslog and store in original file name

I know there are alot of topics like this one but i have a particular need: I need to send all the logs from linux servers to a central loggin server. Problem 1: On the central server i need to store ...
0
votes
1answer
31 views

Restarting rsyslog for zimbra servers

I want to forward my zimbra.log to my log collector server. But Im quite worried about restarting rsyslog process because im not sure if it will affect the zimbra mta itself. Thanks,
0
votes
1answer
38 views

Syslog logging to syslog.1 not syslog

My syslog file is getting a bit unmanageable. I believed I had configured this previously to rotate daily but obviously something has gone amiss. At the moment, my /var/log looks like this: ...
0
votes
0answers
28 views

Sending RFC5452 messages to /dev/log

I would like to be able to send a RFC5452-format message to rsyslog using the /dev/log socket. I've tried a number of variations on the following: echo "<29>1 2003-10-11T22:14:15Z ...
2
votes
1answer
40 views

Amazon Linux rsyslog config override

I am using Amazon Linux AMI release 2015.03, I am trying to configure rsyslog to redirect logs to a remote logging server (in this case, logstash) by dropping a conf file in /etc/rsyslog.d. The ...
2
votes
1answer
127 views

Forwarding structured data with rsyslog

We have a Java application logging structured data (MDC with log4j) via syslog to rsyslog (7.6.3) on localhost. localhost should then forward these log messages to a central logging host (also running ...
0
votes
0answers
34 views

rsyslog syntax error on non existent line

I get a syntax error message for my rsyslog configuration file at line 61. But my configuration only got 60 lines. I checked the last line in my configuration and it seems correct since it is the ...
0
votes
2answers
73 views

rsyslog (local) and remote logging

I have several linux servers that I want to monitor the log files. I thought it would be great to setup a central log server that can capture incoming rsyslog packets. Each hostname would have its own ...
1
vote
0answers
18 views

rsyslog Email On SSH/SFTP Login Fails

I have tried the following on my Nginx server, but do not get any emails upon SSH (or SFTP) login. I put this code in /etc/rsyslog.d/notify.conf and have ensured this file is being called by ...
0
votes
0answers
25 views

logger not logging to remote rsyslogd instance

I am running CentOS 7.0.1406 with rsyslogd 7.4.7 and logger from util-linux 2.23.2. I have two machines connected via a switch. When I try to use logger to log from one machine to the other, nothing ...
0
votes
1answer
44 views

Redirecting syslog facility to other facility

I have a syslog server, which separates logging informations according to hostnames. It can separate messages if it's in the 'local1' facility. I have a mail server, which sends messages to the ...
1
vote
1answer
139 views

Apache errorlog piping fail

Trying to log to a central syslog server, either direct using Apache's ErrorLog to pipe to logger, or getting syslog to forward, but nothing is working and the errors are not making sense to me. I can ...
1
vote
1answer
140 views

Example syslog-ng configuration to replicate rsyslog filename & locations?

ng 3.6.3 from source compilation on CentOS 6.6 64bit to play with and was wondering if anyone has pointers or example syslog-ng.conf that would as close as possible replicate the default rsyslog ...
0
votes
0answers
33 views

rsyslog tcp packets containing multiple log messages

I have rsyslog receiving logs over udp and then relaying them over tcp to a load balance (nginx) which passes them along to SIEM collectors. The setup looks like this: network devices/appliances ...
0
votes
1answer
23 views

All system logs lack end of message newlines

We have a curious issue where all logs in /var/log/ lack a trailing new-lines at the end of their messages, and instead contain an n, but the entire file is one 'line': Jun 4 10:18:54 host ...
0
votes
0answers
12 views

Exclude HAproxy check from postfix log [duplicate]

I use HA Proxy to loadbalanced SMTP connection. Does it possible to exclude HAproxy check from postfix log ? This is a example of my mail.log : Jun 3 09:30:24 mail2 postfix/smtpd[6277]: connect ...
0
votes
0answers
15 views

rsync copy > server unreacheable

I'm using rsync to copy around 500GB of data (Nexus repositories). The idea is to run it every hour to backup the "delta" and in case of issues we can easily switch the disks. Now, for two days in a ...
0
votes
1answer
43 views

Client rsyslog and server in the same machine Ubuntu 14.04

I am wondering if I can make Rsyslog to receive logs from my own IP, I just want to test that the configurations work, right now I dont have access to another PC or Server, just my PC, in few words I ...
1
vote
1answer
72 views

What rsync options to use for the below mentioned scenario?

Greetings !!! This is regarding a specific requirement about rsync that we are trying to achieve. We have tried to achieve this by using various rsync options. However, we are encountering different ...
0
votes
0answers
68 views

Remote logging with rsyslog - Cannot load module lmnsd_gtls.so

I have 2 servers and an office NAS on which I want the two servers to dump their logs. Only 1 server is successfully logging to the NAS. The other server continues to produce this error message in ...
1
vote
3answers
2k views

What is the difference between syslog, rsyslog and syslog-ng?

I am a bit confused in syslog, rsyslog and syslog-ng. From where can I get the source code for syslog()? Is there any difference between rsyslog and rsyslogd?
0
votes
0answers
49 views

rsyslog not discarding despite rule to the contrary

I am running rsyslogd on a new CentOS 6.6 box. I have put in a custom rule to log my firewall messages (via firehol) to a separate file, as per instructions here: ...
1
vote
0answers
33 views

Unable to get structured data in logged messages even after adding mmpstrucdata and mmrfc5424addhmac?(RFC5424)

I am trying to log messages with structured data . But it is showing null value for structured data. I am working with rsyslog 8.9.0.Can someone tell me either i need to load some module or modify ...
0
votes
1answer
158 views

kernel.log stays empty: “rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.”

I'm on a VPS (Ubuntu 14.04.2 LTS, Kernel 3.13.0-042stab094.8, rsyslog 7.4.4-1ubuntu2.5) and kernel.log stays empty with only this line: rsyslogd: imklog: cannot open kernel log (/proc/kmsg): ...
0
votes
0answers
36 views

SFTP and rsyslog: log activities of specified users only?

After a lot of anguish, I finally managed to get chrooted SFTP logging working in Ubuntu 14.04. Relevant bits from /etc/ssh/sshd_config: Subsystem sftp internal-sftp Match Group sftp-only ...
0
votes
2answers
360 views

rsyslog with logrotate: reload rsyslog vs copytruncate

I'm working on Ubuntu 14 with the default rsyslog and logrotate utility. In the default rsyslog logrotate /etc/logrotate.d/rsyslog config I see the following: /var/log/syslog { rotate 7 ...
2
votes
1answer
133 views

rsyslog not writing log file after restart

First off, thanks for spending the time to have a look at this issue, its much appreciated. I've had the attached rsyslog.conf configuration running for sometime now until today when I had to restart ...
-1
votes
1answer
88 views

what is wrong with this rsyslog configuration?

I am trying to get rsyslog to log to the following custom log file /var/log/iptables.conf instead of syslog. Iptables has got logging enabled, here is an example log line outputted from iptables ...
1
vote
1answer
217 views

Squid cannot log to syslog

According to this documentation: http://www.squid-cache.org/Doc/config/access_log/ squid should be able to log to rsyslog with the following directives: access_log syslog:daemon.info squid cache_log ...
1
vote
0answers
105 views

How to figure out why some characters go missing in rsyslog -> logstash pipeline

I am trying to figure out why some messages received by logstash have some text missing from them. I am sending the logs from an Untangle NGFW (11.0 - licensed) to logstash so that I can keep ...
0
votes
0answers
35 views

Sftp Log for every Jailed User

I've a sshd_config file like the following: Match user foo ChrootDirectory /mnt/foo-jail/ ForceCommand internal-sftp AllowTCPForwarding no AuthorizedKeysFile ...
-4
votes
1answer
38 views

Is it possible to centralize files in a directory?

Is it possible to centralize files in a directory? Currently, I am only using a common verisions of rsyslog. I can set the imfile for single file but it doesn't seem to work for a directory of files. ...
0
votes
0answers
61 views

Why would kern.log stop logging after crash & reboot

Server: Ubuntu 12.04 I recently noticed that my servers kern.log had stopped logging. I've not separated iptables from the kern.log so it used to be very active, however recently it's been logging ...
1
vote
0answers
32 views

rsyslog regex global modifier

Many regex systems have the ability to set a global modifier to allow for multiple matches. Here's how it works in Javascript and Perl. /g Python is a little different Python doesn’t have a ...
1
vote
2answers
213 views

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
0
votes
1answer
115 views

rsyslogd not storing remote logging information

I have a rsyslogd on Ubuntu 14.0.1: $ModLoad imtcp $InputTCPServerRun 514 $template FILENAME,"/var/log/%fromhost%/syslog.log" *.* ?FILENAME If if run logger -p local0.crit -n 10.240.157.116 -u ...
0
votes
0answers
59 views

Rsyslog last line of old log retransmitted after log rotation

I have config setup on all my CentOS servers to forward all syslog messages to a Graylog server via rsyslog. In Graylog I have then configured streams to alert on the occurrence of certain message ...
1
vote
2answers
184 views

Unable to get Rsyslog structured data in syslog message

I am new to syslog module. I am trying to log messages with structured data by using this parameter in template. But it is showing null value for structured data. I am working with rsyslogd 5.8.11 ...
3
votes
1answer
93 views

How to configure Monit to alert me when anything appears in syslog

I want Monit to alert me if ANYTHING shows up in syslog - as anything in there would be abnormal. I've tried the following and I'm not receiving any alert emails when I manually add something to ...