rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

0
votes
1answer
19 views

I erased haproxy.log with old content but this file hasn't appeared again

I have a load balancer with HAProxy in Ubuntu 14.04. I did all configurations for turn on log and it works well. However, I erased haproxy.log file and that hasn't appeared again. Can someone help me? ...
0
votes
1answer
22 views

Redirecting log from /var/log/kern.log to a separate log file for iptables log

I am trying to redirect iptables log to another file. Based upon my reading on the net, I did the following: In my iptables rule, I have rules like: iptables -A INPUT -s ... -j LOG --log-prefix ...
1
vote
1answer
32 views

Forwarding specific logs rsyslog

TL;DR - send specific logs with rsyslog (to a redis server) : how to select the logs to be sent ? I want to forward to a redis server a set (and only that set) of logs, say for instance nginx logs in ...
0
votes
0answers
7 views

rsyslog capturing apacher logs in mongodb

I am trying to send my apache logs to mongodb via rsyslog My rsyslog.conf looks like this: module(load="imuxsock") module(load="imklog") module(load="imfile") module(load="ommongodb") ...
1
vote
0answers
24 views

Nginx log to syslog on TCP port

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do: error_log syslog:server=192.168.1.1; However I need to ...
0
votes
0answers
27 views

How can I pull data from journald and outputing it to logz via rsyslog

I have a number of servers that use CoreOS. CoreOS natively uses journald for all it's log files. The latest stable release incorporates docker 1.9 so it doesn't yet support docker log drivers. ...
0
votes
0answers
15 views

docker entered disabled state

Had my debian 7 (3.16.7) system suddenly stop responding. Its a rented unit in the cloud but not shared, I have the whole server. General troubleshooting is beyond a simple question here, but I'm ...
2
votes
0answers
15 views

How can I configure SELinux to let rsyslogd run my program?

I'm trying to use SELinux with a system which has rsyslogd call a binary: # rsyslog configuration file module(load="omprog") template( name="snmp_template" type="string" string="%msg%\007" ) ...
1
vote
1answer
29 views

How can I add values to structured data with rsyslog?

Our logs are sent from our applications to rsyslog running on the same host. Rsyslog then forwards the messages to Sumo Logic. We need to add some metadata to our log messages in the structured data ...
0
votes
0answers
15 views

Templates in Rsyslog 8.17

Recently I patched my system and the installed rsyslog version changed from 8.10 to 8.17. Somehow this update broke all my templates. My custom properties aren't recognized anymore (For example Mark, ...
3
votes
1answer
24 views

remote rsyslog client/server issue

I only want rsyslog to send the logs to the centralized rsyslog server but it is sending them locally as well. This is for legal reasons, the servers will not have a logs directory, only the ...
3
votes
0answers
35 views

When configuring rsyslog to log to mysql DB, what is purpose of SystemEventsProperties table?

I've configured rsyslog on my servers to log to a remote mysql DB. I did this essentially by following the rsyslog wiki and it essentially creates two tables: mysql> show tables; ...
1
vote
0answers
42 views

Postfix logs to remote log host

On my Ubuntu 14.04 server, I'm using Postfix as a front-end mailserver, and I would like to send all mail related info, including email addresses, to a remote host. In the file ...
2
votes
0answers
21 views

Upstart job logs not being forwarded by rsyslog - Ubuntu 14.04 LTS

I've got rsyslog set up correctly forwarding all logs on a set of clients to a central server. Things like ssh auth logs etc all work fine and appear in the remote server properly. The issue is that ...
1
vote
0answers
13 views

How to have upstart shutdown rsyslog as last job in Ubuntu 14.04

It seems like upstart decides to shutdown rsyslog on Ubuntu 14.04 as one of the first jobs if a machine shuts down. So most logging of shutting down jobs is lost. How to I instruct upstart to shutdown ...
0
votes
0answers
30 views

rsyslogd and systemd-journald ram usage

I have a small VPS server with CentOS on it and only 512 MB RAM. It's just for small web-server (nginx) with mariadb, email-server (postfix, dovecot) and BIND service on my own. Today I found that ...
0
votes
2answers
36 views

rsyslog TLS on AIX

I am trying to forward logs with rsyslog (8.4.2) on AIX 7.1 and I need to encrypt with TLS. However it seems I need rsyslog-gnutls package. I can't seem to find this package anywhere for AIX. Best I ...
1
vote
0answers
14 views

rsyslog parsing logs with liblognorm

I'm trying to use such .rb file to parse logs: version=2 ...
0
votes
0answers
12 views

rsyslog 8.17 char changing

My rsyslog configuration do not want to work properly Here is my example log: Mar 10 10:57:35 servername log_tag ...
0
votes
0answers
33 views

Read an environment variable (or environment file) from an rsyslog config?

I'm building AMIs here for my organization which include default configuration to send all of our logs to Loggly from rsyslogd. It works pretty well, but I'd like to be able to customize the ...
0
votes
0answers
44 views

rsyslog stops working on CentOS 7

I have a CentOS 7.2 configuration in which rsyslog is pulling from journald. We have a few application-specific logs, and at times they just stop getting any data from rsyslog. The only way to get ...
-1
votes
1answer
34 views

rsyslog limit log size

Is this even possible to do in rsyslog? http://www.rsyslog.com/doc/rsyslog_conf_output.html This syntax is not working: mail.* -/var/log/mail.log:300M I need to set this limitation ...
0
votes
0answers
24 views

How to configure rsyslog to forward all log files from specific directory?

I have already configured and working setup of centralized log server with web interface. But i need to forward all log files from specific directory in remote host "/Volumes/path/to/dir" to my ...
4
votes
1answer
67 views

Logstash with journald instead of rsyslog

I'm used to sending my logs from a server to a remote Logstash using rsyslog, with a configuration file roughly as follows (usually more specific to prevent too many logs from being sent): *.* ...
0
votes
1answer
43 views

rsyslog server listen only on tcp 514

I'm trying to set rsyslog client- server to listen to tcp messages with port other then 514, however it doesn't work. Only when using 514 it receives messages. I'm using EC2 vms. input(type="imtcp" ...
0
votes
0answers
14 views

Forward psacct logs to rsyslog

I want to monitor users activity and aggregate logs using rsyslog. Is there any way how to do it natively? If I understand how does psacct work, it monitors whole users activity and saves logs in own ...
0
votes
1answer
10 views

only send rsyslog's $msg to file?

I'm using a rsyslog rule to send syslog output from one program elsewhere: :programname, isequal, "myprogram" /var/log/myprogram.log I don't want the rsyslog "header" information (date, hostname, ...
0
votes
1answer
209 views

rsyslog upgrade fails: Sub-process /usr/bin/dpkg returned an error code (1)

I'm having trouble upgrading rsyslog on a Debian server. root@trip:/home# apt-get upgrade Reading package lists... Done Building dependency tree Reading state information... Done Calculating ...
0
votes
0answers
20 views

rsyslog not filtering message field

Trying to remove ALL cron log stuff from auth/syslog but I cannot get it. Here is a snippet of my rsyslog. Not sure how to get this to format right, it keeps wanting to mess with my paste. But here ...
0
votes
0answers
30 views

rsyslog working differently when started as service

I have configured rsyslog to read from a file /root/test.log and forward what it reads on TCP If I start rsyslog directly: [root@servername ~]# rsyslogd it works as I expect (yay). However it does ...
0
votes
0answers
17 views

Use rsyslog to forward but not write to local log

I'm using rsyslog on RHEL6 (ie rsyslog 5.8.10) and forwarding to a central syslog server is already set up. Now I'm wanting to track an extra file that will be forwarded to the syslog server. I used: ...
0
votes
1answer
57 views

graylog not getting cents 7.1 syslog messages using the rsyslogd service

Good morning! I'm playing with Graylog today and everything is working well on Ubuntu, but the two CentOS 7.1 servers I've attempted to attach to it are acting strange. I've been keeping notes as ...
0
votes
1answer
42 views

Is it possible for rsyslog to create a directory?

The Setup I have this in my /etc/rsyslog.conf: $template local1DynFile,"/path/to/my/log/%programname%.log.%NOW% $template local1LogFormat,"%msg:2:$:%\n" *,*;auth,authpriv,local0,local1.none ...
2
votes
1answer
56 views

Why isn't my SELinux logging anything?

I have a sneaking suspicion it has something to do with me mucking about with my rsyslog.conf, but I'm not 100% sure about that. I am running Centos 7, and SELinux has been working A-OK. However, I ...
0
votes
1answer
55 views

Change message content in a syslog server

I am looking to log some troubleshooting info from a DataPower Appliance into a syslog. Although it is already logging, I have a third party solution that requires some modification to the messages, ...
2
votes
0answers
123 views

How does one separate log data sent to a remote rsyslog server?

I have messages from multiple apache2 web servers logging to a rsyslog server. I've used a template to separate each /var/log/syslog file into its own folder based off of the ip address of the server ...
-3
votes
1answer
60 views

How can I send non-default log files to remote rsyslog server? [duplicate]

Yes, I see that you want to mark this as a duplicate, and I appreciate that, but please read to the end. I've found this question several places, and the answers are either too vague for a noob to ...
1
vote
2answers
475 views

Logging not working on Centos 7

Long story short - somehow I managed to screw up rsyslogd service on Centos 7 server. Now only thing that appears in /var/log/messages is: Dec 14 22:13:27 {myhostname} rsyslogd: [origin ...
0
votes
0answers
10 views

rsyslog: Template for hosts sending from 172.16.0.0/12

What is the shortest template to capture all hosts sending from an IP address within the 172.16.0.0/12 network? I would like to avoid multiple :fromhost-ip statements. Basically, I'm trying to create ...
3
votes
1answer
46 views

Alternative way to disable cron writing to /var/log/syslog

There are answers that suggest changing this: *.*;auth,authpriv.none -/var/log/syslog #cron.* -/var/log/cron.log Into this: *.*;cron,auth,authpriv.none ...
0
votes
1answer
109 views

How can I make rsyslog send the logfiles to a location outside of /var/log?

I have a central syslog server (ubuntu 14.04 server), that I've set up to take in logs from many servers. This server has a storage hard drive that is very large, mounted at /home/username/logs I'd ...
0
votes
1answer
27 views

rsyslog not starting up: not found

When starting rsyslog I get the following: /etc/init.d/rsyslog: 1: /etc/default/rsyslog: imudp: not found /etc/init.d/rsyslog: 2: /etc/default/rsyslog: 127.0.0.1: not found /etc/init.d/rsyslog: 3: ...
0
votes
0answers
23 views

RSYSLOG v3 vs v5 config for property base filtering

I'm trying to set up a property base filtering for audispd log, this is what I have currently SLES11 RSYSLOG v5 RHEL6 RSYSLOG v5 RHEL5 RSYSLOG v3 rsyslogd: [origin software="rsyslogd" ...
0
votes
1answer
85 views

rsyslogd template stopped working

Really perplexed at what happened. I've had rsyslogd running on a Centos 6.5 server for a while now logging for remote hosts to a special folder /data/rsyslog. Yesterday I setup our firewall to start ...
2
votes
2answers
209 views

rsyslog does not discard messages

I have the following rsyslog.conf: $PreserveFQDN on # rsyslog v5 configuration file # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html # If you experience problems, see ...
0
votes
1answer
54 views

Logging in separates files in rsyslog

I am configuring rsyslog in order it logs in separate files, identified by the port through which the log event arrives. In order to avoid opening too much ports, I was trying to see if there is any ...
0
votes
1answer
48 views

Send all logs of a system to one specific syslog local facility (local1-7) [closed]

I want to assign the syslog local facilities to specific OS, so I can sort the incoming logs on the logserver (e.g. local1 for Windows logs, local2 for RedHat logs, etc). It worked perfectly on ...
1
vote
1answer
95 views

rsyslog cannot send logs to logstash

Here is my rsyslog.conf (nothing in /etc/rsyslog.d/ folder): #### MODULES #### $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imklog # provides ...
0
votes
0answers
37 views

Is it possible to make samba (smbd,nmbd,winbindd) stop write log to disk and write it only to syslog(rsyslog)?

I have samba instance, and I don't need samba write log to disk, but I want write it to rsyslog. And not full_audit, just general log, how to do it? Options syslog only and syslog from ...
0
votes
0answers
17 views

rsyslog on both a tcp cleartext port and tcp ssl port

I would need to have rsyslog to listen to two TCP ports, one encrypted and one in cleartext. How to do that? The following is not working: $InputTCPServerBindRuleset remote ...