rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

-1
votes
1answer
14 views

prevent rsyslog writing in my custom log file [on hold]

I'm trying to send a custom log from a client to a syslog server. The problem is that: Rsyslog keep writing the same information in my log file. How can I prevent rsyslog to write in my custom log ...
0
votes
0answers
15 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...
-2
votes
0answers
32 views

Not receiving logs from rsyslog client to rsyslog server in rhel6 host

I've referred below clearly on my setup, but no luck in receiving syslog message on server. How to use rsyslog to log files from client to server Rsyslog not logging from remote server I've disabled ...
3
votes
0answers
47 views

Random SSH entries in Auth.log out of date order

Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue. Some ...
1
vote
1answer
115 views

Snort not sending alert log file to syslog server?

I am set up with three virtual machines running Ubuntu - a Server, Client, and Gateway. I am tasked with setting up Snort on the Gateway to monitor "attacks" from the Client to the Server. Snort is ...
1
vote
2answers
40 views

Syslog does not record logs received over TCP to a file

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over ...
0
votes
0answers
20 views

CentOS - php-fpm update - rsyslog issue

Strangest thing. After updating php from 5.4.24 to 5.4.33, I noticed that php errors are no longer going to /var/log/php/all.log, instead they are back in /var/log/messages. I checked my rsyslog ...
2
votes
2answers
36 views

rsyslog configuration syntax

I need to take several actions for some log messages. For example I want to log them to different files according to severity. Everything is ok if I use this: if $programname == 'myprog' ...
0
votes
1answer
46 views

Need to upgrade only rsyslog on Debian system

Just received a notice from apticron: apticron has detected that some packages need upgrading on: The following packages are currently pending an upgrade: rsyslog 5.8.11-3+deb7u1 ... Package ...
1
vote
0answers
26 views

Is it possible to filter rsyslog messages based on an environment variable, the content of a file or the output of a command?

I am configuring setup scripts for automatically created VMs which need to filter syslog messages in rsyslogd based on an environment variable. I need to be able to change where logs get sent based ...
0
votes
0answers
28 views

php-fpm: Maintain php_mod logging format

I recently switched all my lab servers from apache pre_fork/mod_php to apache worker/fcgi/php-fpm, and after getting everything set-up correctly, I noticed one last issue; php-fpm is adding it's own ...
0
votes
1answer
85 views

RSyslog sends logs to logstash with host as IP not FQDN

I am having a issue. I am trying to send apache/nginx logs to logstash server. The problem is that rsyslog sends host as IP not the servers FQDN. Solutions that I have tried: PreserveFQDN on (did ...
0
votes
0answers
16 views

Input filtering in rsyslog 5?

I have some messages hitting my rsyslogd server which a network trace shows as: <5>1 2014-09-04T14:58:31Z HOSTNAME This=a message=that contains=some specially=formatted data= This is ...
0
votes
0answers
55 views

Rsyslog queues and performance impacts

Having recently had a network failure that caused a major cascading series of other issues, I've been diving into our rsyslog.conf to try identify opportunities for more stable deployment. We have ...
3
votes
1answer
135 views

How do I configure rsyslog to deal with MySQL Slow Query Log multi-line messages?

Using rsyslog v8.2.2, I would like to group multi-line messages, such as those output by the MySQL Slow Query log. Each new message begins with three consecutive lines having '#' as the first char of ...
1
vote
1answer
23 views

TCP rsyslogd events showing up as 2000 character continuations

I'm taking syslog events from a proprietary app. This could be the app's fault or it could be rsyslogd. Events are written like: Aug 15 16:00:00 10.11.12.13 Event1 from this wonderful product using ...
2
votes
2answers
50 views

Using (r)syslog's dynamic file generation

I am in the middle of configuring a (r)syslog server as a remote server that receives logs from various clients. I wonder whether there is a nicer way to dynamically generate multiple file names as ...
1
vote
1answer
149 views

Forward linux logs to fluentd on linux

On one VM I have this in /etc/rsyslog.d/50-default.conf *.* @192.168.29.1:42185 # Default rules for rsyslog. On the vm with fluentd I have this: I have this in /etc/td-agent/td-agent.conf ...
0
votes
0answers
20 views

One rsyslog machine accepting encrypted and non encrypted logs on different ports

I'm trying to setup an rsyslog server to accept input from 2 different ports, one encrypted for our non internal servers, and one open for our internal servers. The reason for needing this is that ...
0
votes
0answers
42 views

Group Ownership in rsyslog?

What I would like would be to have all remote local7 facilities logged to: /var/log/cisco.log but the ownership needs to be under the group "cisco" in /etc/rsyslog.conf I have: # Logs for cisco ...
2
votes
1answer
47 views

IPTables custom log failing

I'm currently trying to split out some of my IPTables logging from kern.log into a file called iptables.log. Basically, I have several different adapters and I'm logging requests to port 80 on each ...
3
votes
1answer
243 views

Difference between /dev/udp and netcat

I have a syslog server listening on localhost:514 as UDP and would like to write messages to it on that port. (Using Ubuntu 14.04) If I run either of these commands this from bash it prints the date ...
2
votes
1answer
87 views

Remote logging to specific directory structure with rsyslog

I'm currently in the process of having all of our various servers send their syslog messages to a central server. I'd like to have the following directory structure on the central server that logs ...
0
votes
0answers
58 views

rsyslog not writing remote host messages to specific file

I have the following in my rsyslog.conf file on my ubuntu 14.04 logging server: if $fromhost-ip = '192.168.10.37' then /var/log/netgear/switch.log I have changed the owner to be syslog adm 0 ...
0
votes
1answer
155 views

Configuring MariaDB to log to mysql.log using rsyslog

I'm a little stumped - there is something obvious I'm missing here. Recently I made the switch from mySQL to mariaDB. Everything is working so far - except for the logging, as I realized today. All ...
0
votes
0answers
130 views

Proper rsyslog configuration

I'm trying to setup a syslog server but it doesn't appear to be working as intended. My client does not seem to be logging to it. Server Ubuntu 12.04 (192.168.1.10) Client Ubuntu 14.04 ...
2
votes
0answers
352 views

Rsyslog: discarding specific messages, rate limiting

I've got netatalk installed on the server and afpd is spamming system logs with the following error: Jun 24 15:38:16 TEST afpd[21532]: sys_getextattr_size: error: Operation not supported I'm not ...
0
votes
0answers
201 views

Setup CENTOS Centralized AUDIT and RSYSLOG server

Attempting to use these links: Sending audit logs to SYSLOG server or http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log I have been unable to get centralized AUDIT logging to work on my ...
1
vote
0answers
94 views

Receiving Apache access and error logs via rsyslog and possible catchall filter

I'm new to rsyslog and have been trying to figure out why I am not receiving any of my Apache and mysql logs which are configured on the client-side to sent via rsyslog. I am currently receiving all ...
2
votes
1answer
763 views

Sending logs to remote server with rsyslog

I'm trying to setup centralized logging with Logstash, Elasticsearch and Kibana and am having trouble getting logs to my log server. Logstash is listening on TCP 5000 and is successfully receiving ...
0
votes
0answers
195 views

rsyslog - How to flush queue?

I'm using rsyslog to get logs from haproxy and put them into logstash for elasticsearch/kibana. Everything was working ok, but i've found something strange in rsyslog. I've found that i've got ...
0
votes
0answers
458 views

How to forward arbitrary files to graylog2 with rsyslog

I have some random files that I would like to collect and forward to my logging server. These are applications that don't really support GELF, so I am trying to forward these files with rsyslog: # ...
1
vote
1answer
2k views

How do I configure rsyslog on Ubuntu 14.04 to use ISO8601 timestamps?

In a file in /etc/rsyslog.d/ I have the following: local3.* /var/log/mylog.log When I log to this facility, records have timestamps which look like this: Apr 27 21:12:20 hostname msg How ...
2
votes
0answers
44 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
1
vote
0answers
22 views

Rsyslog dynamic variables

I have a rsyslog config file for an application that filters logs as so: if $msg contains 'sid:31147' then ~ if $programname == 'myprog' then /var/log/myprog.log &~ The idea is that if the msg ...
2
votes
2answers
728 views

Rsyslog duplicate logs (rsyslog.conf and rsyslog.d/something.conf)

I've created a custom log (php sends log entries to rsyslog) using local0. It uses a new custom file (/var/log/sea.log). The problem is that logs are being sent to /var/log/sea.log , ...
2
votes
1answer
554 views

Different permissions per log file when using rsyslog

Is it feasible to define different permissions per log file, using rsyslog? $FileCreateMode applies to all, but I want different permissions for a specific file.
0
votes
0answers
57 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
1
vote
2answers
158 views

Rsyslog filter by client

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side. I added this line ...
1
vote
1answer
92 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
1
vote
1answer
266 views

How to use rsyslog to log files from client to server

I've setup an rsyslog server which accepts log information from clients. I can successfully receive syslog messages however I'm interested in logging a number of files too. Here is what my client ...
1
vote
0answers
116 views

Redirecting app log to rsyslog in upstart script

I have an upstart script that does the following start on runlevel [2345] stop on runlevel [06] respawn pre-start script exec >/dev/kmsg 2>&1 REPO=git@github.com:blabla/bli ...
0
votes
2answers
403 views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...
1
vote
2answers
551 views

Trying to convert syslog-ng to rsyslog

I'me trying to get nginx to log direct to piwik. I am having problems getting rsyslog to accecpt some syslog-ng syntax. The rsyslog doc says syslog-ng conf is compatible with it. source s_nginx_20 { ...
1
vote
1answer
62 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
0
votes
1answer
194 views

Converting to rsyslog v7 new config format

I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy ...
0
votes
1answer
80 views

Syslog and LogAnalyzer - how to retrive source IPs and count them

I have set centralized Syslog (centOS + rsys) server which runs LogAnalyzer for better log presentation. Recently I have got asked to provide logs from the firewall of all IPs for particular firewall ...
1
vote
0answers
76 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
1
vote
1answer
358 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
0
votes
1answer
461 views

Forwarding from rsyslog to syslog-ng over TCP not working (although packets are reaching server)

We use syslog-ng on our central syslog server (syslog-ng-2.1.4-9.el5 on CentOS 5.9). We were happily sending logs using syslogd and rsyslog from a mixture of Linux and Solaris hosts over UDP until ...