rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

0
votes
0answers
6 views

Rsyslog v2 File Support

Can anyone tell if v2.0 of rsyslog supports files (e.g., like the imfile module in the latest versions)? In case it does not, can anyone tell a workaround to send log files to a remote host? Thanks ...
0
votes
0answers
9 views

Collecting jmxremote data from multiple hosts

I use AWS Elasticbeanstalk to to run Java applications, which means my servers come and go with different ip addresses. I run jmxremote on the servers, but need to find a way of collecting jmx data ...
0
votes
1answer
15 views

rsyslog 8 wildcard stops sending

We are having an issue with the rsyslog8 wildcard feature and logs that are generated with the date in them by default. Rsyslog will send log messages when I first add the config but then stops ...
0
votes
1answer
9 views

rsyslogd wont start correctly on Ubuntu 14.04.4 LTS while using the Init-Script

somehow my init-script for rsyslogd does not work. I tried to enable rsyslogd to accept logging-data on udp:514. If I start my rsyslogd via Init-Script, no logging-data is forwarded. Not even syslog! ...
2
votes
1answer
37 views

sshd no longer logging after update on fresh CentOS 7 Install

I am running a VPS with CentOS 7. After a clean install, I correctly saw failed login attempts and service restarts appearing in /var/log/secure like so: Jul 8 13:55:32 vps unix_chkpwd[2561]: ...
1
vote
1answer
27 views

Rsyslog not logging events

I'm trying to stand up a syslog server to receive events from a piece of network equipment, but I can't seem to get it to actually log the events to disk. I can confirm that the connection is being ...
0
votes
0answers
15 views

Syslog filter to own file by tag or text contain

I need to log from my Python application to syslog. In syslog I want filter messages from my app to own file. I'm using Debian 8.3. My rsyslog rules: # cat /etc/rsyslog.d/99-MyLog.conf :syslogtag, ...
0
votes
0answers
7 views

How can I use the hostname of the machine rsyslog got the message from, regardless of what is in the message?

I have a machine we run rsyslog on. This is the config I have in place in rsyslog.conf: $template DynFileMyApp, "/opt/remote-syslog-data/MyApp/%HOSTNAME%.log" $RuleSet MyApp *.* ?DynFileMyApp $...
0
votes
1answer
14 views

Configure rsyslog client to send different log filename to a syslog-ng server

I have multiple servers with rsyslog configured to write logs to a remote syslog-ng server configured like this: # Log anything of level info or higher. # Don't log private authentication messages! *....
0
votes
1answer
11 views

rsyslog : logs in double in my file

I've configured my firewall to send logs to rsyslog. But all logs appears twice. cat fortigate100D | grep "sessionid=97294098" Jun 27 11:24:16 date=2016-06-27 time=11:24:16 logid=0000000013 type=...
0
votes
1answer
20 views

Rsyslog not capturing Remote log

I am on the way to configure LogAnalyzer with Rsyslog server. I am all done with HTTP configuration. but my loganalyzer is only logging logs from localhost. I am little bit confused that where to ...
0
votes
1answer
50 views

Rsyslog output in GELF

rsyslog is powerful, but its docs aren't that explicit. I can't figure out how to parse a log file and route it directly to Graylog in GELF format. I have found bits of documentation about outputing ...
0
votes
0answers
26 views

Rsyslog filter by facility name and multiple string conditions

We have the following line in an rsyslog.d/conf.d file: if $syslogfacility-text == 'local6' and ($msg contains 'TID' and $msg contains 'JID' and $msg contains 'INFO') then ~ The issue is that the ...
0
votes
0answers
13 views

How to configure rsyslog to log message from different servers and forward to different servers?

Scenario: I have multiple sites say around 14, and a central syslog server, now entire logging is done at central log server. But I need to log the data at central syslog server individually for ...
0
votes
0answers
7 views

Storing rsyslog remote events into ip based file

I was looking in the documentation and over google if it's possible to create single rule in rsyslog that would place the syslog events into files based on source ip/host/any other variable. What I ...
0
votes
0answers
68 views

Missing /var/log/messages file in CentOS 6.8

I'm not sure what I'm doing wrong, but my Linux box doesn't seem to be logging any info to the messages file. Will someone please help? Here's the content of the /etc/rsyslog.conf file (rsyslog-5.8....
0
votes
0answers
15 views

How to force rsyslog ommysql use utf8?

I'm using ommysql in rsyslog for transfering data into mysql $ModLoad ommysql local6.* :ommysql:localhost,Syslog,rsyslog,1 but cyrilic data goes like "·Ð¾Ð²Ð°Ð½Ð¸Ðµ иÑ�точнÐ" in ...
0
votes
1answer
21 views

rsyslog ignoring settings file

changing the /etc/rsyslog.conf has no effect for my rsyslog. After changing the settings I call service rsyslog restart and it starts up without any problems. I for instance tried commenting out all ...
0
votes
1answer
101 views

Pass host from nginx to rsyslog

I have a cluster of nginx web servers and a separate syslog server running rsyslog. The nginx vhost looks like this: access_log syslog:server=10.0.0.51,facility=local1,severity=info combined; ...
0
votes
0answers
24 views

rsyslog does not close connections

I've successfully configured rsyslog (v5.8.11-3, Debian 7.6) to receive messages from remote machines using this configuration: Server-side rsyslog.conf $ModLoad imtcp $InputTCPServerRun 514 $...
1
vote
1answer
35 views

How do I handle messages from my custom application in rsyslog?

I have a Ruby application on my server, let's call it "alpha". The application emits syslog messages with the program name "alpha". I want to separate my log messages into separate files based on what ...
0
votes
2answers
43 views

Rsyslog pull tools or strategy

I would collect the log(in particolar auditd but also other syslog log) produced by several linux server in a centralized syslog server installed in a linux server. I would configure the centralized ...
2
votes
1answer
34 views

rsyslogd not listening udp 514

I have Debian 3.2.65-1+deb7u2 with rsyslog 5.8.11 udp 514 $UDPServerRun 514 and $InputTCPServerRun 514 are uncommented. Why it is not listening to that udp port?
1
vote
2answers
31 views

I erased haproxy.log with old content but this file hasn't appeared again

I have a load balancer with HAProxy in Ubuntu 14.04. I did all configurations for turn on log and it works well. However, I erased haproxy.log file and that hasn't appeared again. Can someone help me? ...
0
votes
2answers
58 views

Redirecting log from /var/log/kern.log to a separate log file for iptables log

I am trying to redirect iptables log to another file. Based upon my reading on the net, I did the following: In my iptables rule, I have rules like: iptables -A INPUT -s ... -j LOG --log-prefix "...
1
vote
1answer
93 views

Forwarding specific logs rsyslog

TL;DR - send specific logs with rsyslog (to a redis server) : how to select the logs to be sent ? I want to forward to a redis server a set (and only that set) of logs, say for instance nginx logs in ...
0
votes
0answers
19 views

rsyslog capturing apacher logs in mongodb

I am trying to send my apache logs to mongodb via rsyslog My rsyslog.conf looks like this: module(load="imuxsock") module(load="imklog") module(load="imfile") module(load="ommongodb") input(...
2
votes
0answers
158 views

Nginx log to syslog on TCP port

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do: error_log syslog:server=192.168.1.1; However I need to ...
0
votes
0answers
56 views

How can I pull data from journald and outputing it to logz via rsyslog

I have a number of servers that use CoreOS. CoreOS natively uses journald for all it's log files. The latest stable release incorporates docker 1.9 so it doesn't yet support docker log drivers. ...
0
votes
0answers
43 views

docker entered disabled state

Had my debian 7 (3.16.7) system suddenly stop responding. Its a rented unit in the cloud but not shared, I have the whole server. General troubleshooting is beyond a simple question here, but I'm ...
2
votes
0answers
23 views

How can I configure SELinux to let rsyslogd run my program?

I'm trying to use SELinux with a system which has rsyslogd call a binary: # rsyslog configuration file module(load="omprog") template( name="snmp_template" type="string" string="%msg%\007" ) ...
1
vote
1answer
61 views

How can I add values to structured data with rsyslog?

Our logs are sent from our applications to rsyslog running on the same host. Rsyslog then forwards the messages to Sumo Logic. We need to add some metadata to our log messages in the structured data ...
0
votes
0answers
19 views

Templates in Rsyslog 8.17

Recently I patched my system and the installed rsyslog version changed from 8.10 to 8.17. Somehow this update broke all my templates. My custom properties aren't recognized anymore (For example Mark, ...
3
votes
0answers
32 views

remote rsyslog client/server issue

I only want rsyslog to send the logs to the centralized rsyslog server but it is sending them locally as well. This is for legal reasons, the servers will not have a logs directory, only the ...
3
votes
0answers
52 views

When configuring rsyslog to log to mysql DB, what is purpose of SystemEventsProperties table?

I've configured rsyslog on my servers to log to a remote mysql DB. I did this essentially by following the rsyslog wiki and it essentially creates two tables: mysql> show tables; +----------------...
1
vote
0answers
62 views

Postfix logs to remote log host

On my Ubuntu 14.04 server, I'm using Postfix as a front-end mailserver, and I would like to send all mail related info, including email addresses, to a remote host. In the file /etc/rsyslog.d/50-...
2
votes
0answers
26 views

Upstart job logs not being forwarded by rsyslog - Ubuntu 14.04 LTS

I've got rsyslog set up correctly forwarding all logs on a set of clients to a central server. Things like ssh auth logs etc all work fine and appear in the remote server properly. The issue is that ...
1
vote
0answers
17 views

How to have upstart shutdown rsyslog as last job in Ubuntu 14.04

It seems like upstart decides to shutdown rsyslog on Ubuntu 14.04 as one of the first jobs if a machine shuts down. So most logging of shutting down jobs is lost. How to I instruct upstart to shutdown ...
0
votes
0answers
41 views

rsyslogd and systemd-journald ram usage

I have a small VPS server with CentOS on it and only 512 MB RAM. It's just for small web-server (nginx) with mariadb, email-server (postfix, dovecot) and BIND service on my own. Today I found that ...
0
votes
2answers
66 views

rsyslog TLS on AIX

I am trying to forward logs with rsyslog (8.4.2) on AIX 7.1 and I need to encrypt with TLS. However it seems I need rsyslog-gnutls package. I can't seem to find this package anywhere for AIX. Best I ...
1
vote
0answers
19 views

rsyslog parsing logs with liblognorm

I'm trying to use such .rb file to parse logs: version=2 rule=:%Server:char-to:\t%\t%stamp:char-to:\t%\t%ip:ipv4%\t%Site:char-to:\t%\t%BID:char-to:\t%\t%SID:char-to:\t%\t%LD:char-to:\t%\t%UserID:...
0
votes
0answers
15 views

rsyslog 8.17 char changing

My rsyslog configuration do not want to work properly Here is my example log: Mar 10 10:57:35 servername log_tag servername.at.google.com#01120160310105735#01144.44.44.443#011app#011162040-...
0
votes
0answers
96 views

Read an environment variable (or environment file) from an rsyslog config?

I'm building AMIs here for my organization which include default configuration to send all of our logs to Loggly from rsyslogd. It works pretty well, but I'd like to be able to customize the ...
0
votes
0answers
53 views

rsyslog stops working on CentOS 7

I have a CentOS 7.2 configuration in which rsyslog is pulling from journald. We have a few application-specific logs, and at times they just stop getting any data from rsyslog. The only way to get ...
-1
votes
1answer
71 views

rsyslog limit log size

Is this even possible to do in rsyslog? http://www.rsyslog.com/doc/rsyslog_conf_output.html This syntax is not working: mail.* -/var/log/mail.log:300M I need to set this limitation ...
0
votes
0answers
41 views

How to configure rsyslog to forward all log files from specific directory?

I have already configured and working setup of centralized log server with web interface. But i need to forward all log files from specific directory in remote host "/Volumes/path/to/dir" to my server....
4
votes
1answer
94 views

Logstash with journald instead of rsyslog

I'm used to sending my logs from a server to a remote Logstash using rsyslog, with a configuration file roughly as follows (usually more specific to prevent too many logs from being sent): *.* @192....
0
votes
1answer
58 views

rsyslog server listen only on tcp 514

I'm trying to set rsyslog client- server to listen to tcp messages with port other then 514, however it doesn't work. Only when using 514 it receives messages. I'm using EC2 vms. input(type="imtcp" ...
0
votes
0answers
24 views

Forward psacct logs to rsyslog

I want to monitor users activity and aggregate logs using rsyslog. Is there any way how to do it natively? If I understand how does psacct work, it monitors whole users activity and saves logs in own ...
0
votes
1answer
11 views

only send rsyslog's $msg to file?

I'm using a rsyslog rule to send syslog output from one program elsewhere: :programname, isequal, "myprogram" /var/log/myprogram.log I don't want the rsyslog "header" information (date, hostname, ...