rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

0
votes
1answer
9 views

Client rsyslog and server in the same machine Ubuntu 14.04

I am wondering if I can make Rsyslog to receive logs from my own IP, I just want to test that the configurations work, right now I dont have access to another PC or Server, just my PC, in few words I ...
1
vote
1answer
31 views

What rsync options to use for the below mentioned scenario?

Greetings !!! This is regarding a specific requirement about rsync that we are trying to achieve. We have tried to achieve this by using various rsync options. However, we are encountering different ...
0
votes
0answers
11 views

Remote logging with rsyslog - Cannot load module lmnsd_gtls.so

I have 2 servers and an office NAS on which I want the two servers to dump their logs. Only 1 server is successfully logging to the NAS. The other server continues to produce this error message in ...
0
votes
2answers
95 views

What is the difference between syslog, rsyslog and syslog-ng?

I am a bit confused in syslog, rsyslog and syslog-ng. From where can I get the source code for syslog()? Is there any difference between rsyslog and rsyslogd?
0
votes
0answers
25 views

rsyslog not discarding despite rule to the contrary

I am running rsyslogd on a new CentOS 6.6 box. I have put in a custom rule to log my firewall messages (via firehol) to a separate file, as per instructions here: ...
0
votes
0answers
5 views

Unable to get structured data in logged messages even after adding mmpstrucdata and mmrfc5424addhmac?(RFC5424)

I am trying to log messages with structured data . But it is showing null value for structured data. I am working with rsyslog 8.9.0.Can someone tell me either i need to load some module or modify ...
0
votes
1answer
19 views

kernel.log stays empty: “rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.”

I'm on a VPS (Ubuntu 14.04.2 LTS, Kernel 3.13.0-042stab094.8, rsyslog 7.4.4-1ubuntu2.5) and kernel.log stays empty with only this line: rsyslogd: imklog: cannot open kernel log (/proc/kmsg): ...
0
votes
0answers
14 views

SFTP and rsyslog: log activities of specified users only?

After a lot of anguish, I finally managed to get chrooted SFTP logging working in Ubuntu 14.04. Relevant bits from /etc/ssh/sshd_config: Subsystem sftp internal-sftp Match Group sftp-only ...
0
votes
2answers
37 views

rsyslog with logrotate: reload rsyslog vs copytruncate

I'm working on Ubuntu 14 with the default rsyslog and logrotate utility. In the default rsyslog logrotate /etc/logrotate.d/rsyslog config I see the following: /var/log/syslog { rotate 7 ...
1
vote
1answer
57 views

rsyslog not writing log file after restart

First off, thanks for spending the time to have a look at this issue, its much appreciated. I've had the attached rsyslog.conf configuration running for sometime now until today when I had to restart ...
-1
votes
1answer
47 views

what is wrong with this rsyslog configuration?

I am trying to get rsyslog to log to the following custom log file /var/log/iptables.conf instead of syslog. Iptables has got logging enabled, here is an example log line outputted from iptables ...
1
vote
1answer
56 views

Squid cannot log to syslog

According to this documentation: http://www.squid-cache.org/Doc/config/access_log/ squid should be able to log to rsyslog with the following directives: access_log syslog:daemon.info squid cache_log ...
1
vote
0answers
53 views

How to figure out why some characters go missing in rsyslog -> logstash pipeline

I am trying to figure out why some messages received by logstash have some text missing from them. I am sending the logs from an Untangle NGFW (11.0 - licensed) to logstash so that I can keep ...
0
votes
0answers
23 views

Sftp Log for every Jailed User

I've a sshd_config file like the following: Match user foo ChrootDirectory /mnt/foo-jail/ ForceCommand internal-sftp AllowTCPForwarding no AuthorizedKeysFile ...
-3
votes
1answer
33 views

Is it possible to centralize files in a directory?

Is it possible to centralize files in a directory? Currently, I am only using a common verisions of rsyslog. I can set the imfile for single file but it doesn't seem to work for a directory of files. ...
0
votes
0answers
25 views

Why would kern.log stop logging after crash & reboot

Server: Ubuntu 12.04 I recently noticed that my servers kern.log had stopped logging. I've not separated iptables from the kern.log so it used to be very active, however recently it's been logging ...
1
vote
0answers
17 views

rsyslog regex global modifier

Many regex systems have the ability to set a global modifier to allow for multiple matches. Here's how it works in Javascript and Perl. /g Python is a little different Python doesn’t have a ...
0
votes
1answer
114 views

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
0
votes
1answer
49 views

rsyslogd not storing remote logging information

I have a rsyslogd on Ubuntu 14.0.1: $ModLoad imtcp $InputTCPServerRun 514 $template FILENAME,"/var/log/%fromhost%/syslog.log" *.* ?FILENAME If if run logger -p local0.crit -n 10.240.157.116 -u ...
0
votes
0answers
45 views

Rsyslog last line of old log retransmitted after log rotation

I have config setup on all my CentOS servers to forward all syslog messages to a Graylog server via rsyslog. In Graylog I have then configured streams to alert on the occurrence of certain message ...
0
votes
2answers
90 views

Unable to get Rsyslog structured data in syslog message

I am new to syslog module. I am trying to log messages with structured data by using this parameter in template. But it is showing null value for structured data. I am working with rsyslogd 5.8.11 ...
3
votes
1answer
56 views

How to configure Monit to alert me when anything appears in syslog

I want Monit to alert me if ANYTHING shows up in syslog - as anything in there would be abnormal. I've tried the following and I'm not receiving any alert emails when I manually add something to ...
1
vote
0answers
17 views

Possible to have FQDN in Debian Logfiles?

Is it possible to have instead the hostname the fqdn inside debian log files? Example: Now its: Mar 2 18:00:12 www rsyslogd: [origin software="rsyslogd" swVersion="5.8.11" x-pid="2442" ...
0
votes
0answers
192 views

sending tomcat catalina.out to syslog

we're on tomcat 6.4 on centos. I've been trying to get the catalina.out logs in tomcat to syslog. For reasons it's very important that I don't send the raw logs, they have to be tagged with OURTOMCAT: ...
0
votes
0answers
25 views

rsyslogd and FQDN - cannot get FQDN from clients

I setup a syslogserver with rsyslogd and 3 clients. Logs from 3 test clients are sent to the server, so far so good. My Problem is: I can't get the FQDN hostnames to work. According to rsyslog.com ...
1
vote
1answer
85 views

configure and test rsyslog to UDP socket

I am trying to use https://github.com/gliderlabs/logspout so I can see all the logs from my containers in one place. I need rsyslog to listen on UDP socket on port 514. I uncommitted $ModLoad imudp ...
0
votes
1answer
64 views

Using rsyslog with TLS without generating a self signed cert

Just about every guide I have seen for using TLS with rsyslog involves generating a self signed cert and using that. If the boxes are already set up with a legit signed cert how do you set up the ...
1
vote
1answer
50 views

Rsyslog refuses to log over OpenVPN

I'm trying to forward rsyslog from a client to a server over a VPN. I have it working across an internet link already (through eth0 to an edge router) but would like it to go through the OpenVPN ...
0
votes
1answer
98 views

How to replace control characters in rsyslog

we have several (usually java) application and they log to centralized rsyslog server (version 7.6). We had problems with java exceptions as rsyslog was handling each line of stack trace as separate ...
0
votes
0answers
64 views

Writing to Unix Domain Socket from rsyslog

I want to write output messages from rsyslog to a Unix Domain Socket. I want to do this so that I can read the messages from that socket using my script and parse log messages further. I try to use ...
0
votes
1answer
101 views

Suppressing rsyslog tls error messages

When configuring rsyslog with tls and using PermittedPeer or streamdriver.authmode name, if an unauthorized peer connects, rsyslog logs error messages like below. Jan 22 08:56:38 test rsyslogd-2089: ...
1
vote
0answers
62 views

Syslog connection to Logstash not resetting

We have a setup with one Logstash server (1.4.2, using embedded Elasticsearch) to receive logs from a number of other clients (via TCP and from their rsyslogd instances). One issue that now happens ...
0
votes
2answers
66 views

Forwarding logs in nested directories with rsyslog

I have log forwarding set up using rsyslog and imfile. How could I go about watching nested log files? Right now I'm using wildcards to watch all files matching log/*.log, but I have logs nested 1 ...
0
votes
1answer
757 views

nginx logs to syslog - connection refused

I'm trying to setup nginx 1.7.3 to send logs to syslog, but when I this configuration: server { access_log syslog:server=localhost; } this shows up in nginx's error log: 2015/01/15 21:42:47 ...
0
votes
0answers
40 views

rsyslog v7 template conversion from v5

I need to convert my v5 rsyslog template to a v7 template. v5 template was this: $template Firewall,"/var/log/prd/fwlog-%$YEAR%-%$MONTH%-%$DAY%" $template ...
-1
votes
1answer
50 views

File monitoring using syslog [closed]

Can rsyslog, syslog-ng programs monitor change of file? I want to monitor files and receive the changes made to the file by syslog on server. Thank you.
1
vote
0answers
48 views

rsyslog: facilities not separating

I will preface this with, I am a Linux newbie. I had set up a Debian Linux rsyslog server that was working, but I had to switch to Ubuntu. I was hoping that I would be able to just copy the parts of ...
1
vote
0answers
30 views

rsyslog: Logs on local0 only on restart of rsyslogd

I have configured rsyslog.conf such that my program's log get logged in local0 facility. I have prevented logging in messages as well. *.info;mail.none;authpriv.none;cron.none;local0.none ...
0
votes
2answers
54 views

Can I prevent some of the UFW messages from being logged?

My router broadcasts (sends to 224.0.0.1) something every forty seconds. This is caught by UFW which stores a log entry in syslog: Jan 5 03:49:02 log kernel: [ 1184.788900] [UFW BLOCK] IN=eth0 ...
1
vote
2answers
63 views

cronjob not running daily

I am a linux newbie. With that said I need a cronjob to compress some syslog files after 48 hours to keep the size manageable. These files are currently located in /syslog - a disk I added to handle ...
3
votes
2answers
1k views

rsyslog - configuration help - logrotate and compression

I am a newbie to Linux and rsyslog. I have used the logfiles for many years, but I have never had to set one up. At this point I have some Proof of Concept devices pointing to my Debain Linux server. ...
-1
votes
1answer
89 views

Determine timezone in Rsyslog file

I would like to determine what time zone a specific log is in. I found this line in the log: Aug 29 07:07:40 gw kernel: rtc_cmos rtc_cmos: setting system clock to 2013-08-29 11:07:08 UTC(1377774428) ...
0
votes
0answers
85 views

rsyslog: one of two ruleset-specific main queues isn't processed

there is a Debian Wheezy server with stock rsyslog 5.8.11 which aggregate messages from two hosts, putting them into files at dynamically generated paths. A while ago we came to realization that a ...
0
votes
1answer
507 views

Haproxy not logging requests?

So, I configured Haproxy so the logging would go through rsyslog and, for now, be all dumped in one file. It's definetly logging, as I get those "starting" messages on startup, but no HTTP requests ...
1
vote
0answers
63 views

Rsyslog won't monitor mysql-slow.log when written to by mysql

I'm going mad. I'm trying to get rsyslog to send log files to logentries.com. This works perfectly until I try to log mysql-slow.log. The config is pretty simple module(load="imfile" ...
0
votes
2answers
2k views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
0
votes
1answer
940 views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
1
vote
2answers
879 views

Centos: rsyslog blocks sshd and also local login if selinux is active

I have a very curious problem on an centos 6.5(now 6.6) machine. After an update between june 11th and october 21th the trouble begins (packages: http://pastebin.com/gXvaycLL). After a restart in ...
-1
votes
1answer
96 views

prevent rsyslog writing in my custom log file [closed]

I'm trying to send a custom log from a client to a syslog server. The problem is that: Rsyslog keep writing the same information in my log file. How can I prevent rsyslog to write in my custom log ...
0
votes
0answers
83 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...