rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

4
votes
1answer
19 views

Logstash with journald instead of rsyslog

I'm used to sending my logs from a server to a remote Logstash using rsyslog, with a configuration file roughly as follows (usually more specific to prevent too many logs from being sent): *.* ...
0
votes
1answer
19 views

rsyslog server listen only on tcp 514

I'm trying to set rsyslog client- server to listen to tcp messages with port other then 514, however it doesn't work. Only when using 514 it receives messages. I'm using EC2 vms. input(type="imtcp" ...
0
votes
0answers
5 views

Forward psacct logs to rsyslog

I want to monitor users activity and aggregate logs using rsyslog. Is there any way how to do it natively? If I understand how does psacct work, it monitors whole users activity and saves logs in own ...
0
votes
0answers
4 views

only send rsyslog's $msg to file?

I'm using a rsyslog rule to send syslog output from one program elsewhere: :programname, isequal, "myprogram" /var/log/myprogram.log I don't want the rsyslog "header" information (date, hostname, ...
0
votes
1answer
45 views

rsyslog upgrade fails: Sub-process /usr/bin/dpkg returned an error code (1)

I'm having trouble upgrading rsyslog on a Debian server. root@trip:/home# apt-get upgrade Reading package lists... Done Building dependency tree Reading state information... Done Calculating ...
0
votes
0answers
16 views

rsyslog not filtering message field

Trying to remove ALL cron log stuff from auth/syslog but I cannot get it. Here is a snippet of my rsyslog. Not sure how to get this to format right, it keeps wanting to mess with my paste. But here ...
0
votes
0answers
20 views

rsyslog working differently when started as service

I have configured rsyslog to read from a file /root/test.log and forward what it reads on TCP If I start rsyslog directly: [root@servername ~]# rsyslogd it works as I expect (yay). However it does ...
0
votes
0answers
9 views

Use rsyslog to forward but not write to local log

I'm using rsyslog on RHEL6 (ie rsyslog 5.8.10) and forwarding to a central syslog server is already set up. Now I'm wanting to track an extra file that will be forwarded to the syslog server. I used: ...
0
votes
1answer
31 views

graylog not getting cents 7.1 syslog messages using the rsyslogd service

Good morning! I'm playing with Graylog today and everything is working well on Ubuntu, but the two CentOS 7.1 servers I've attempted to attach to it are acting strange. I've been keeping notes as ...
0
votes
1answer
20 views

Is it possible for rsyslog to create a directory?

The Setup I have this in my /etc/rsyslog.conf: $template local1DynFile,"/path/to/my/log/%programname%.log.%NOW% $template local1LogFormat,"%msg:2:$:%\n" *,*;auth,authpriv,local0,local1.none ...
2
votes
1answer
29 views

Why isn't my SELinux logging anything?

I have a sneaking suspicion it has something to do with me mucking about with my rsyslog.conf, but I'm not 100% sure about that. I am running Centos 7, and SELinux has been working A-OK. However, I ...
0
votes
1answer
29 views

Change message content in a syslog server

I am looking to log some troubleshooting info from a DataPower Appliance into a syslog. Although it is already logging, I have a third party solution that requires some modification to the messages, ...
2
votes
0answers
42 views

How does one separate log data sent to a remote rsyslog server?

I have messages from multiple apache2 web servers logging to a rsyslog server. I've used a template to separate each /var/log/syslog file into its own folder based off of the ip address of the server ...
-3
votes
1answer
33 views

How can I send non-default log files to remote rsyslog server? [duplicate]

Yes, I see that you want to mark this as a duplicate, and I appreciate that, but please read to the end. I've found this question several places, and the answers are either too vague for a noob to ...
1
vote
2answers
144 views

Logging not working on Centos 7

Long story short - somehow I managed to screw up rsyslogd service on Centos 7 server. Now only thing that appears in /var/log/messages is: Dec 14 22:13:27 {myhostname} rsyslogd: [origin ...
0
votes
0answers
9 views

rsyslog: Template for hosts sending from 172.16.0.0/12

What is the shortest template to capture all hosts sending from an IP address within the 172.16.0.0/12 network? I would like to avoid multiple :fromhost-ip statements. Basically, I'm trying to create ...
3
votes
1answer
34 views

Alternative way to disable cron writing to /var/log/syslog

There are answers that suggest changing this: *.*;auth,authpriv.none -/var/log/syslog #cron.* -/var/log/cron.log Into this: *.*;cron,auth,authpriv.none ...
0
votes
1answer
44 views

How can I make rsyslog send the logfiles to a location outside of /var/log?

I have a central syslog server (ubuntu 14.04 server), that I've set up to take in logs from many servers. This server has a storage hard drive that is very large, mounted at /home/username/logs I'd ...
0
votes
1answer
14 views

rsyslog not starting up: not found

When starting rsyslog I get the following: /etc/init.d/rsyslog: 1: /etc/default/rsyslog: imudp: not found /etc/init.d/rsyslog: 2: /etc/default/rsyslog: 127.0.0.1: not found /etc/init.d/rsyslog: 3: ...
0
votes
0answers
18 views

RSYSLOG v3 vs v5 config for property base filtering

I'm trying to set up a property base filtering for audispd log, this is what I have currently SLES11 RSYSLOG v5 RHEL6 RSYSLOG v5 RHEL5 RSYSLOG v3 rsyslogd: [origin software="rsyslogd" ...
0
votes
1answer
27 views

rsyslogd template stopped working

Really perplexed at what happened. I've had rsyslogd running on a Centos 6.5 server for a while now logging for remote hosts to a special folder /data/rsyslog. Yesterday I setup our firewall to start ...
1
vote
1answer
76 views

rsyslog does not discard messages

I have the following rsyslog.conf: $PreserveFQDN on # rsyslog v5 configuration file # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html # If you experience problems, see ...
0
votes
1answer
28 views

Logging in separates files in rsyslog

I am configuring rsyslog in order it logs in separate files, identified by the port through which the log event arrives. In order to avoid opening too much ports, I was trying to see if there is any ...
0
votes
1answer
34 views

Send all logs of a system to one specific syslog local facility (local1-7) [closed]

I want to assign the syslog local facilities to specific OS, so I can sort the incoming logs on the logserver (e.g. local1 for Windows logs, local2 for RedHat logs, etc). It worked perfectly on ...
1
vote
1answer
54 views

rsyslog cannot send logs to logstash

Here is my rsyslog.conf (nothing in /etc/rsyslog.d/ folder): #### MODULES #### $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imklog # provides ...
0
votes
0answers
18 views

Is it possible to make samba (smbd,nmbd,winbindd) stop write log to disk and write it only to syslog(rsyslog)?

I have samba instance, and I don't need samba write log to disk, but I want write it to rsyslog. And not full_audit, just general log, how to do it? Options syslog only and syslog from ...
0
votes
0answers
13 views

rsyslog on both a tcp cleartext port and tcp ssl port

I would need to have rsyslog to listen to two TCP ports, one encrypted and one in cleartext. How to do that? The following is not working: $InputTCPServerBindRuleset remote ...
-1
votes
1answer
28 views

IPtables log only some drop connections

I have these rules: -A INPUT -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7 -A INPUT -j DROP But this logs every DROP that occurs like IPTables Packet Dropped: ...
-2
votes
1answer
79 views

Ubuntu + Postfix: Mail Log Missing [duplicate]

I've just installed postfix on my ubuntu server and am trying to debug why outgoing mails are not being sent. This led me to notice that the /var/log/mail.log file is missing. For that matter, there's ...
0
votes
2answers
45 views

syslog-ng “log_msg_size” maximum possible value

I read from syslog-ng doc and forums that log_msg_size to defaults to 8192. What is the possible maximum limit of this parameter? My application supports either syslog-ng or rsyslog depending upon ...
0
votes
0answers
61 views

Python TCP socket and syslog

I'm baffled as to why I can't get rsyslog to log data sent to it via TCP whenever I send the data with a Python script, but works perfectly fine if I send the same string via netcat Rsyslog is set up ...
0
votes
0answers
35 views

Identical VMs behave differently

I have 2 Centos 6.7 OpenVZ VPS'. I have copied the entire disk image from the first one (server1) to the second one (server2). Now I have a couple of issues with server1 that I don't have with ...
0
votes
1answer
100 views

Why can't the logstash syslog_pri filter see the priority in syslog messages

I'm running LS 2.0.0, and I've noticed an issue where the syslog_pri filter doesn't detect the priority at the start of my syslogs. My filter config is as follows: filter { if [type] == "relp" { ...
0
votes
0answers
53 views

maillog files not in chronological date order

I am running centos 7 LAMP server with webmin and recently disabled mailman from the bootup and shutdown module of webmin and then rebooted the system. I am positive my log files(such as maillog, ...
2
votes
1answer
36 views

Does rsyslogd send new information or the entire log file upon restart

I'm trying to use rsyslog on a Debian machine to send log data to an external server. The log files that I'm interested in have around 10GB of historical data. When I started on configuring rsyslog ...
0
votes
1answer
80 views

Rsyslog doesn't create log files on CentOS7

I have the following configuration file in "/etc/rsyslog.d/10-my.conf" # This file is managed by Puppet, changes may be overwritten if $programname == 'hello' then -/var/log/test/test.log & ~ ...
0
votes
0answers
36 views

Centos LDAP server slapd stops responding until rsyslog is restarted

Have a LDAP sever running centos 6 with a fairly low amount of LDAP AUTH requests. Every couple of days the LDAP server will stop responding completely to any requests. LDAPsearch will freeze and ...
1
vote
0answers
80 views

rsyslog filter on authpriv facility in rsyslog.conf

This has been addressed in other post(s), but I still can't get this to work properly. I am trying to OMIT (discard) certain entries from being written to my " /var/log/secure ". Namely, any line ...
0
votes
1answer
55 views

installing GlusterFS 3.7.5 on AWS AMI

I am trying to install Gluster 3.7.5 on Amazon Linux AMI but cannot get passed error Error: Package: glusterfs-libs-3.7.5-1.el7.x86_64 (glusterfs-epel) Requires: rsyslog-mmjsonparse Error: ...
0
votes
0answers
92 views

how to supervisord logs to syslog

I am using supervisord to manage my process. Say process A, I log to /data/log/A.log and I setup logrotate. Now, I need to pipe to syslog which automatically pipes to r syslog. Should I edit ...
0
votes
0answers
32 views

Rsyslog system timezone

I changed timezone on my server and can't understand - why rsyslog did not apply them. Rsyslog has no any timezone related settings. I also try to restart both cron and rsyslogd daemons. Timezone ...
1
vote
2answers
43 views

rsyslog - Different logs for different IP addresses?

Our network has devices scattered all over. I'd like to do something like: pool1 { 192.168.1.1-192.168.1.20, 192.168.1.50 } pool2 { 192.168.1.21-192.168.1.40, 192.168.1.66 } if from pool1 do this ...
0
votes
1answer
40 views

How do I watch local# to ensure messages are being sent to it?

I am trying to collect additional operation logging from my sftp server. I have added the following lines to /etc/ssh/sshd_config, as instructed by many posts on the internet: Subsystem sftp ...
0
votes
1answer
89 views

Postfix logs nowhere to be found in Ubuntu 14.04.3 LTS

I have not changed any configuration in any of the tools, specially not in: syslog rsyslog postfix systemd (If any apply) In my /var/log there is no /var/log/mail.log, /var/log/postfix.log or ...
1
vote
0answers
110 views

How can I separate logs with rsyslog from a remote location for devices using the same IP?

I have a number of Yealink SIP phones at different locations that I am trying to centralize log collection for. I have set up a CentOS server at my main location with rsyslog. I am forwarding all ...
0
votes
1answer
62 views

rsyslog convert json to text on the fly

I have application logging events in JSON format for later structured queries, etc. Now I have a task to log the same messages in plain text (CSV probably) and I really don't want to log each event ...
0
votes
2answers
117 views

Haproxy logging doesn't work. Does that have anything to do with csf?

Does Haproxy log every time a connection is made? I have followed instructions from other threads to set up logging via rsyslogd. Even though the files are created (haproxy.log,haproxy-info.log and ...
0
votes
1answer
43 views

Rsyslog logging to rolled log instead of unrolled log

Forgive me if I am vague, but I am trying to keep this as secure as possible. I have a CentOS server setup as a central remote logging server. Servers have been sending their logs to this server for ...
-2
votes
1answer
33 views

Rsyslog not working properly on Centos6.6

The TCPDUMP output from the source server is given below: 04:48:03.074010 IP RCVSPRLN002.37915 > 10.61.0.12.syslog: SYSLOG authpriv.info, length: 103 This shows that the server RCVSPRLN002 is ...
0
votes
1answer
40 views

Unable to log into a rsyslog filter using logger [duplicate]

Ubuntu 64 14.04 comes with rsyslog (7) built-in. I've added test.conf to /etc/rsyslog.d with the following line: :syslogtag,isequal,"test" /var/log/test.log I then restart rsyslog and log ...