rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

-4
votes
0answers
14 views

How to configure ubuntu 14.04 to receive syslog messages from cisco routers?

I am using cisco CSR1000V/cisco router to export syslog messages to syslog server using ubuntu 14.04. How to configure the server side? There are documents for ubuntu 12.04 remote syslog server but ...
0
votes
1answer
19 views

Suppressing rsyslog tls error messages

When configuring rsyslog with tls and using PermittedPeer or streamdriver.authmode name, if an unauthorized peer connects, rsyslog logs error messages like below. Jan 22 08:56:38 test rsyslogd-2089: ...
1
vote
0answers
22 views

Syslog connection to Logstash not resetting

We have a setup with one Logstash server (1.4.2, using embedded Elasticsearch) to receive logs from a number of other clients (via TCP and from their rsyslogd instances). One issue that now happens ...
0
votes
2answers
42 views

Forwarding logs in nested directories with rsyslog

I have log forwarding set up using rsyslog and imfile. How could I go about watching nested log files? Right now I'm using wildcards to watch all files matching log/*.log, but I have logs nested 1 ...
0
votes
1answer
46 views

nginx logs to syslog - connection refused

I'm trying to setup nginx 1.7.3 to send logs to syslog, but when I this configuration: server { access_log syslog:server=localhost; } this shows up in nginx's error log: 2015/01/15 21:42:47 ...
0
votes
0answers
21 views

rsyslog v7 template conversion from v5

I need to convert my v5 rsyslog template to a v7 template. v5 template was this: $template Firewall,"/var/log/prd/fwlog-%$YEAR%-%$MONTH%-%$DAY%" $template ...
-1
votes
1answer
30 views

File monitoring using syslog [closed]

Can rsyslog, syslog-ng programs monitor change of file? I want to monitor files and receive the changes made to the file by syslog on server. Thank you.
1
vote
0answers
34 views

rsyslog: facilities not separating

I will preface this with, I am a Linux newbie. I had set up a Debian Linux rsyslog server that was working, but I had to switch to Ubuntu. I was hoping that I would be able to just copy the parts of ...
1
vote
0answers
21 views

rsyslog: Logs on local0 only on restart of rsyslogd

I have configured rsyslog.conf such that my program's log get logged in local0 facility. I have prevented logging in messages as well. *.info;mail.none;authpriv.none;cron.none;local0.none ...
0
votes
2answers
24 views

Can I prevent some of the UFW messages from being logged?

My router broadcasts (sends to 224.0.0.1) something every forty seconds. This is caught by UFW which stores a log entry in syslog: Jan 5 03:49:02 log kernel: [ 1184.788900] [UFW BLOCK] IN=eth0 ...
1
vote
2answers
54 views

cronjob not running daily

I am a linux newbie. With that said I need a cronjob to compress some syslog files after 48 hours to keep the size manageable. These files are currently located in /syslog - a disk I added to handle ...
3
votes
2answers
121 views

rsyslog - configuration help - logrotate and compression

I am a newbie to Linux and rsyslog. I have used the logfiles for many years, but I have never had to set one up. At this point I have some Proof of Concept devices pointing to my Debain Linux server. ...
-1
votes
1answer
51 views

Determine timezone in Rsyslog file

I would like to determine what time zone a specific log is in. I found this line in the log: Aug 29 07:07:40 gw kernel: rtc_cmos rtc_cmos: setting system clock to 2013-08-29 11:07:08 UTC(1377774428) ...
0
votes
0answers
43 views

rsyslog: one of two ruleset-specific main queues isn't processed

there is a Debian Wheezy server with stock rsyslog 5.8.11 which aggregate messages from two hosts, putting them into files at dynamically generated paths. A while ago we came to realization that a ...
0
votes
1answer
88 views

Haproxy not logging requests?

So, I configured Haproxy so the logging would go through rsyslog and, for now, be all dumped in one file. It's definetly logging, as I get those "starting" messages on startup, but no HTTP requests ...
1
vote
0answers
37 views

Rsyslog won't monitor mysql-slow.log when written to by mysql

I'm going mad. I'm trying to get rsyslog to send log files to logentries.com. This works perfectly until I try to log mysql-slow.log. The config is pretty simple module(load="imfile" ...
0
votes
0answers
223 views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
0
votes
1answer
214 views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
1
vote
2answers
552 views

Centos: rsyslog blocks sshd and also local login if selinux is active

I have a very curious problem on an centos 6.5(now 6.6) machine. After an update between june 11th and october 21th the trouble begins (packages: http://pastebin.com/gXvaycLL). After a restart in ...
-1
votes
1answer
66 views

prevent rsyslog writing in my custom log file [closed]

I'm trying to send a custom log from a client to a syslog server. The problem is that: Rsyslog keep writing the same information in my log file. How can I prevent rsyslog to write in my custom log ...
0
votes
0answers
37 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...
3
votes
1answer
126 views

Random SSH entries in Auth.log out of date order [duplicate]

Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue. Some ...
1
vote
1answer
779 views

Snort not sending alert log file to syslog server?

I am set up with three virtual machines running Ubuntu - a Server, Client, and Gateway. I am tasked with setting up Snort on the Gateway to monitor "attacks" from the Client to the Server. Snort is ...
1
vote
2answers
123 views

Syslog does not record logs received over TCP to a file

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over ...
0
votes
0answers
47 views

CentOS - php-fpm update - rsyslog issue

Strangest thing. After updating php from 5.4.24 to 5.4.33, I noticed that php errors are no longer going to /var/log/php/all.log, instead they are back in /var/log/messages. I checked my rsyslog ...
2
votes
2answers
72 views

rsyslog configuration syntax

I need to take several actions for some log messages. For example I want to log them to different files according to severity. Everything is ok if I use this: if $programname == 'myprog' ...
0
votes
1answer
61 views

Need to upgrade only rsyslog on Debian system

Just received a notice from apticron: apticron has detected that some packages need upgrading on: The following packages are currently pending an upgrade: rsyslog 5.8.11-3+deb7u1 ... Package ...
1
vote
0answers
54 views

Is it possible to filter rsyslog messages based on an environment variable, the content of a file or the output of a command?

I am configuring setup scripts for automatically created VMs which need to filter syslog messages in rsyslogd based on an environment variable. I need to be able to change where logs get sent based ...
0
votes
0answers
44 views

php-fpm: Maintain php_mod logging format

I recently switched all my lab servers from apache pre_fork/mod_php to apache worker/fcgi/php-fpm, and after getting everything set-up correctly, I noticed one last issue; php-fpm is adding it's own ...
0
votes
1answer
156 views

RSyslog sends logs to logstash with host as IP not FQDN

I am having a issue. I am trying to send apache/nginx logs to logstash server. The problem is that rsyslog sends host as IP not the servers FQDN. Solutions that I have tried: PreserveFQDN on (did ...
0
votes
0answers
30 views

Input filtering in rsyslog 5?

I have some messages hitting my rsyslogd server which a network trace shows as: <5>1 2014-09-04T14:58:31Z HOSTNAME This=a message=that contains=some specially=formatted data= This is ...
0
votes
1answer
245 views

Rsyslog queues and performance impacts

Having recently had a network failure that caused a major cascading series of other issues, I've been diving into our rsyslog.conf to try identify opportunities for more stable deployment. We have ...
3
votes
1answer
250 views

How do I configure rsyslog to deal with MySQL Slow Query Log multi-line messages?

Using rsyslog v8.2.2, I would like to group multi-line messages, such as those output by the MySQL Slow Query log. Each new message begins with three consecutive lines having '#' as the first char of ...
1
vote
1answer
26 views

TCP rsyslogd events showing up as 2000 character continuations

I'm taking syslog events from a proprietary app. This could be the app's fault or it could be rsyslogd. Events are written like: Aug 15 16:00:00 10.11.12.13 Event1 from this wonderful product using ...
2
votes
2answers
57 views

Using (r)syslog's dynamic file generation

I am in the middle of configuring a (r)syslog server as a remote server that receives logs from various clients. I wonder whether there is a nicer way to dynamically generate multiple file names as ...
1
vote
1answer
389 views

Forward linux logs to fluentd on linux

On one VM I have this in /etc/rsyslog.d/50-default.conf *.* @192.168.29.1:42185 # Default rules for rsyslog. On the vm with fluentd I have this: I have this in /etc/td-agent/td-agent.conf ...
0
votes
0answers
39 views

One rsyslog machine accepting encrypted and non encrypted logs on different ports

I'm trying to setup an rsyslog server to accept input from 2 different ports, one encrypted for our non internal servers, and one open for our internal servers. The reason for needing this is that ...
0
votes
0answers
71 views

Group Ownership in rsyslog?

What I would like would be to have all remote local7 facilities logged to: /var/log/cisco.log but the ownership needs to be under the group "cisco" in /etc/rsyslog.conf I have: # Logs for cisco ...
2
votes
1answer
87 views

IPTables custom log failing

I'm currently trying to split out some of my IPTables logging from kern.log into a file called iptables.log. Basically, I have several different adapters and I'm logging requests to port 80 on each ...
3
votes
1answer
323 views

Difference between /dev/udp and netcat

I have a syslog server listening on localhost:514 as UDP and would like to write messages to it on that port. (Using Ubuntu 14.04) If I run either of these commands this from bash it prints the date ...
2
votes
1answer
148 views

Remote logging to specific directory structure with rsyslog

I'm currently in the process of having all of our various servers send their syslog messages to a central server. I'd like to have the following directory structure on the central server that logs ...
0
votes
0answers
78 views

rsyslog not writing remote host messages to specific file

I have the following in my rsyslog.conf file on my ubuntu 14.04 logging server: if $fromhost-ip = '192.168.10.37' then /var/log/netgear/switch.log I have changed the owner to be syslog adm 0 ...
1
vote
1answer
317 views

Configuring MariaDB to log to mysql.log using rsyslog

I'm a little stumped - there is something obvious I'm missing here. Recently I made the switch from mySQL to mariaDB. Everything is working so far - except for the logging, as I realized today. All ...
0
votes
0answers
282 views

Proper rsyslog configuration

I'm trying to setup a syslog server but it doesn't appear to be working as intended. My client does not seem to be logging to it. Server Ubuntu 12.04 (192.168.1.10) Client Ubuntu 14.04 ...
2
votes
0answers
715 views

Rsyslog: discarding specific messages, rate limiting

I've got netatalk installed on the server and afpd is spamming system logs with the following error: Jun 24 15:38:16 TEST afpd[21532]: sys_getextattr_size: error: Operation not supported I'm not ...
0
votes
0answers
245 views

Setup CENTOS Centralized AUDIT and RSYSLOG server

Attempting to use these links: Sending audit logs to SYSLOG server or http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log I have been unable to get centralized AUDIT logging to work on my ...
1
vote
0answers
117 views

Receiving Apache access and error logs via rsyslog and possible catchall filter

I'm new to rsyslog and have been trying to figure out why I am not receiving any of my Apache and mysql logs which are configured on the client-side to sent via rsyslog. I am currently receiving all ...
2
votes
1answer
1k views

Sending logs to remote server with rsyslog

I'm trying to setup centralized logging with Logstash, Elasticsearch and Kibana and am having trouble getting logs to my log server. Logstash is listening on TCP 5000 and is successfully receiving ...
0
votes
0answers
323 views

rsyslog - How to flush queue?

I'm using rsyslog to get logs from haproxy and put them into logstash for elasticsearch/kibana. Everything was working ok, but i've found something strange in rsyslog. I've found that i've got ...
0
votes
0answers
561 views

How to forward arbitrary files to graylog2 with rsyslog

I have some random files that I would like to collect and forward to my logging server. These are applications that don't really support GELF, so I am trying to forward these files with rsyslog: # ...