rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.
1
vote
4answers
56 views
Rsyslog not logging from remote server
I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on ...
0
votes
1answer
34 views
Rsyslog: Difference between logging to a UNIX domain socket or an INET socket (UDP)
I am observing the following behaviour when logging to syslog from an external application: if I send a well-formed syslog message to a UDP socket, rsyslog correctly parses it, however if the very ...
2
votes
1answer
43 views
Wildcard support for InputFileName in rsyslog?
We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName?
Example:
InputFileName: ...
0
votes
0answers
48 views
funneling apache logs to syslog server
We are in an AWS environment and want to have all our web servers log to one logserver (also in the same AWS VPC). We want to stream all the Access Log data to the logserver I setup. The logserver ...
3
votes
1answer
38 views
Why Postfix on Linux require a “-” character before the pathname?
I´ve found the following here:
IMPORTANT: on Linux you need to put a "-" character before the pathname, e.g., -/var/log/maillog, otherwise the syslogd process will use more system resources than ...
0
votes
0answers
12 views
Rsyslog related query
I have configured my system to put syslog to a remote machine. The logging is heavy and I am running out of memory. so I want to filter it based on priority for example log only error message. I see ...
0
votes
1answer
69 views
Errors using new rsyslog template syntax on RHEL6
I'm migrating our rsyslog config from an old server to a new one, and thought I'd use the opportunity to tidy up our config. The old config used "legacy" template definitions, and the rsyslog doc on ...
0
votes
3answers
43 views
Remote Apache Logging
I have been researching remote logging of apache logs, and everything I have found involves piping to logger.
Two questions:
1) Is there any other way to remotely log apache logs?
2) Is piping to ...
0
votes
1answer
39 views
rsyslog - assigning a modified property to a cee variable
So I'm going nuts trying to get a sortable timestamp from rsyslog into a CEE variable which will go to ElasticSearch. Right now I'm using:
set $!tgen = $timegenerated;
from which the field looks ...
0
votes
1answer
37 views
imported log into rsyslog not sent to remote server when rotated
So right now I have a bunch of production servers, and I setup remote logging through rsyslog to our staging servers. For anything actually logged through rsyslog it works fine (Even when rotated) but ...
0
votes
1answer
37 views
Can Rsyslog process messages before saving them?
The messages that I'm sending to syslog have some tags like so:
"[date] [text here] tags:tag1,tag2,tag3 [more text here]"
I already have a rule that only saves lines that contain the text "tags:" ...
2
votes
1answer
55 views
firewall output flooding dmesg
I log all dropped packets using following iptables rule:
-A INPUT -j LOG --log-prefix "FW_DROP: " --log-level 7
and then in rsyslog.conf, I redirect this output to a separate file, so that my ...
0
votes
1answer
70 views
haproxy not logging
I have configured rsyslog (CentOS 6.3) adding the -c 0 -r options and the line local2.* /var/log/haproxy.log and restarted rsyslog but all that happens is an haproxy.log gets created. It is never ...
0
votes
0answers
31 views
Rsyslog Output Files - Reload on Rotate?
Good morning,
I'm new to everything sysadmin.
I"m trying to set a few server processes to log to rsyslog (for future shipping abilities, etc.), but want to have clean log files on my local machine ...
0
votes
2answers
125 views
rsyslog Text File Input Module error
I'm using:
root@u1210: /etc () # lsb_release -d
Description: Ubuntu 12.10
root@u1210: /etc () # dpkg -l | grep rsyslog
ii rsyslog 5.8.6-1ubuntu9 ...
0
votes
0answers
22 views
Rsyslog Daemon Uclinux [closed]
I am working on a project which includes porting of uclinux on coldfire(M5272C3).My basic uclinux is working right now. I need to add rsyslog daemon in uclinux for logging. I thought of 3 ways of ...
0
votes
0answers
107 views
Rsyslog Template To Translate Apache Error Logs to JSON
I am trying to use rsyslog to translate the format of Apache error logs into JSON for sending to a central logging facility.
In Apache 2.2 it is not possible to change the error log's format. The ...
0
votes
1answer
90 views
How should I rotate rsyslog documents stored in mysql
I have setup rsyslog to dump syslog data into mysql so that LogAnalyzer can easily access and interact with it.
How do I automate a job to remove syslog data of a certain age for the mysql database ...
0
votes
1answer
215 views
why is stunnel doing this
I am trying to setup stunnel to encrypt traffic from rsyslog (using the relp protocol), but whenever I try starting stunnel and sending logs to the remote server, i get the following:
Remote ...
2
votes
1answer
92 views
rsyslog starttls ssl
I'm trying to test a setup of rsyslog that uses ssl. I'm (perhaps mis)-understanding that if I use starttls for the ssl traffic, I should be able to receive both ssl and plain syslog traffic on the ...
0
votes
2answers
70 views
Using rsyslogd on only 1 of 2 systems
I have two systems. One is a laptop and has rsyslog. The other is embedded system that doesn't have rsyslog. What I'd like to do is log messages from the embedded system on the laptop.
I've ...
0
votes
0answers
25 views
rsyslog change msg property to new value
I have this rsyslog configuration:
$template f_x,"/path/%programname%.%$YEAR%%$MONTH%%$DAY%%$HOUR%.log"
if $programname == 'xyz' and $msg contains 'Hello World' or $msg contains 'FATAL'
...
1
vote
0answers
32 views
Why empty fields in Rsyslog?
In our Rsyslog database, we are using rsyslog version 5.8.6, we have so many empty fields for some columns, for example, EventBinaryData, EventSource, EventUser, EventCategory, all these fields are ...
0
votes
0answers
57 views
Filter rsyslog message by message id?
I'm trying to filter out some windows logs, that from program named Security-Auditing and with a message id 4624, but it doesn't work:
if $programname == 'Security-Alert' and $msgid == '4624' then ...
1
vote
0answers
57 views
Writing templates for rsyslog
When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
0
votes
1answer
91 views
rsyslog: “-” prepended to action path / ftp.* does not log
following config rules:
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* ...
0
votes
1answer
53 views
Monitor application log files with variable names with rsyslog
I have an application on linux that puts randomly (truly randomly, not following any pattern) named log files in /opt/application/logs.
I need to read all these files with rsyslog and forward their ...
0
votes
0answers
226 views
Receiving remote logs and forwarding to logstash syslog plugin
I've setup rsyslog server and remote machines ie: vmware esxi send logs to this server.
My Problem is: vmware logs not are forwarded to logstash server
My rsyslog.conf:
# logs from vmware to ...
1
vote
1answer
36 views
What does “-/filepath” ACTION mean in rsyslog configuration
I came across this one Debian Linux installation (6.0.6), and examining its /etc/rsyslog.conf, I see configuration lines like this:
auth,authpriv.* /var/log/auth.log
...
2
votes
1answer
100 views
Rsyslog messages are truncated, not sent to the correct file
On Ubuntu 10.04 LTS, I'm using the stock rsyslog configuration and added a custom file in /etc/rsyslog.d with the following contents:
# cat /etc/rsyslog.d/62-pc
local3.debug /var/log/pc/debug.log
...
2
votes
2answers
190 views
rsyslog - regex trouble
I'm trying to setup the logentries service. If a log entry has a token in it then I would like to send it to api.logentries.com:10000. The token is a guid in the format ...
1
vote
1answer
239 views
Restarting rsyslog re-sends logs again
I am running Ubuntu 12.04.1 LTS on EC2. I have a bunch of application servers which are configured to forward their logs to a central server via rsyslog.
Since putting in Nagios monitoring on the ...
0
votes
0answers
141 views
Apache multiple vhost logs, stored locally and sent to remote logstash
I'm investigating centralised logging and it seems there's so many different ways this can be done.
I don't want to run logstash as a log "sender", preferring to keep the web servers as lean and ...
3
votes
2answers
510 views
CentOS centralised logging, syslogd, rsyslog, syslog-ng, logstash sender?
I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc.
I've found a few different options but I'm not sure what would be best. ...
1
vote
0answers
75 views
What's wrong with this rsyslog rule?
I'm trying to handle part of a log with a program:
if $programname == 'Security-Alert' then |/usr/local/bin/handler
The handler script works if I call echo blabla | /usr/local/bin/handler.
Now I ...
1
vote
2answers
361 views
Rsyslogd not listening on port
I installed rsyslogd on ubuntu server, started it and everything looks fine, but the port the server should listen on is not opened.
ubuntu@node7:~$ sudo service rsyslog restart
rsyslog stop/waiting
...
0
votes
1answer
66 views
Hosts.deny file not being updated by denyhost service
I have denyhosts running on my server to block IPs that repeated fail to login over ssh, for example brute force style attacks. I can see that entries in the auth.log file have not been updated in the ...
4
votes
2answers
380 views
rsyslogd not monitoring all files
So.. I've installed Logstash, and instead of using the logstash shipper (because it needs the JVM and is generally massive), I'm using rsyslogd with the following configuration.
# Use traditional ...
2
votes
1answer
39 views
How to configure syslogd name/identifier?
I'm forwarding all syslog events to papertrailapp.com, and they are identified as sent by localhost. It's not convenient, since I have a few servers and all of them are localhost-s. How can I ...
0
votes
1answer
76 views
How to forward postfix event logging to an http endpoint?
I would like to monitor postfix with a tool I wrote my self, I need to do it live right after sending, my optimal solution will be somehow make postfix send it's events to a logging system other then ...
0
votes
1answer
167 views
imuxsock messages in syslog and system becomes unresponsive
I am getting such messages in syslog.
rsyslogd-2177: imuxsock lost 21869 messages from pid 3418 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 3427 due to rate-limiting
...
3
votes
2answers
424 views
How to redirect third party logs to log server in Centos
I want to setup a simple log server to accept logs from all clients. I am not talking about standard system logs such as /var/log/mail , message, boot etc. I want to redirect or send application logs ...
2
votes
1answer
207 views
Remote rsyslog only writing logging data to /var/log/syslog and not custom logfiles
I'm having a problem setting up rsyslog to log remote logging data to a specific file. I have two Windows Server 2008 boxes that each have a C# application using NLog.Targets.Syslog which log their ...
1
vote
0answers
68 views
rsyslogd RepeatedMsgReduction on a per-facility basis
I am using rsyslogd to remotely log certain facilities. Repeated message reduction plays havok with the logserver filters, due to loss of information.
I see that I can disable $RepeatedMsgReduction ...
0
votes
1answer
185 views
rsyslog. Filter doesn't work
I use ubuntu-server. I try to set filter in my rsyslog.conf for accepting only remote logs from my D-link.
that is debug
Debug line with all properties:
FROMHOST: 'fromname', fromhost-ip: ...
0
votes
1answer
212 views
Rsyslog Central Server Log Rotation File/Folder Permission
I have setup a CentOS 6.3 box to collect logs from a few devices, I have log rotation setup for each host. Basically It rotates the log file by Year, Month, Day and the Host.
Everything works great ...
0
votes
1answer
65 views
Compiling rsyslog with zlib
I'm trying to compile rsyslog but it fails with
CC rsyslogd-smtradfwd.o
CC rsyslogd-iminternal.o
CC rsyslogd-pidfile.o
CCLD rsyslogd
...
1
vote
1answer
238 views
Ubuntu syslog: After log rotation nothing is written on /var/log/syslog
I've been running a Ubuntu VPS for a few weeks now, so a couple of monthly log rotations took place yestarday. For things like /var/log/wtmp things look as expected: logfile has recent entries, while ...
2
votes
0answers
53 views
Why don't cfn-init logs get sent by rsyslog?
I just signed up for Papertrail to aggregate logs from some AWS instances I'm setting up with CloudFormation::Init. I've followed the instructions and added *.* @logs.papertrailapp.com to the end of ...
1
vote
2answers
394 views
Forward Windows Events Logs to Rsyslog
I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on.
Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
