rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

0
votes
0answers
10 views

Rsyslog queues and performance impacts

Having recently had a network failure that caused a major cascading series of other issues, I've been diving into our rsyslog.conf to try identify opportunities for more stable deployment. We have ...
3
votes
1answer
75 views

How do I configure rsyslog to deal with MySQL Slow Query Log multi-line messages?

Using rsyslog v8.2.2, I would like to group multi-line messages, such as those output by the MySQL Slow Query log. Each new message begins with three consecutive lines having '#' as the first char of ...
1
vote
1answer
20 views

TCP rsyslogd events showing up as 2000 character continuations

I'm taking syslog events from a proprietary app. This could be the app's fault or it could be rsyslogd. Events are written like: Aug 15 16:00:00 10.11.12.13 Event1 from this wonderful product using ...
2
votes
2answers
44 views

Using (r)syslog's dynamic file generation

I am in the middle of configuring a (r)syslog server as a remote server that receives logs from various clients. I wonder whether there is a nicer way to dynamically generate multiple file names as ...
1
vote
1answer
61 views

Forward linux logs to fluentd on linux

On one VM I have this in /etc/rsyslog.d/50-default.conf *.* @192.168.29.1:42185 # Default rules for rsyslog. On the vm with fluentd I have this: I have this in /etc/td-agent/td-agent.conf ...
0
votes
0answers
11 views

One rsyslog machine accepting encrypted and non encrypted logs on different ports

I'm trying to setup an rsyslog server to accept input from 2 different ports, one encrypted for our non internal servers, and one open for our internal servers. The reason for needing this is that ...
0
votes
0answers
19 views

Group Ownership in rsyslog?

What I would like would be to have all remote local7 facilities logged to: /var/log/cisco.log but the ownership needs to be under the group "cisco" in /etc/rsyslog.conf I have: # Logs for cisco ...
2
votes
1answer
26 views

IPTables custom log failing

I'm currently trying to split out some of my IPTables logging from kern.log into a file called iptables.log. Basically, I have several different adapters and I'm logging requests to port 80 on each ...
3
votes
1answer
197 views

Difference between /dev/udp and netcat

I have a syslog server listening on localhost:514 as UDP and would like to write messages to it on that port. (Using Ubuntu 14.04) If I run either of these commands this from bash it prints the date ...
2
votes
1answer
23 views

Remote logging to specific directory structure with rsyslog

I'm currently in the process of having all of our various servers send their syslog messages to a central server. I'd like to have the following directory structure on the central server that logs ...
0
votes
0answers
19 views

rsyslog not writing remote host messages to specific file

I have the following in my rsyslog.conf file on my ubuntu 14.04 logging server: if $fromhost-ip = '192.168.10.37' then /var/log/netgear/switch.log I have changed the owner to be syslog adm 0 ...
0
votes
1answer
50 views

Configuring MariaDB to log to mysql.log using rsyslog

I'm a little stumped - there is something obvious I'm missing here. Recently I made the switch from mySQL to mariaDB. Everything is working so far - except for the logging, as I realized today. All ...
0
votes
0answers
60 views

Proper rsyslog configuration

I'm trying to setup a syslog server but it doesn't appear to be working as intended. My client does not seem to be logging to it. Server Ubuntu 12.04 (192.168.1.10) Client Ubuntu 14.04 ...
2
votes
0answers
102 views

Rsyslog: discarding specific messages, rate limiting

I've got netatalk installed on the server and afpd is spamming system logs with the following error: Jun 24 15:38:16 TEST afpd[21532]: sys_getextattr_size: error: Operation not supported I'm not ...
0
votes
0answers
103 views

Setup CENTOS Centralized AUDIT and RSYSLOG server

Attempting to use these links: Sending audit logs to SYSLOG server or http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log I have been unable to get centralized AUDIT logging to work on my ...
1
vote
0answers
70 views

Receiving Apache access and error logs via rsyslog and possible catchall filter

I'm new to rsyslog and have been trying to figure out why I am not receiving any of my Apache and mysql logs which are configured on the client-side to sent via rsyslog. I am currently receiving all ...
1
vote
1answer
282 views

Sending logs to remote server with rsyslog

I'm trying to setup centralized logging with Logstash, Elasticsearch and Kibana and am having trouble getting logs to my log server. Logstash is listening on TCP 5000 and is successfully receiving ...
0
votes
0answers
102 views

rsyslog - How to flush queue?

I'm using rsyslog to get logs from haproxy and put them into logstash for elasticsearch/kibana. Everything was working ok, but i've found something strange in rsyslog. I've found that i've got ...
0
votes
0answers
256 views

How to forward arbitrary files to graylog2 with rsyslog

I have some random files that I would like to collect and forward to my logging server. These are applications that don't really support GELF, so I am trying to forward these files with rsyslog: # ...
0
votes
1answer
1k views

How do I configure rsyslog on Ubuntu 14.04 to use ISO8601 timestamps?

In a file in /etc/rsyslog.d/ I have the following: local3.* /var/log/mylog.log When I log to this facility, records have timestamps which look like this: Apr 27 21:12:20 hostname msg How ...
2
votes
0answers
35 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
0
votes
0answers
15 views

Rsyslog dynamic variables

I have a rsyslog config file for an application that filters logs as so: if $msg contains 'sid:31147' then ~ if $programname == 'myprog' then /var/log/myprog.log &~ The idea is that if the msg ...
2
votes
2answers
382 views

Rsyslog duplicate logs (rsyslog.conf and rsyslog.d/something.conf)

I've created a custom log (php sends log entries to rsyslog) using local0. It uses a new custom file (/var/log/sea.log). The problem is that logs are being sent to /var/log/sea.log , ...
2
votes
1answer
320 views

Different permissions per log file when using rsyslog

Is it feasible to define different permissions per log file, using rsyslog? $FileCreateMode applies to all, but I want different permissions for a specific file.
0
votes
0answers
41 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
1
vote
2answers
80 views

Rsyslog filter by client

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side. I added this line ...
1
vote
1answer
73 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
0
votes
1answer
150 views

How to use rsyslog to log files from client to server

I've setup an rsyslog server which accepts log information from clients. I can successfully receive syslog messages however I'm interested in logging a number of files too. Here is what my client ...
1
vote
0answers
92 views

Redirecting app log to rsyslog in upstart script

I have an upstart script that does the following start on runlevel [2345] stop on runlevel [06] respawn pre-start script exec >/dev/kmsg 2>&1 REPO=git@github.com:blabla/bli ...
0
votes
2answers
239 views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...
1
vote
2answers
369 views

Trying to convert syslog-ng to rsyslog

I'me trying to get nginx to log direct to piwik. I am having problems getting rsyslog to accecpt some syslog-ng syntax. The rsyslog doc says syslog-ng conf is compatible with it. source s_nginx_20 { ...
1
vote
1answer
54 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
0
votes
1answer
135 views

Converting to rsyslog v7 new config format

I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy ...
0
votes
1answer
69 views

Syslog and LogAnalyzer - how to retrive source IPs and count them

I have set centralized Syslog (centOS + rsys) server which runs LogAnalyzer for better log presentation. Recently I have got asked to provide logs from the firewall of all IPs for particular firewall ...
1
vote
0answers
50 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
1
vote
1answer
245 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
0
votes
1answer
269 views

Forwarding from rsyslog to syslog-ng over TCP not working (although packets are reaching server)

We use syslog-ng on our central syslog server (syslog-ng-2.1.4-9.el5 on CentOS 5.9). We were happily sending logs using syslogd and rsyslog from a mixture of Linux and Solaris hosts over UDP until ...
0
votes
0answers
172 views

rsyslogd not monitoring all files in config file

I am not seeing rsyslog pick up all files I am trying to monitor. I am using the standard config from Ubuntu 12.04 LTS but am adding the contents below to /etc/rsyslog.d/30-logentries.conf. I ...
0
votes
0answers
94 views

Writing vsftpd logs to a database

I found this useful post relating this topic: http://www.supertom.com/code/vsftpd_mysql_syslog_configuration.html Unfortunately it is not a tutorial but kind of a notepad for the author. After some ...
1
vote
1answer
123 views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
0
votes
2answers
112 views

Find syslog priortiy/ severity of a message

Is there a way to find the syslog priority or severity of log entries using a standard unix tool? For example I could grep for the word error in a log. But not all logs will state the word "error" ...
3
votes
2answers
1k views

rsyslog does not write remote messsages to log file from specific host

I have setup an rsyslog server (based on CentOS 6) that works fine with some remote hosts. But, when I added a Cisco ASA firewall, it does log its messages! The rsyslog.conf is the following: # ...
0
votes
1answer
171 views

rsyslog with variable input file name

I am running an apache server which is creating log files using rotatelogs. It creates a new file every day with the date appended to it (e.g. filename.yyyy.mm.dd format). I want to use rsyslog to ...
2
votes
1answer
100 views

%HOSTNAME% value is “unknown” in rsyslog template

The Gist Where does rsyslog get the value of %HOSTNAME% and under what conditions would "unknown" be the expected value? We're using rsyslog on an EC2 instance and we're trying to send our ...
1
vote
1answer
453 views

Centos syslog isn't logging to custom file from bash script

I'm trying to get a bash script to log to a custom log file using syslog on Centos release 6.5, but it always just logs to /var/log/messages like so: Jan 12 09:54:47 localhost nbsp: Test message ...
0
votes
0answers
59 views

What kind of messages are dropped when $OmitLocalLogging is on?

The new systemd journal was introduced some time ago. The following configuration is added in rsyslog to integrate this new module: $ModLoad imjournal # provides access to the systemd journal ...
1
vote
0answers
126 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
0
votes
1answer
483 views

rsyslog dynamic file filter

I'm trying to get my local /var/log/syslog file under control. My current structure is to log remote files to /var/log/juniper/syslog/%fromhost-ip%/syslog.log. Below are my configurations. ...
1
vote
1answer
70 views

Can I automate emailing of critical errors with systemd journal?

Fedora OS introduces journalctl as the new way to log error messages. I learn about this recently when I performed an upgrade. var/log/messages and many other log files are now combined into a ...
0
votes
2answers
48 views

how to prevent crontab logs from registring in syslog?

I have separate my crontab log into cron.log file by uncommenting the below ling in /etc/syslog.conf, But it register in syslog too. cron.* /var/log/cron.log How ...