rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

2
votes
0answers
12 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
0
votes
0answers
6 views

Rsyslog dynamic variables

I have a rsyslog config file for an application that filters logs as so: if $msg contains 'sid:31147' then ~ if $programname == 'myprog' then /var/log/myprog.log &~ The idea is that if the msg ...
2
votes
2answers
19 views

Rsyslog duplicate logs (rsyslog.conf and rsyslog.d/something.conf)

I've created a custom log (php sends log entries to rsyslog) using local0. It uses a new custom file (/var/log/sea.log). The problem is that logs are being sent to /var/log/sea.log , ...
2
votes
1answer
40 views

Different permissions per log file when using rsyslog

Is it feasible to define different permissions per log file, using rsyslog? $FileCreateMode applies to all, but I want different permissions for a specific file.
0
votes
0answers
15 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
1
vote
2answers
29 views

Rsyslog filter by client

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side. I added this line ...
1
vote
1answer
28 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
0
votes
1answer
29 views

How to use rsyslog to log files from client to server

I've setup an rsyslog server which accepts log information from clients. I can successfully receive syslog messages however I'm interested in logging a number of files too. Here is what my client ...
1
vote
0answers
34 views

Redirecting app log to rsyslog in upstart script

I have an upstart script that does the following start on runlevel [2345] stop on runlevel [06] respawn pre-start script exec >/dev/kmsg 2>&1 REPO=git@github.com:blabla/bli ...
0
votes
2answers
51 views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...
1
vote
1answer
76 views

Trying to convert syslog-ng to rsyslog

I'me trying to get nginx to log direct to piwik. I am having problems getting rsyslog to accecpt some syslog-ng syntax. The rsyslog doc says syslog-ng conf is compatible with it. source s_nginx_20 { ...
1
vote
1answer
25 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
0
votes
1answer
38 views

Converting to rsyslog v7 new config format

I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy ...
0
votes
1answer
28 views

Syslog and LogAnalyzer - how to retrive source IPs and count them

I have set centralized Syslog (centOS + rsys) server which runs LogAnalyzer for better log presentation. Recently I have got asked to provide logs from the firewall of all IPs for particular firewall ...
1
vote
0answers
11 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
1
vote
1answer
47 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
0
votes
1answer
39 views

Forwarding from rsyslog to syslog-ng over TCP not working (although packets are reaching server)

We use syslog-ng on our central syslog server (syslog-ng-2.1.4-9.el5 on CentOS 5.9). We were happily sending logs using syslogd and rsyslog from a mixture of Linux and Solaris hosts over UDP until ...
0
votes
0answers
47 views

rsyslogd not monitoring all files in config file

I am not seeing rsyslog pick up all files I am trying to monitor. I am using the standard config from Ubuntu 12.04 LTS but am adding the contents below to /etc/rsyslog.d/30-logentries.conf. I ...
0
votes
0answers
34 views

Writing vsftpd logs to a database

I found this useful post relating this topic: http://www.supertom.com/code/vsftpd_mysql_syslog_configuration.html Unfortunately it is not a tutorial but kind of a notepad for the author. After some ...
1
vote
1answer
78 views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
0
votes
2answers
57 views

Find syslog priortiy/ severity of a message

Is there a way to find the syslog priority or severity of log entries using a standard unix tool? For example I could grep for the word error in a log. But not all logs will state the word "error" ...
2
votes
2answers
378 views

rsyslog does not write remote messsages to log file from specific host

I have setup an rsyslog server (based on CentOS 6) that works fine with some remote hosts. But, when I added a Cisco ASA firewall, it does log its messages! The rsyslog.conf is the following: # ...
0
votes
1answer
53 views

rsyslog with variable input file name

I am running an apache server which is creating log files using rotatelogs. It creates a new file every day with the date appended to it (e.g. filename.yyyy.mm.dd format). I want to use rsyslog to ...
2
votes
1answer
40 views

%HOSTNAME% value is “unknown” in rsyslog template

The Gist Where does rsyslog get the value of %HOSTNAME% and under what conditions would "unknown" be the expected value? We're using rsyslog on an EC2 instance and we're trying to send our ...
1
vote
1answer
125 views

Centos syslog isn't logging to custom file from bash script

I'm trying to get a bash script to log to a custom log file using syslog on Centos release 6.5, but it always just logs to /var/log/messages like so: Jan 12 09:54:47 localhost nbsp: Test message ...
0
votes
0answers
32 views

What kind of messages are dropped when $OmitLocalLogging is on?

The new systemd journal was introduced some time ago. The following configuration is added in rsyslog to integrate this new module: $ModLoad imjournal # provides access to the systemd journal ...
1
vote
0answers
67 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
0
votes
1answer
180 views

rsyslog dynamic file filter

I'm trying to get my local /var/log/syslog file under control. My current structure is to log remote files to /var/log/juniper/syslog/%fromhost-ip%/syslog.log. Below are my configurations. ...
1
vote
1answer
58 views

Can I automate emailing of critical errors with systemd journal?

Fedora OS introduces journalctl as the new way to log error messages. I learn about this recently when I performed an upgrade. var/log/messages and many other log files are now combined into a ...
0
votes
2answers
36 views

how to prevent crontab logs from registring in syslog?

I have separate my crontab log into cron.log file by uncommenting the below ling in /etc/syslog.conf, But it register in syslog too. cron.* /var/log/cron.log How ...
0
votes
0answers
24 views

rsyslog Disable $RepeatedMsgReduction for specific filter

I have the following in my rsyslog configuration. It works well. :msg, contains, "<switch2>" /var/log/switch.log & ~ I need to disable RepeatedMsgReduction for log messages that are ...
1
vote
2answers
72 views

Using Rsyslog to send application logs to syslog server

I'm trying to setup my rsyslog to send logs generated by an application under /opt/appname/logs to a remote syslog server. I have already configured rsyslog to send OS level logs but wanted to see if ...
1
vote
1answer
255 views

Rsyslogd config error

I have this rsyslog.conf file: # /etc/rsyslog.conf Configuration file for rsyslog. # # For more information see # /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html ...
1
vote
2answers
110 views

Log ssh sessions to rsyslog

How can I setup rsyslog to log commands typed in a ssh session? Just in case someone unauthorized ever accesses the system, I'd like to know what he did.
1
vote
1answer
64 views

Pipe program output to rsyslog

I have a process running that writes it's output to a file, like this. processx > /var/log/processx.log 2>&1 How would I write/pipe/forward this to rsyslog instead (including the ...
0
votes
2answers
353 views

Remove Iptables log from kern.log syslog messages

I'm having trouble with Iptables logs, i'm not able to get them out from kern.log, syslog and message files. I added two rules in rsyslog.conf which redirect my messages to an "iptables.log" file but ...
2
votes
1answer
125 views

How to prevent logging of duplicated error messages in rsyslog?

After performing a software update, I got hundreds of errors that read like this: 2013-11-11 19:00:00 err user audispd - queue is full - dropping event Not sure if this is a bug, but it is rapidly ...
0
votes
0answers
70 views

Rsyslog ommail module

Just recently updated rsyslog to send email alerts if a specific string is located in a $msg. The tests worked out fine, but after making the change to the correct string (error codes I'm looking to ...
2
votes
1answer
301 views

Forwarding rsyslog to syslog-ng, with FQDN and facility separation

I'm attempting to configure my rsyslog clients to forward messages to my syslog-ng log repository systems. Forwarding messages works "out of the box", but my clients are logging short names, not ...
1
vote
1answer
107 views

rsyslog forward all except ldap

I have Centos 6 servers running openLDAP. In the rsyslog.conf, I forward the logs to my central server with this line: *.* @10.10.10.10:514 openldap seems incredibly chatty. I have 3 servers in ...
0
votes
1answer
74 views

rsyslog logging path with custom property

I have an rsyslog server running v7.4.3 receiving a stream with the format: <PRI>Date hostname app: name=VALUE message What I need to do is pull the VALUE out of the message, and log it in a ...
3
votes
2answers
266 views

Properly Configured Rsyslog on CentOS

I'm trying to configure Rsyslog 5.8.10 on CentOS 6.4 to send Apache's error and access logs to a remote server. It's working, but I have a couple questions. A) I would like to use as few queues (and ...
0
votes
4answers
256 views

remote server log viewer/analyzer

I have an rsyslog server running Ubuntu 12.04 which stores logs from different clients also running Ubuntu 12.04. Now I want to view those logs from my machine which also runs Ubuntu 12.04. One way ...
0
votes
1answer
86 views

Centralized logging server failover

I'm planning a centralized log server for 200+ Linux boxes, rsyslog on both the client and server side. Here are my requirements: Do not log anything locally on Linux boxes and send everything to ...
3
votes
2answers
539 views

Rsyslog stops sending data to remote server after log rotation

In my configuration, I have rsyslog who is in charge of following changes of /home/user/my_app/shared/log/unicorn.stderr.log using imfile. The content is sent to another remote logging server using ...
0
votes
0answers
37 views

software to view logs on remote server [closed]

I have configured syslog server on my linux machine like this Linux Machine (syslog client) -- > Linux Machine (syslog server) I have configured it and its working properly. Now, the problem is I ...
1
vote
1answer
152 views

Getting logs from remote clients via rsyslog

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp ...
0
votes
0answers
28 views

rsyslog and multiple contains criteria

i'm trying to filter cisco asa firewall logs separately from the device logs. in short i'm trying to do something like: $template AsaFwLog,"/var/log/net/%$YEAR%/%$MONTH%/%$DAY%/asa.log" if $fromhost ...
5
votes
2answers
136 views

Best place in network to put syslog server for DMZ hosts?

I have a firewalled router that connects to two virtual Lans. The first lan is an administration network and the second a DMZ. My virtual machines in the DMZ need to send syslog messages to a syslog ...
2
votes
3answers
228 views

Logging doesn't work after rsyslog upgrade

I have several different django applications under apache on a Red Hat server. These applications use SysLogHandler for sending log messages to the local rsyslog service. In order to pipe log messages ...