rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

0
votes
1answer
12 views

Rsyslog failed to start CentOS 6.6 Final

I'm getting the following error message when trying to run: service rsyslog restart # service rsyslog restart : command not foundlog: line 2: : command not foundlog: line 3: : command not ...
0
votes
0answers
24 views

Run a script if an error in syslog appears

Is it possible to run a shell script if a specified string is found in rsyslog 5.8.11? I couldn't find any examples so I tried this but it doesn't work: $Template MyAlert,":msg" :msg, contains, ...
0
votes
2answers
32 views

Send all linux logs to remote rsyslog and store in original file name

I know there are alot of topics like this one but i have a particular need: I need to send all the logs from linux servers to a central loggin server. Problem 1: On the central server i need to store ...
0
votes
1answer
20 views

Restarting rsyslog for zimbra servers

I want to forward my zimbra.log to my log collector server. But Im quite worried about restarting rsyslog process because im not sure if it will affect the zimbra mta itself. Thanks,
0
votes
1answer
32 views

Syslog logging to syslog.1 not syslog

My syslog file is getting a bit unmanageable. I believed I had configured this previously to rotate daily but obviously something has gone amiss. At the moment, my /var/log looks like this: ...
0
votes
0answers
20 views

Sending RFC5452 messages to /dev/log

I would like to be able to send a RFC5452-format message to rsyslog using the /dev/log socket. I've tried a number of variations on the following: echo "<29>1 2003-10-11T22:14:15Z ...
2
votes
1answer
29 views

Amazon Linux rsyslog config override

I am using Amazon Linux AMI release 2015.03, I am trying to configure rsyslog to redirect logs to a remote logging server (in this case, logstash) by dropping a conf file in /etc/rsyslog.d. The ...
2
votes
1answer
101 views

Forwarding structured data with rsyslog

We have a Java application logging structured data (MDC with log4j) via syslog to rsyslog (7.6.3) on localhost. localhost should then forward these log messages to a central logging host (also running ...
0
votes
0answers
28 views

rsyslog syntax error on non existent line

I get a syntax error message for my rsyslog configuration file at line 61. But my configuration only got 60 lines. I checked the last line in my configuration and it seems correct since it is the ...
0
votes
2answers
44 views

rsyslog (local) and remote logging

I have several linux servers that I want to monitor the log files. I thought it would be great to setup a central log server that can capture incoming rsyslog packets. Each hostname would have its own ...
1
vote
0answers
12 views

rsyslog Email On SSH/SFTP Login Fails

I have tried the following on my Nginx server, but do not get any emails upon SSH (or SFTP) login. I put this code in /etc/rsyslog.d/notify.conf and have ensured this file is being called by ...
0
votes
0answers
20 views

logger not logging to remote rsyslogd instance

I am running CentOS 7.0.1406 with rsyslogd 7.4.7 and logger from util-linux 2.23.2. I have two machines connected via a switch. When I try to use logger to log from one machine to the other, nothing ...
0
votes
1answer
36 views

Redirecting syslog facility to other facility

I have a syslog server, which separates logging informations according to hostnames. It can separate messages if it's in the 'local1' facility. I have a mail server, which sends messages to the ...
1
vote
1answer
84 views

Apache errorlog piping fail

Trying to log to a central syslog server, either direct using Apache's ErrorLog to pipe to logger, or getting syslog to forward, but nothing is working and the errors are not making sense to me. I can ...
1
vote
1answer
128 views

Example syslog-ng configuration to replicate rsyslog filename & locations?

ng 3.6.3 from source compilation on CentOS 6.6 64bit to play with and was wondering if anyone has pointers or example syslog-ng.conf that would as close as possible replicate the default rsyslog ...
0
votes
0answers
23 views

rsyslog tcp packets containing multiple log messages

I have rsyslog receiving logs over udp and then relaying them over tcp to a load balance (nginx) which passes them along to SIEM collectors. The setup looks like this: network devices/appliances ...
0
votes
1answer
19 views

All system logs lack end of message newlines

We have a curious issue where all logs in /var/log/ lack a trailing new-lines at the end of their messages, and instead contain an n, but the entire file is one 'line': Jun 4 10:18:54 host ...
0
votes
0answers
12 views

Exclude HAproxy check from postfix log [duplicate]

I use HA Proxy to loadbalanced SMTP connection. Does it possible to exclude HAproxy check from postfix log ? This is a example of my mail.log : Jun 3 09:30:24 mail2 postfix/smtpd[6277]: connect ...
0
votes
0answers
14 views

rsync copy > server unreacheable

I'm using rsync to copy around 500GB of data (Nexus repositories). The idea is to run it every hour to backup the "delta" and in case of issues we can easily switch the disks. Now, for two days in a ...
0
votes
1answer
34 views

Client rsyslog and server in the same machine Ubuntu 14.04

I am wondering if I can make Rsyslog to receive logs from my own IP, I just want to test that the configurations work, right now I dont have access to another PC or Server, just my PC, in few words I ...
1
vote
1answer
62 views

What rsync options to use for the below mentioned scenario?

Greetings !!! This is regarding a specific requirement about rsync that we are trying to achieve. We have tried to achieve this by using various rsync options. However, we are encountering different ...
0
votes
0answers
47 views

Remote logging with rsyslog - Cannot load module lmnsd_gtls.so

I have 2 servers and an office NAS on which I want the two servers to dump their logs. Only 1 server is successfully logging to the NAS. The other server continues to produce this error message in ...
1
vote
3answers
1k views

What is the difference between syslog, rsyslog and syslog-ng?

I am a bit confused in syslog, rsyslog and syslog-ng. From where can I get the source code for syslog()? Is there any difference between rsyslog and rsyslogd?
0
votes
0answers
42 views

rsyslog not discarding despite rule to the contrary

I am running rsyslogd on a new CentOS 6.6 box. I have put in a custom rule to log my firewall messages (via firehol) to a separate file, as per instructions here: ...
1
vote
0answers
28 views

Unable to get structured data in logged messages even after adding mmpstrucdata and mmrfc5424addhmac?(RFC5424)

I am trying to log messages with structured data . But it is showing null value for structured data. I am working with rsyslog 8.9.0.Can someone tell me either i need to load some module or modify ...
0
votes
1answer
111 views

kernel.log stays empty: “rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.”

I'm on a VPS (Ubuntu 14.04.2 LTS, Kernel 3.13.0-042stab094.8, rsyslog 7.4.4-1ubuntu2.5) and kernel.log stays empty with only this line: rsyslogd: imklog: cannot open kernel log (/proc/kmsg): ...
0
votes
0answers
33 views

SFTP and rsyslog: log activities of specified users only?

After a lot of anguish, I finally managed to get chrooted SFTP logging working in Ubuntu 14.04. Relevant bits from /etc/ssh/sshd_config: Subsystem sftp internal-sftp Match Group sftp-only ...
0
votes
2answers
239 views

rsyslog with logrotate: reload rsyslog vs copytruncate

I'm working on Ubuntu 14 with the default rsyslog and logrotate utility. In the default rsyslog logrotate /etc/logrotate.d/rsyslog config I see the following: /var/log/syslog { rotate 7 ...
2
votes
1answer
123 views

rsyslog not writing log file after restart

First off, thanks for spending the time to have a look at this issue, its much appreciated. I've had the attached rsyslog.conf configuration running for sometime now until today when I had to restart ...
-1
votes
1answer
78 views

what is wrong with this rsyslog configuration?

I am trying to get rsyslog to log to the following custom log file /var/log/iptables.conf instead of syslog. Iptables has got logging enabled, here is an example log line outputted from iptables ...
1
vote
1answer
178 views

Squid cannot log to syslog

According to this documentation: http://www.squid-cache.org/Doc/config/access_log/ squid should be able to log to rsyslog with the following directives: access_log syslog:daemon.info squid cache_log ...
1
vote
0answers
93 views

How to figure out why some characters go missing in rsyslog -> logstash pipeline

I am trying to figure out why some messages received by logstash have some text missing from them. I am sending the logs from an Untangle NGFW (11.0 - licensed) to logstash so that I can keep ...
0
votes
0answers
34 views

Sftp Log for every Jailed User

I've a sshd_config file like the following: Match user foo ChrootDirectory /mnt/foo-jail/ ForceCommand internal-sftp AllowTCPForwarding no AuthorizedKeysFile ...
-4
votes
1answer
36 views

Is it possible to centralize files in a directory?

Is it possible to centralize files in a directory? Currently, I am only using a common verisions of rsyslog. I can set the imfile for single file but it doesn't seem to work for a directory of files. ...
0
votes
0answers
51 views

Why would kern.log stop logging after crash & reboot

Server: Ubuntu 12.04 I recently noticed that my servers kern.log had stopped logging. I've not separated iptables from the kern.log so it used to be very active, however recently it's been logging ...
1
vote
0answers
30 views

rsyslog regex global modifier

Many regex systems have the ability to set a global modifier to allow for multiple matches. Here's how it works in Javascript and Perl. /g Python is a little different Python doesn’t have a ...
1
vote
2answers
199 views

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
0
votes
1answer
97 views

rsyslogd not storing remote logging information

I have a rsyslogd on Ubuntu 14.0.1: $ModLoad imtcp $InputTCPServerRun 514 $template FILENAME,"/var/log/%fromhost%/syslog.log" *.* ?FILENAME If if run logger -p local0.crit -n 10.240.157.116 -u ...
0
votes
0answers
56 views

Rsyslog last line of old log retransmitted after log rotation

I have config setup on all my CentOS servers to forward all syslog messages to a Graylog server via rsyslog. In Graylog I have then configured streams to alert on the occurrence of certain message ...
1
vote
2answers
160 views

Unable to get Rsyslog structured data in syslog message

I am new to syslog module. I am trying to log messages with structured data by using this parameter in template. But it is showing null value for structured data. I am working with rsyslogd 5.8.11 ...
3
votes
1answer
82 views

How to configure Monit to alert me when anything appears in syslog

I want Monit to alert me if ANYTHING shows up in syslog - as anything in there would be abnormal. I've tried the following and I'm not receiving any alert emails when I manually add something to ...
1
vote
1answer
23 views

Possible to have FQDN in Debian Logfiles?

Is it possible to have instead the hostname the fqdn inside debian log files? Example: Now its: Mar 2 18:00:12 www rsyslogd: [origin software="rsyslogd" swVersion="5.8.11" x-pid="2442" ...
0
votes
0answers
293 views

sending tomcat catalina.out to syslog

we're on tomcat 6.4 on centos. I've been trying to get the catalina.out logs in tomcat to syslog. For reasons it's very important that I don't send the raw logs, they have to be tagged with OURTOMCAT: ...
0
votes
1answer
55 views

rsyslogd and FQDN - cannot get FQDN from clients

I setup a syslogserver with rsyslogd and 3 clients. Logs from 3 test clients are sent to the server, so far so good. My Problem is: I can't get the FQDN hostnames to work. According to rsyslog.com ...
1
vote
1answer
133 views

configure and test rsyslog to UDP socket

I am trying to use https://github.com/gliderlabs/logspout so I can see all the logs from my containers in one place. I need rsyslog to listen on UDP socket on port 514. I uncommitted $ModLoad imudp ...
0
votes
1answer
165 views

Using rsyslog with TLS without generating a self signed cert

Just about every guide I have seen for using TLS with rsyslog involves generating a self signed cert and using that. If the boxes are already set up with a legit signed cert how do you set up the ...
1
vote
1answer
75 views

Rsyslog refuses to log over OpenVPN

I'm trying to forward rsyslog from a client to a server over a VPN. I have it working across an internet link already (through eth0 to an edge router) but would like it to go through the OpenVPN ...
0
votes
1answer
186 views

How to replace control characters in rsyslog

we have several (usually java) application and they log to centralized rsyslog server (version 7.6). We had problems with java exceptions as rsyslog was handling each line of stack trace as separate ...
0
votes
1answer
140 views

Writing to Unix Domain Socket from rsyslog

I want to write output messages from rsyslog to a Unix Domain Socket. I want to do this so that I can read the messages from that socket using my script and parse log messages further. I try to use ...
0
votes
1answer
161 views

Suppressing rsyslog tls error messages

When configuring rsyslog with tls and using PermittedPeer or streamdriver.authmode name, if an unauthorized peer connects, rsyslog logs error messages like below. Jan 22 08:56:38 test rsyslogd-2089: ...