rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

0
votes
2answers
17 views

rsyslog (local) and remote logging

I have several linux servers that I want to monitor the log files. I thought it would be great to setup a central log server that can capture incoming rsyslog packets. Each hostname would have its own ...
0
votes
0answers
3 views

rsyslog Email On SSH/SFTP Login Fails

I have tried the following on my Nginx server, but do not get any emails upon SSH (or SFTP) login. I put this code in /etc/rsyslog.d/notify.conf and have ensured this file is being called by ...
0
votes
0answers
10 views

logger not logging to remote rsyslogd instance

I am running CentOS 7.0.1406 with rsyslogd 7.4.7 and logger from util-linux 2.23.2. I have two machines connected via a switch. When I try to use logger to log from one machine to the other, nothing ...
0
votes
0answers
14 views

How to send rsyslog to graylog?

Hi I have just configured GrayLog Now I want to transport my Linux-Client log to GrayLog. How can I do that? I tried with allowing TCP:514 in /etc/rsyslog.conf and on the client I have added this ...
0
votes
1answer
31 views

Redirecting syslog facility to other facility

I have a syslog server, which separates logging informations according to hostnames. It can separate messages if it's in the 'local1' facility. I have a mail server, which sends messages to the ...
1
vote
1answer
41 views

Apache errorlog piping fail

Trying to log to a central syslog server, either direct using Apache's ErrorLog to pipe to logger, or getting syslog to forward, but nothing is working and the errors are not making sense to me. I can ...
1
vote
1answer
72 views

Example syslog-ng configuration to replicate rsyslog filename & locations?

ng 3.6.3 from source compilation on CentOS 6.6 64bit to play with and was wondering if anyone has pointers or example syslog-ng.conf that would as close as possible replicate the default rsyslog ...
0
votes
0answers
14 views

rsyslog tcp packets containing multiple log messages

I have rsyslog receiving logs over udp and then relaying them over tcp to a load balance (nginx) which passes them along to SIEM collectors. The setup looks like this: network devices/appliances ...
0
votes
1answer
17 views

All system logs lack end of message newlines

We have a curious issue where all logs in /var/log/ lack a trailing new-lines at the end of their messages, and instead contain an n, but the entire file is one 'line': Jun 4 10:18:54 host ...
0
votes
0answers
12 views

Exclude HAproxy check from postfix log [duplicate]

I use HA Proxy to loadbalanced SMTP connection. Does it possible to exclude HAproxy check from postfix log ? This is a example of my mail.log : Jun 3 09:30:24 mail2 postfix/smtpd[6277]: connect ...
0
votes
0answers
12 views

rsync copy > server unreacheable

I'm using rsync to copy around 500GB of data (Nexus repositories). The idea is to run it every hour to backup the "delta" and in case of issues we can easily switch the disks. Now, for two days in a ...
0
votes
1answer
29 views

Client rsyslog and server in the same machine Ubuntu 14.04

I am wondering if I can make Rsyslog to receive logs from my own IP, I just want to test that the configurations work, right now I dont have access to another PC or Server, just my PC, in few words I ...
1
vote
1answer
52 views

What rsync options to use for the below mentioned scenario?

Greetings !!! This is regarding a specific requirement about rsync that we are trying to achieve. We have tried to achieve this by using various rsync options. However, we are encountering different ...
0
votes
0answers
30 views

Remote logging with rsyslog - Cannot load module lmnsd_gtls.so

I have 2 servers and an office NAS on which I want the two servers to dump their logs. Only 1 server is successfully logging to the NAS. The other server continues to produce this error message in ...
0
votes
3answers
439 views

What is the difference between syslog, rsyslog and syslog-ng?

I am a bit confused in syslog, rsyslog and syslog-ng. From where can I get the source code for syslog()? Is there any difference between rsyslog and rsyslogd?
0
votes
0answers
35 views

rsyslog not discarding despite rule to the contrary

I am running rsyslogd on a new CentOS 6.6 box. I have put in a custom rule to log my firewall messages (via firehol) to a separate file, as per instructions here: ...
0
votes
0answers
20 views

Unable to get structured data in logged messages even after adding mmpstrucdata and mmrfc5424addhmac?(RFC5424)

I am trying to log messages with structured data . But it is showing null value for structured data. I am working with rsyslog 8.9.0.Can someone tell me either i need to load some module or modify ...
0
votes
1answer
73 views

kernel.log stays empty: “rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.”

I'm on a VPS (Ubuntu 14.04.2 LTS, Kernel 3.13.0-042stab094.8, rsyslog 7.4.4-1ubuntu2.5) and kernel.log stays empty with only this line: rsyslogd: imklog: cannot open kernel log (/proc/kmsg): ...
0
votes
0answers
28 views

SFTP and rsyslog: log activities of specified users only?

After a lot of anguish, I finally managed to get chrooted SFTP logging working in Ubuntu 14.04. Relevant bits from /etc/ssh/sshd_config: Subsystem sftp internal-sftp Match Group sftp-only ...
0
votes
2answers
124 views

rsyslog with logrotate: reload rsyslog vs copytruncate

I'm working on Ubuntu 14 with the default rsyslog and logrotate utility. In the default rsyslog logrotate /etc/logrotate.d/rsyslog config I see the following: /var/log/syslog { rotate 7 ...
2
votes
1answer
92 views

rsyslog not writing log file after restart

First off, thanks for spending the time to have a look at this issue, its much appreciated. I've had the attached rsyslog.conf configuration running for sometime now until today when I had to restart ...
-1
votes
1answer
65 views

what is wrong with this rsyslog configuration?

I am trying to get rsyslog to log to the following custom log file /var/log/iptables.conf instead of syslog. Iptables has got logging enabled, here is an example log line outputted from iptables ...
1
vote
1answer
131 views

Squid cannot log to syslog

According to this documentation: http://www.squid-cache.org/Doc/config/access_log/ squid should be able to log to rsyslog with the following directives: access_log syslog:daemon.info squid cache_log ...
1
vote
0answers
77 views

How to figure out why some characters go missing in rsyslog -> logstash pipeline

I am trying to figure out why some messages received by logstash have some text missing from them. I am sending the logs from an Untangle NGFW (11.0 - licensed) to logstash so that I can keep ...
0
votes
0answers
32 views

Sftp Log for every Jailed User

I've a sshd_config file like the following: Match user foo ChrootDirectory /mnt/foo-jail/ ForceCommand internal-sftp AllowTCPForwarding no AuthorizedKeysFile ...
-4
votes
1answer
35 views

Is it possible to centralize files in a directory?

Is it possible to centralize files in a directory? Currently, I am only using a common verisions of rsyslog. I can set the imfile for single file but it doesn't seem to work for a directory of files. ...
0
votes
0answers
37 views

Why would kern.log stop logging after crash & reboot

Server: Ubuntu 12.04 I recently noticed that my servers kern.log had stopped logging. I've not separated iptables from the kern.log so it used to be very active, however recently it's been logging ...
1
vote
0answers
26 views

rsyslog regex global modifier

Many regex systems have the ability to set a global modifier to allow for multiple matches. Here's how it works in Javascript and Perl. /g Python is a little different Python doesn’t have a ...
1
vote
2answers
176 views

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
0
votes
1answer
83 views

rsyslogd not storing remote logging information

I have a rsyslogd on Ubuntu 14.0.1: $ModLoad imtcp $InputTCPServerRun 514 $template FILENAME,"/var/log/%fromhost%/syslog.log" *.* ?FILENAME If if run logger -p local0.crit -n 10.240.157.116 -u ...
0
votes
0answers
52 views

Rsyslog last line of old log retransmitted after log rotation

I have config setup on all my CentOS servers to forward all syslog messages to a Graylog server via rsyslog. In Graylog I have then configured streams to alert on the occurrence of certain message ...
1
vote
2answers
130 views

Unable to get Rsyslog structured data in syslog message

I am new to syslog module. I am trying to log messages with structured data by using this parameter in template. But it is showing null value for structured data. I am working with rsyslogd 5.8.11 ...
3
votes
1answer
68 views

How to configure Monit to alert me when anything appears in syslog

I want Monit to alert me if ANYTHING shows up in syslog - as anything in there would be abnormal. I've tried the following and I'm not receiving any alert emails when I manually add something to ...
1
vote
1answer
22 views

Possible to have FQDN in Debian Logfiles?

Is it possible to have instead the hostname the fqdn inside debian log files? Example: Now its: Mar 2 18:00:12 www rsyslogd: [origin software="rsyslogd" swVersion="5.8.11" x-pid="2442" ...
0
votes
0answers
261 views

sending tomcat catalina.out to syslog

we're on tomcat 6.4 on centos. I've been trying to get the catalina.out logs in tomcat to syslog. For reasons it's very important that I don't send the raw logs, they have to be tagged with OURTOMCAT: ...
0
votes
1answer
48 views

rsyslogd and FQDN - cannot get FQDN from clients

I setup a syslogserver with rsyslogd and 3 clients. Logs from 3 test clients are sent to the server, so far so good. My Problem is: I can't get the FQDN hostnames to work. According to rsyslog.com ...
1
vote
1answer
111 views

configure and test rsyslog to UDP socket

I am trying to use https://github.com/gliderlabs/logspout so I can see all the logs from my containers in one place. I need rsyslog to listen on UDP socket on port 514. I uncommitted $ModLoad imudp ...
0
votes
1answer
114 views

Using rsyslog with TLS without generating a self signed cert

Just about every guide I have seen for using TLS with rsyslog involves generating a self signed cert and using that. If the boxes are already set up with a legit signed cert how do you set up the ...
1
vote
1answer
67 views

Rsyslog refuses to log over OpenVPN

I'm trying to forward rsyslog from a client to a server over a VPN. I have it working across an internet link already (through eth0 to an edge router) but would like it to go through the OpenVPN ...
0
votes
1answer
153 views

How to replace control characters in rsyslog

we have several (usually java) application and they log to centralized rsyslog server (version 7.6). We had problems with java exceptions as rsyslog was handling each line of stack trace as separate ...
0
votes
1answer
114 views

Writing to Unix Domain Socket from rsyslog

I want to write output messages from rsyslog to a Unix Domain Socket. I want to do this so that I can read the messages from that socket using my script and parse log messages further. I try to use ...
0
votes
1answer
140 views

Suppressing rsyslog tls error messages

When configuring rsyslog with tls and using PermittedPeer or streamdriver.authmode name, if an unauthorized peer connects, rsyslog logs error messages like below. Jan 22 08:56:38 test rsyslogd-2089: ...
1
vote
0answers
73 views

Syslog connection to Logstash not resetting

We have a setup with one Logstash server (1.4.2, using embedded Elasticsearch) to receive logs from a number of other clients (via TCP and from their rsyslogd instances). One issue that now happens ...
0
votes
2answers
75 views

Forwarding logs in nested directories with rsyslog

I have log forwarding set up using rsyslog and imfile. How could I go about watching nested log files? Right now I'm using wildcards to watch all files matching log/*.log, but I have logs nested 1 ...
0
votes
1answer
1k views

nginx logs to syslog - connection refused

I'm trying to setup nginx 1.7.3 to send logs to syslog, but when I this configuration: server { access_log syslog:server=localhost; } this shows up in nginx's error log: 2015/01/15 21:42:47 ...
0
votes
0answers
45 views

rsyslog v7 template conversion from v5

I need to convert my v5 rsyslog template to a v7 template. v5 template was this: $template Firewall,"/var/log/prd/fwlog-%$YEAR%-%$MONTH%-%$DAY%" $template ...
-1
votes
1answer
57 views

File monitoring using syslog [closed]

Can rsyslog, syslog-ng programs monitor change of file? I want to monitor files and receive the changes made to the file by syslog on server. Thank you.
1
vote
0answers
53 views

rsyslog: facilities not separating

I will preface this with, I am a Linux newbie. I had set up a Debian Linux rsyslog server that was working, but I had to switch to Ubuntu. I was hoping that I would be able to just copy the parts of ...
1
vote
0answers
43 views

rsyslog: Logs on local0 only on restart of rsyslogd

I have configured rsyslog.conf such that my program's log get logged in local0 facility. I have prevented logging in messages as well. *.info;mail.none;authpriv.none;cron.none;local0.none ...
0
votes
2answers
64 views

Can I prevent some of the UFW messages from being logged?

My router broadcasts (sends to 224.0.0.1) something every forty seconds. This is caught by UFW which stores a log entry in syslog: Jan 5 03:49:02 log kernel: [ 1184.788900] [UFW BLOCK] IN=eth0 ...