rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

-1
votes
0answers
12 views

Determine timezone in Rsyslog file

I would like to determine what time zone a specific log is in. I found this line in the log: Aug 29 07:07:40 gw kernel: rtc_cmos rtc_cmos: setting system clock to 2013-08-29 11:07:08 UTC(1377774428) ...
0
votes
0answers
27 views

rsyslog: one of two ruleset-specific main queues isn't processed

there is a Debian Wheezy server with stock rsyslog 5.8.11 which aggregate messages from two hosts, putting them into files at dynamically generated paths. A while ago we came to realization that a ...
0
votes
1answer
56 views

Haproxy not logging requests?

So, I configured Haproxy so the logging would go through rsyslog and, for now, be all dumped in one file. It's definetly logging, as I get those "starting" messages on startup, but no HTTP requests ...
1
vote
0answers
24 views

Rsyslog won't monitor mysql-slow.log when written to by mysql

I'm going mad. I'm trying to get rsyslog to send log files to logentries.com. This works perfectly until I try to log mysql-slow.log. The config is pretty simple module(load="imfile" ...
0
votes
0answers
87 views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
0
votes
1answer
98 views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
1
vote
2answers
398 views

Centos: rsyslog blocks sshd and also local login if selinux is active

I have a very curious problem on an centos 6.5(now 6.6) machine. After an update between june 11th and october 21th the trouble begins (packages: http://pastebin.com/gXvaycLL). After a restart in ...
-1
votes
1answer
50 views

prevent rsyslog writing in my custom log file [closed]

I'm trying to send a custom log from a client to a syslog server. The problem is that: Rsyslog keep writing the same information in my log file. How can I prevent rsyslog to write in my custom log ...
0
votes
0answers
33 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...
3
votes
0answers
90 views

Random SSH entries in Auth.log out of date order

Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue. Some ...
1
vote
1answer
497 views

Snort not sending alert log file to syslog server?

I am set up with three virtual machines running Ubuntu - a Server, Client, and Gateway. I am tasked with setting up Snort on the Gateway to monitor "attacks" from the Client to the Server. Snort is ...
1
vote
2answers
99 views

Syslog does not record logs received over TCP to a file

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over ...
0
votes
0answers
40 views

CentOS - php-fpm update - rsyslog issue

Strangest thing. After updating php from 5.4.24 to 5.4.33, I noticed that php errors are no longer going to /var/log/php/all.log, instead they are back in /var/log/messages. I checked my rsyslog ...
2
votes
2answers
59 views

rsyslog configuration syntax

I need to take several actions for some log messages. For example I want to log them to different files according to severity. Everything is ok if I use this: if $programname == 'myprog' ...
0
votes
1answer
58 views

Need to upgrade only rsyslog on Debian system

Just received a notice from apticron: apticron has detected that some packages need upgrading on: The following packages are currently pending an upgrade: rsyslog 5.8.11-3+deb7u1 ... Package ...
1
vote
0answers
43 views

Is it possible to filter rsyslog messages based on an environment variable, the content of a file or the output of a command?

I am configuring setup scripts for automatically created VMs which need to filter syslog messages in rsyslogd based on an environment variable. I need to be able to change where logs get sent based ...
0
votes
0answers
38 views

php-fpm: Maintain php_mod logging format

I recently switched all my lab servers from apache pre_fork/mod_php to apache worker/fcgi/php-fpm, and after getting everything set-up correctly, I noticed one last issue; php-fpm is adding it's own ...
0
votes
1answer
126 views

RSyslog sends logs to logstash with host as IP not FQDN

I am having a issue. I am trying to send apache/nginx logs to logstash server. The problem is that rsyslog sends host as IP not the servers FQDN. Solutions that I have tried: PreserveFQDN on (did ...
0
votes
0answers
29 views

Input filtering in rsyslog 5?

I have some messages hitting my rsyslogd server which a network trace shows as: <5>1 2014-09-04T14:58:31Z HOSTNAME This=a message=that contains=some specially=formatted data= This is ...
0
votes
1answer
183 views

Rsyslog queues and performance impacts

Having recently had a network failure that caused a major cascading series of other issues, I've been diving into our rsyslog.conf to try identify opportunities for more stable deployment. We have ...
3
votes
1answer
215 views

How do I configure rsyslog to deal with MySQL Slow Query Log multi-line messages?

Using rsyslog v8.2.2, I would like to group multi-line messages, such as those output by the MySQL Slow Query log. Each new message begins with three consecutive lines having '#' as the first char of ...
1
vote
1answer
24 views

TCP rsyslogd events showing up as 2000 character continuations

I'm taking syslog events from a proprietary app. This could be the app's fault or it could be rsyslogd. Events are written like: Aug 15 16:00:00 10.11.12.13 Event1 from this wonderful product using ...
2
votes
2answers
56 views

Using (r)syslog's dynamic file generation

I am in the middle of configuring a (r)syslog server as a remote server that receives logs from various clients. I wonder whether there is a nicer way to dynamically generate multiple file names as ...
1
vote
1answer
305 views

Forward linux logs to fluentd on linux

On one VM I have this in /etc/rsyslog.d/50-default.conf *.* @192.168.29.1:42185 # Default rules for rsyslog. On the vm with fluentd I have this: I have this in /etc/td-agent/td-agent.conf ...
0
votes
0answers
35 views

One rsyslog machine accepting encrypted and non encrypted logs on different ports

I'm trying to setup an rsyslog server to accept input from 2 different ports, one encrypted for our non internal servers, and one open for our internal servers. The reason for needing this is that ...
0
votes
0answers
57 views

Group Ownership in rsyslog?

What I would like would be to have all remote local7 facilities logged to: /var/log/cisco.log but the ownership needs to be under the group "cisco" in /etc/rsyslog.conf I have: # Logs for cisco ...
2
votes
1answer
74 views

IPTables custom log failing

I'm currently trying to split out some of my IPTables logging from kern.log into a file called iptables.log. Basically, I have several different adapters and I'm logging requests to port 80 on each ...
3
votes
1answer
296 views

Difference between /dev/udp and netcat

I have a syslog server listening on localhost:514 as UDP and would like to write messages to it on that port. (Using Ubuntu 14.04) If I run either of these commands this from bash it prints the date ...
2
votes
1answer
126 views

Remote logging to specific directory structure with rsyslog

I'm currently in the process of having all of our various servers send their syslog messages to a central server. I'd like to have the following directory structure on the central server that logs ...
0
votes
0answers
70 views

rsyslog not writing remote host messages to specific file

I have the following in my rsyslog.conf file on my ubuntu 14.04 logging server: if $fromhost-ip = '192.168.10.37' then /var/log/netgear/switch.log I have changed the owner to be syslog adm 0 ...
1
vote
1answer
259 views

Configuring MariaDB to log to mysql.log using rsyslog

I'm a little stumped - there is something obvious I'm missing here. Recently I made the switch from mySQL to mariaDB. Everything is working so far - except for the logging, as I realized today. All ...
0
votes
0answers
229 views

Proper rsyslog configuration

I'm trying to setup a syslog server but it doesn't appear to be working as intended. My client does not seem to be logging to it. Server Ubuntu 12.04 (192.168.1.10) Client Ubuntu 14.04 ...
2
votes
0answers
606 views

Rsyslog: discarding specific messages, rate limiting

I've got netatalk installed on the server and afpd is spamming system logs with the following error: Jun 24 15:38:16 TEST afpd[21532]: sys_getextattr_size: error: Operation not supported I'm not ...
0
votes
0answers
231 views

Setup CENTOS Centralized AUDIT and RSYSLOG server

Attempting to use these links: Sending audit logs to SYSLOG server or http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log I have been unable to get centralized AUDIT logging to work on my ...
1
vote
0answers
111 views

Receiving Apache access and error logs via rsyslog and possible catchall filter

I'm new to rsyslog and have been trying to figure out why I am not receiving any of my Apache and mysql logs which are configured on the client-side to sent via rsyslog. I am currently receiving all ...
2
votes
1answer
1k views

Sending logs to remote server with rsyslog

I'm trying to setup centralized logging with Logstash, Elasticsearch and Kibana and am having trouble getting logs to my log server. Logstash is listening on TCP 5000 and is successfully receiving ...
0
votes
0answers
295 views

rsyslog - How to flush queue?

I'm using rsyslog to get logs from haproxy and put them into logstash for elasticsearch/kibana. Everything was working ok, but i've found something strange in rsyslog. I've found that i've got ...
0
votes
0answers
526 views

How to forward arbitrary files to graylog2 with rsyslog

I have some random files that I would like to collect and forward to my logging server. These are applications that don't really support GELF, so I am trying to forward these files with rsyslog: # ...
1
vote
1answer
3k views

How do I configure rsyslog on Ubuntu 14.04 to use ISO8601 timestamps?

In a file in /etc/rsyslog.d/ I have the following: local3.* /var/log/mylog.log When I log to this facility, records have timestamps which look like this: Apr 27 21:12:20 hostname msg How ...
2
votes
0answers
49 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
1
vote
0answers
29 views

Rsyslog dynamic variables

I have a rsyslog config file for an application that filters logs as so: if $msg contains 'sid:31147' then ~ if $programname == 'myprog' then /var/log/myprog.log &~ The idea is that if the msg ...
2
votes
2answers
1k views

Rsyslog duplicate logs (rsyslog.conf and rsyslog.d/something.conf)

I've created a custom log (php sends log entries to rsyslog) using local0. It uses a new custom file (/var/log/sea.log). The problem is that logs are being sent to /var/log/sea.log , ...
3
votes
1answer
844 views

Different permissions per log file when using rsyslog

Is it feasible to define different permissions per log file, using rsyslog? $FileCreateMode applies to all, but I want different permissions for a specific file.
0
votes
0answers
65 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
1
vote
2answers
244 views

Rsyslog filter by client

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side. I added this line ...
1
vote
1answer
102 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
1
vote
1answer
342 views

How to use rsyslog to log files from client to server

I've setup an rsyslog server which accepts log information from clients. I can successfully receive syslog messages however I'm interested in logging a number of files too. Here is what my client ...
1
vote
0answers
134 views

Redirecting app log to rsyslog in upstart script

I have an upstart script that does the following start on runlevel [2345] stop on runlevel [06] respawn pre-start script exec >/dev/kmsg 2>&1 REPO=git@github.com:blabla/bli ...
0
votes
2answers
548 views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...
1
vote
2answers
681 views

Trying to convert syslog-ng to rsyslog

I'me trying to get nginx to log direct to piwik. I am having problems getting rsyslog to accecpt some syslog-ng syntax. The rsyslog doc says syslog-ng conf is compatible with it. source s_nginx_20 { ...