0
votes
0answers
54 views

Setup CENTOS Centralized AUDIT and RSYSLOG server

Attempting to use these links: Sending audit logs to SYSLOG server or http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log I have been unable to get centralized AUDIT logging to work on my ...
0
votes
0answers
114 views

How to forward arbitrary files to graylog2 with rsyslog

I have some random files that I would like to collect and forward to my logging server. These are applications that don't really support GELF, so I am trying to forward these files with rsyslog: # ...
0
votes
0answers
33 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
1
vote
1answer
46 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
1
vote
0answers
29 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
1
vote
1answer
156 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
0
votes
0answers
42 views

What kind of messages are dropped when $OmitLocalLogging is on?

The new systemd journal was introduced some time ago. The following configuration is added in rsyslog to integrate this new module: $ModLoad imjournal # provides access to the systemd journal ...
1
vote
1answer
65 views

Can I automate emailing of critical errors with systemd journal?

Fedora OS introduces journalctl as the new way to log error messages. I learn about this recently when I performed an upgrade. var/log/messages and many other log files are now combined into a ...
0
votes
2answers
44 views

how to prevent crontab logs from registring in syslog?

I have separate my crontab log into cron.log file by uncommenting the below ling in /etc/syslog.conf, But it register in syslog too. cron.* /var/log/cron.log How ...
2
votes
2answers
195 views

Log ssh sessions to rsyslog

How can I setup rsyslog to log commands typed in a ssh session? Just in case someone unauthorized ever accesses the system, I'd like to know what he did.
1
vote
1answer
124 views

Pipe program output to rsyslog

I have a process running that writes it's output to a file, like this. processx > /var/log/processx.log 2>&1 How would I write/pipe/forward this to rsyslog instead (including the ...
0
votes
2answers
736 views

Remove Iptables log from kern.log syslog messages

I'm having trouble with Iptables logs, i'm not able to get them out from kern.log, syslog and message files. I added two rules in rsyslog.conf which redirect my messages to an "iptables.log" file but ...
2
votes
1answer
215 views

How to prevent logging of duplicated error messages in rsyslog?

After performing a software update, I got hundreds of errors that read like this: 2013-11-11 19:00:00 err user audispd - queue is full - dropping event Not sure if this is a bug, but it is rapidly ...
0
votes
4answers
499 views

remote server log viewer/analyzer

I have an rsyslog server running Ubuntu 12.04 which stores logs from different clients also running Ubuntu 12.04. Now I want to view those logs from my machine which also runs Ubuntu 12.04. One way ...
0
votes
1answer
113 views

Centralized logging server failover

I'm planning a centralized log server for 200+ Linux boxes, rsyslog on both the client and server side. Here are my requirements: Do not log anything locally on Linux boxes and send everything to ...
2
votes
3answers
314 views

Logging doesn't work after rsyslog upgrade

I have several different django applications under apache on a Red Hat server. These applications use SysLogHandler for sending log messages to the local rsyslog service. In order to pipe log messages ...
0
votes
0answers
68 views

Rsyslog filter packets from input file before sending to remote rsyslog host

I have my rsyslog configured to send logs from a logfile to a remote host $InputFileName /var/log/app/app.log $InputFileTag app $InputFileSeverity info $InputFileFacility local7 ...
0
votes
1answer
345 views

rsyslog relp - preventing remote logs from being written to my local /var/log

I've set up a logging server using rsyslog with relp. It works just fine as far as receiving remote logs and placing them in /var/spool/rsyslog. My problem is: most of these messages are appearing in ...
2
votes
1answer
594 views

How to send NAGIOS alerts to OSSIM server

I've installed an OSSIM server and I wanto to retrieve the alerts generated by a remote Nagios server in order to analyze them and perform correlation of security events. Before putting hands on it, ...
2
votes
1answer
1k views

How do I setup rsyslog to send all logs to multiple remote servers?

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails. *.* @@server1 *.* @@server2 If I put the above in ...
2
votes
3answers
202 views

How can I forward an application log to a remote log server?

I have an application which writes its own log file in /var/log/app/app.log. How can I forward these logs to a remote Rsyslog server?
2
votes
0answers
51 views

Rsyslog : copy with changing the facility

I have saslauthd with save the logs in LOG_AUTH in our rsyslogd server. It can't be changed without recompiling, and I don't want to do that. I would like to see all the LOG_AUTH in LOG_MAIL, because ...
0
votes
1answer
95 views

How do the slapd logging levels work?

I can't seem to find an example of how each of the log levels in slapd work. I want slapd to log the users who are logging in, and the server that they are trying to log into, as well as any ...
0
votes
1answer
195 views

Centralized apache logging with rsyslog

I maintain many virtualhosts (over 60) hosted on a Centos server running Apache. The virtualhosts gets created using Plesk, which creates separate log files for each domain using the following pattern ...
3
votes
2answers
1k views

how to filer rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based ...
2
votes
1answer
776 views

How to configure rsyslog to log into PostgreSQL without too much latency?

I'm trying to configure RSyslog on a Debian machine to log everythingo into PostgreSQL, while also logging as usual on disk. I'm using a pretty stock Debian configuration and I activated the related ...
1
vote
4answers
711 views

Rsyslog not logging from remote server

I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on ...
-1
votes
2answers
319 views

Rsyslog: Difference between logging to a UNIX domain socket or an INET socket (UDP)

I am observing the following behaviour when logging to syslog from an external application: if I send a well-formed syslog message to a UDP socket, rsyslog correctly parses it, however if the very ...
4
votes
1answer
625 views

Wildcard support for InputFileName in rsyslog?

We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName? Example: InputFileName: ...
3
votes
1answer
67 views

Why Postfix on Linux require a “-” character before the pathname?

I´ve found the following here: IMPORTANT: on Linux you need to put a "-" character before the pathname, e.g., -/var/log/maillog, otherwise the syslogd process will use more system resources than ...
0
votes
1answer
97 views

imported log into rsyslog not sent to remote server when rotated

So right now I have a bunch of production servers, and I setup remote logging through rsyslog to our staging servers. For anything actually logged through rsyslog it works fine (Even when rotated) but ...
3
votes
1answer
676 views

haproxy not logging

I have configured rsyslog (CentOS 6.3) adding the -c 0 -r options and the line local2.* /var/log/haproxy.log and restarted rsyslog but all that happens is an haproxy.log gets created. It is never ...
1
vote
0answers
42 views

Why empty fields in Rsyslog?

In our Rsyslog database, we are using rsyslog version 5.8.6, we have so many empty fields for some columns, for example, EventBinaryData, EventSource, EventUser, EventCategory, all these fields are ...
0
votes
0answers
109 views

Filter rsyslog message by message id?

I'm trying to filter out some windows logs, that from program named Security-Auditing and with a message id 4624, but it doesn't work: if $programname == 'Security-Alert' and $msgid == '4624' then ...
1
vote
0answers
100 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
0
votes
1answer
323 views

rsyslog: “-” prepended to action path / ftp.* does not log

following config rules: auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log daemon.* ...
4
votes
4answers
878 views

CentOS centralised logging, syslogd, rsyslog, syslog-ng, logstash sender?

I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc. I've found a few different options but I'm not sure what would be best. ...
1
vote
2answers
1k views

Rsyslogd not listening on port

I installed rsyslogd on ubuntu server, started it and everything looks fine, but the port the server should listen on is not opened. ubuntu@node7:~$ sudo service rsyslog restart rsyslog stop/waiting ...
2
votes
1answer
438 views

Remote rsyslog only writing logging data to /var/log/syslog and not custom logfiles

I'm having a problem setting up rsyslog to log remote logging data to a specific file. I have two Windows Server 2008 boxes that each have a C# application using NLog.Targets.Syslog which log their ...
0
votes
1answer
247 views

rsyslog. Filter doesn't work

I use ubuntu-server. I try to set filter in my rsyslog.conf for accepting only remote logs from my D-link. that is debug Debug line with all properties: FROMHOST: 'fromname', fromhost-ip: ...
1
vote
1answer
304 views

Rsyslog Central Server Log Rotation File/Folder Permission

I have setup a CentOS 6.3 box to collect logs from a few devices, I have log rotation setup for each host. Basically It rotates the log file by Year, Month, Day and the Host. Everything works great ...
5
votes
1answer
513 views

rsyslog update on Amazon Linux suddenly treats INFO level messages as EMERG

I'm having strange issue with rsyslog on some of my EC2 instances running Amazon Linux 2012.3. Upon yum upgrading rsyslog 4.6 to 5.8.10, it seems like every INFO level log message is suddenly treated ...
1
vote
2answers
2k views

Remote logging - Nginx over Rsyslog or any other alternative

I need to setup centralized remote access logging of Auto Scaling Instances. Currently I have Rsyslog / Apache2 logging working just fine, but for the new project Nginx is used and I don't see any ...
1
vote
1answer
223 views

Rsyslog Discarding Unwanted Messages

Once again, i found that Rsyslog is not as flexible as i expected... My application logs to LOCAL5.* ( depending on the severity ) I would like to see on my centralized log server only ...
2
votes
2answers
5k views

rsyslog: How do I direct messages from all remote machines to one file?

We have a syslog server and we have all our servers logging to it. We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for. Anyone know how to ...
3
votes
3answers
3k views

rsyslogd: Any way to get around the number of local facilities?

We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
5
votes
1answer
2k views

How to maintain the log source host using logstash

I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter. In the ...
2
votes
1answer
182 views

rsyslog appears to act on old configuration

I'm using a template to dynamically generate rsyslog filenames. I've made some changes from my original format, but rsyslog still appears to be using both the new template and the old after ...
0
votes
1answer
333 views

rsyslog from Heroku drain creates empty log files

I'm sending logs from my Heroku app to an rsyslog server, but the resulting log files seem to come up empty. The rsyslog configuration for receiving remote messages is as follows: $template ...
3
votes
1answer
330 views

rsyslog with heroku

I'm trying to capture logs from Heroku. I have setup as suggested http://devcenter.heroku.com/articles/logging#syslog_drains. I'm completely new to the rsyslog, please bear with me. Where do I see ...