rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

3
votes
1answer
3k views

Most functional log analysis tools? [closed]

I am curious as to what others find to be the most useful log analysis tools for *nix. Presently I am simply tailing output and grepping through things, however I'd like to use something that would ...
3
votes
0answers
343 views

rSyslog and short hostname

I'm working with rsyslog through multiple hops. What I want is the following, I do not want the short hostname in the msg I only want the IP. So the server sending the msg I do not want it to add its ...
3
votes
1answer
281 views

Ubuntu 12.04 logger won't write to remote syslog

I'm trying to use logger to send events to a remote syslog server. The syslog server is Ubuntu 12.04 running the default rsyslogd. The "client" servers are both Ubuntu 12.04 and SLES11SP1. On SLES11, ...
2
votes
2answers
2k views

Forward Windows Events Logs to Rsyslog

I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on. Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
2
votes
2answers
422 views

Log ssh sessions to rsyslog

How can I setup rsyslog to log commands typed in a ssh session? Just in case someone unauthorized ever accesses the system, I'd like to know what he did.
2
votes
1answer
561 views

How to prevent logging of duplicated error messages in rsyslog?

After performing a software update, I got hundreds of errors that read like this: 2013-11-11 19:00:00 err user audispd - queue is full - dropping event Not sure if this is a bug, but it is rapidly ...
2
votes
3answers
557 views

Logging doesn't work after rsyslog upgrade

I have several different django applications under apache on a Red Hat server. These applications use SysLogHandler for sending log messages to the local rsyslog service. In order to pipe log messages ...
2
votes
2answers
342 views

How can you filter mail.info from syslog?

How do I filter mail.info from /var/log/syslog (rsyslog.conf/Debian) while keeping messages greater than or equal to mail.warn? I've tried just about every different variation of appending and ...
2
votes
1answer
398 views

Reason to use rsyslog for log rotating?

Is there any benefit to using rsyslog's rotation abilities over the standard /sbin/logrotate?
2
votes
2answers
1k views

Rsyslog duplicate logs (rsyslog.conf and rsyslog.d/something.conf)

I've created a custom log (php sends log entries to rsyslog) using local0. It uses a new custom file (/var/log/sea.log). The problem is that logs are being sent to /var/log/sea.log , ...
2
votes
1answer
244 views

Pipe program output to rsyslog

I have a process running that writes it's output to a file, like this. processx > /var/log/processx.log 2>&1 How would I write/pipe/forward this to rsyslog instead (including the ...
2
votes
4answers
351 views

How can I forward an application log to a remote log server?

I have an application which writes its own log file in /var/log/app/app.log. How can I forward these logs to a remote Rsyslog server?
2
votes
2answers
3k views

Rsyslog is not working properly, it does not log anything

I'm running a Debian server and a couple of days ago my rsyslog started to behave very weird, the daemon is running but it doesn't seem to do anything. Many people use the system but I'm the only one ...
2
votes
1answer
1k views

syslog writing to general instead of specific file

I'm running Ubuntu and Postgresql 9. I've enabled postgresql to log to syslog, and added the following directive to the config file: syslog_facility = 'local0'". I've tried to configure syslog ...
2
votes
3answers
2k views

Chained Syslog forwarding

Is there a way to chain syslog forwarding? For example, how can a clienthost forward its syslogs to ServerA and ServerA forward everything to CentralSyslogServer? I'm using rsyslog. The reason is ...
2
votes
1answer
1k views

rsyslog not logging to auth.log

I'm running Ubuntu server 10.04, and my auth.log is no longer getting updated. And actually my auth.log is empty and everything was being logged to auth.log.1, same with syslog, mail, and other logs. ...
2
votes
2answers
69 views

rsyslog configuration syntax

I need to take several actions for some log messages. For example I want to log them to different files according to severity. Everything is ok if I use this: if $programname == 'myprog' ...
2
votes
1answer
660 views

Failing forwarding rsyslog

I have a centralised rsyslog server A that receives a bunch of logs through TCP from servers X, Y, Z. It then stores the files on disk but also forwards them to logstash server B (on a different ...
2
votes
1answer
283 views

rsyslog starttls ssl

I'm trying to test a setup of rsyslog that uses ssl. I'm (perhaps mis)-understanding that if I use starttls for the ssl traffic, I should be able to receive both ssl and plain syslog traffic on the ...
2
votes
1answer
50 views

How to configure syslogd name/identifier?

I'm forwarding all syslog events to papertrailapp.com, and they are identified as sent by localhost. It's not convenient, since I have a few servers and all of them are localhost-s. How can I ...
2
votes
3answers
881 views

Syslog severity levels when to use Alert vs Critical

Short overview: Is Alert more severe than Critical. RFC 5424 briefly defines syslog severity levels and gives a short description. Each syslog level is given a code 0 - 7. It was my understanding ...
2
votes
2answers
404 views

Preventing multiple line loss when storing syslog messages in a Postgres database

I have an application creating reports that are centralized using syslog, and I'm storing them in a Postgres database for custom use. The database has a specific format (given that the data I'm ...
2
votes
2answers
56 views

Using (r)syslog's dynamic file generation

I am in the middle of configuring a (r)syslog server as a remote server that receives logs from various clients. I wonder whether there is a nicer way to dynamically generate multiple file names as ...
2
votes
1answer
1k views

Sending logs to remote server with rsyslog

I'm trying to setup centralized logging with Logstash, Elasticsearch and Kibana and am having trouble getting logs to my log server. Logstash is listening on TCP 5000 and is successfully receiving ...
2
votes
1answer
158 views

%HOSTNAME% value is “unknown” in rsyslog template

The Gist Where does rsyslog get the value of %HOSTNAME% and under what conditions would "unknown" be the expected value? We're using rsyslog on an EC2 instance and we're trying to send our ...
2
votes
1answer
881 views

How to send NAGIOS alerts to OSSIM server

I've installed an OSSIM server and I wanto to retrieve the alerts generated by a remote Nagios server in order to analyze them and perform correlation of security events. Before putting hands on it, ...
2
votes
1answer
248 views

Rsyslog messages are truncated, not sent to the correct file

On Ubuntu 10.04 LTS, I'm using the stock rsyslog configuration and added a custom file in /etc/rsyslog.d with the following contents: # cat /etc/rsyslog.d/62-pc local3.debug /var/log/pc/debug.log ...
2
votes
2answers
415 views

rsyslog - regex trouble

I'm trying to setup the logentries service. If a log entry has a token in it then I would like to send it to api.logentries.com:10000. The token is a guid in the format ...
2
votes
1answer
708 views

Restarting rsyslog re-sends logs again

I am running Ubuntu 12.04.1 LTS on EC2. I have a bunch of application servers which are configured to forward their logs to a central server via rsyslog. Since putting in Nagios monitoring on the ...
2
votes
1answer
528 views

Remote rsyslog only writing logging data to /var/log/syslog and not custom logfiles

I'm having a problem setting up rsyslog to log remote logging data to a specific file. I have two Windows Server 2008 boxes that each have a C# application using NLog.Targets.Syslog which log their ...
2
votes
1answer
923 views

Ubuntu syslog: After log rotation nothing is written on /var/log/syslog

I've been running a Ubuntu VPS for a few weeks now, so a couple of monthly log rotations took place yestarday. For things like /var/log/wtmp things look as expected: logfile has recent entries, while ...
2
votes
2answers
4k views

pptpd on Debian doesn't write any logs

I'm trying to set up PPTP server with Debian Squeeze. The problem is nothing is being written in the logs (neither in messages nor in debug nor in daemon.log) though debug and dump options are set. ...
2
votes
1answer
883 views

snort not logging full output to syslog

I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
2
votes
2answers
3k views

Using rsyslog to create different log files for different processes

Scenario: I am running a cluster of machines. Each machine runs various python programs with a unique (across the cluster), but dynamically set, ID. Right now, they are all logging locally. So, I ...
2
votes
1answer
84 views

IPTables custom log failing

I'm currently trying to split out some of my IPTables logging from kern.log into a file called iptables.log. Basically, I have several different adapters and I'm logging requests to port 80 on each ...
2
votes
1answer
143 views

Remote logging to specific directory structure with rsyslog

I'm currently in the process of having all of our various servers send their syslog messages to a central server. I'd like to have the following directory structure on the central server that logs ...
2
votes
0answers
698 views

Rsyslog: discarding specific messages, rate limiting

I've got netatalk installed on the server and afpd is spamming system logs with the following error: Jun 24 15:38:16 TEST afpd[21532]: sys_getextattr_size: error: Operation not supported I'm not ...
2
votes
0answers
52 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
2
votes
1answer
1k views

Forwarding rsyslog to syslog-ng, with FQDN and facility separation

I'm attempting to configure my rsyslog clients to forward messages to my syslog-ng log repository systems. Forwarding messages works "out of the box", but my clients are logging short names, not ...
2
votes
1answer
754 views

Configuring JBoss AS 7.2 to log to syslog

In my standalone.xml, I have the syslog-handler configured like so: <syslog-handler name="SYSLOG" enabled="true"> <level name="INFO"/> <hostname value="i-XXXXXXX"/> ...
2
votes
1answer
121 views

Pure-ftpd with mutiple domains separate xfer log files on CentOS 6.4

Using the Pure-ftpd daemon to serve ftp service. I've modified the init script to run multiple domains with different IPs, with separate DBs and separate WELCOME MSGs. daemon "$pure_launch_script ...
2
votes
0answers
82 views

Rsyslog : copy with changing the facility

I have saslauthd with save the logs in LOG_AUTH in our rsyslogd server. It can't be changed without recompiling, and I don't want to do that. I would like to see all the LOG_AUTH in LOG_MAIL, because ...
2
votes
1answer
95 views

Why don't cfn-init logs get sent by rsyslog?

I just signed up for Papertrail to aggregate logs from some AWS instances I'm setting up with CloudFormation::Init. I've followed the instructions and added *.* @logs.papertrailapp.com to the end of ...
2
votes
1answer
324 views

Rsyslog Discarding Unwanted Messages

Once again, i found that Rsyslog is not as flexible as i expected... My application logs to LOCAL5.* ( depending on the severity ) I would like to see on my centralized log server only ...
2
votes
1answer
190 views

rsyslog appears to act on old configuration

I'm using a template to dynamically generate rsyslog filenames. I've made some changes from my original format, but rsyslog still appears to be using both the new template and the old after ...
2
votes
0answers
177 views

How to prevent rsyslog from relaying messages

How can I make rsyslog behave like the default of the old syslog, that it will not be relaying (not forward messages coming from remote hosts to another host)? I.e., that it will only forward locally ...
2
votes
1answer
845 views

rsyslog configuration

I need some help :< Does anyone know how i can change the log severity ? What i want to do is somethink like this. node3 -> intermediate -> logserver I want in the intermediate node to filter ...
1
vote
2answers
2k views

rsyslog Text File Input Module error

I'm using: root@u1210: /etc () # lsb_release -d Description: Ubuntu 12.10 root@u1210: /etc () # dpkg -l | grep rsyslog ii rsyslog 5.8.6-1ubuntu9 ...
1
vote
2answers
701 views

Why aren't Heroku syslog drains logging to rsyslogd?

I'm having a problem using syslog drains as described in https://devcenter.heroku.com/articles/logging. To summarize, I have an Ubuntu 10.04 instance on EC2 that is running rsyslogd. I've also set ...
1
vote
1answer
702 views

Remote rsyslog on Debian

How does one enable remote listening with rsyslog (on Debian). Forgive what seems like a super basic question, but all the docs I'm finding about it seem to apply to older versions in which one would ...