rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

2
votes
2answers
193 views

Log ssh sessions to rsyslog

How can I setup rsyslog to log commands typed in a ssh session? Just in case someone unauthorized ever accesses the system, I'd like to know what he did.
2
votes
3answers
201 views

How can I forward an application log to a remote log server?

I have an application which writes its own log file in /var/log/app/app.log. How can I forward these logs to a remote Rsyslog server?
2
votes
1answer
838 views

syslog writing to general instead of specific file

I'm running Ubuntu and Postgresql 9. I've enabled postgresql to log to syslog, and added the following directive to the config file: syslog_facility = 'local0'". I've tried to configure syslog ...
2
votes
3answers
1k views

Chained Syslog forwarding

Is there a way to chain syslog forwarding? For example, how can a clienthost forward its syslogs to ServerA and ServerA forward everything to CentralSyslogServer? I'm using rsyslog. The reason is ...
2
votes
1answer
1k views

rsyslog not logging to auth.log

I'm running Ubuntu server 10.04, and my auth.log is no longer getting updated. And actually my auth.log is empty and everything was being logged to auth.log.1, same with syslog, mail, and other logs. ...
2
votes
1answer
364 views

Failing forwarding rsyslog

I have a centralised rsyslog server A that receives a bunch of logs through TCP from servers X, Y, Z. It then stores the files on disk but also forwards them to logstash server B (on a different ...
2
votes
1answer
1k views

How do I setup rsyslog to send all logs to multiple remote servers?

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails. *.* @@server1 *.* @@server2 If I put the above in ...
2
votes
1answer
184 views

rsyslog starttls ssl

I'm trying to test a setup of rsyslog that uses ssl. I'm (perhaps mis)-understanding that if I use starttls for the ssl traffic, I should be able to receive both ssl and plain syslog traffic on the ...
2
votes
1answer
42 views

How to configure syslogd name/identifier?

I'm forwarding all syslog events to papertrailapp.com, and they are identified as sent by localhost. It's not convenient, since I have a few servers and all of them are localhost-s. How can I ...
2
votes
3answers
677 views

Syslog severity levels when to use Alert vs Critical

Short overview: Is Alert more severe than Critical. RFC 5424 briefly defines syslog severity levels and gives a short description. Each syslog level is given a code 0 - 7. It was my understanding ...
2
votes
2answers
365 views

Preventing multiple line loss when storing syslog messages in a Postgres database

I have an application creating reports that are centralized using syslog, and I'm storing them in a Postgres database for custom use. The database has a specific format (given that the data I'm ...
2
votes
1answer
73 views

%HOSTNAME% value is “unknown” in rsyslog template

The Gist Where does rsyslog get the value of %HOSTNAME% and under what conditions would "unknown" be the expected value? We're using rsyslog on an EC2 instance and we're trying to send our ...
2
votes
1answer
588 views

How to send NAGIOS alerts to OSSIM server

I've installed an OSSIM server and I wanto to retrieve the alerts generated by a remote Nagios server in order to analyze them and perform correlation of security events. Before putting hands on it, ...
2
votes
1answer
775 views

How to configure rsyslog to log into PostgreSQL without too much latency?

I'm trying to configure RSyslog on a Debian machine to log everythingo into PostgreSQL, while also logging as usual on disk. I'm using a pretty stock Debian configuration and I activated the related ...
2
votes
1answer
179 views

Rsyslog messages are truncated, not sent to the correct file

On Ubuntu 10.04 LTS, I'm using the stock rsyslog configuration and added a custom file in /etc/rsyslog.d with the following contents: # cat /etc/rsyslog.d/62-pc local3.debug /var/log/pc/debug.log ...
2
votes
1answer
538 views

Restarting rsyslog re-sends logs again

I am running Ubuntu 12.04.1 LTS on EC2. I have a bunch of application servers which are configured to forward their logs to a central server via rsyslog. Since putting in Nagios monitoring on the ...
2
votes
1answer
438 views

Remote rsyslog only writing logging data to /var/log/syslog and not custom logfiles

I'm having a problem setting up rsyslog to log remote logging data to a specific file. I have two Windows Server 2008 boxes that each have a C# application using NLog.Targets.Syslog which log their ...
2
votes
1answer
735 views

Ubuntu syslog: After log rotation nothing is written on /var/log/syslog

I've been running a Ubuntu VPS for a few weeks now, so a couple of monthly log rotations took place yestarday. For things like /var/log/wtmp things look as expected: logfile has recent entries, while ...
2
votes
2answers
5k views

rsyslog: How do I direct messages from all remote machines to one file?

We have a syslog server and we have all our servers logging to it. We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for. Anyone know how to ...
2
votes
2answers
3k views

pptpd on Debian doesn't write any logs

I'm trying to set up PPTP server with Debian Squeeze. The problem is nothing is being written in the logs (neither in messages nor in debug nor in daemon.log) though debug and dump options are set. ...
2
votes
1answer
723 views

snort not logging full output to syslog

I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
2
votes
2answers
2k views

Using rsyslog to create different log files for different processes

Scenario: I am running a cluster of machines. Each machine runs various python programs with a unique (across the cluster), but dynamically set, ID. Right now, they are all logging locally. So, I ...
2
votes
0answers
56 views

Rsyslog: discarding specific messages, rate limiting

I've got netatalk installed on the server and afpd is spamming system logs with the following error: Jun 24 15:38:16 TEST afpd[21532]: sys_getextattr_size: error: Operation not supported I'm not ...
2
votes
0answers
32 views

Can TLS-enabled rsyslog use a certificate revocation list?

When using the gtls driver, is it possible to configure rsyslog to use a certificate revocation list? We are running rsyslogd 5.8.10 (standard in CentOS 6.5).
2
votes
1answer
565 views

Forwarding rsyslog to syslog-ng, with FQDN and facility separation

I'm attempting to configure my rsyslog clients to forward messages to my syslog-ng log repository systems. Forwarding messages works "out of the box", but my clients are logging short names, not ...
2
votes
1answer
383 views

Configuring JBoss AS 7.2 to log to syslog

In my standalone.xml, I have the syslog-handler configured like so: <syslog-handler name="SYSLOG" enabled="true"> <level name="INFO"/> <hostname value="i-XXXXXXX"/> ...
2
votes
1answer
77 views

Pure-ftpd with mutiple domains separate xfer log files on CentOS 6.4

Using the Pure-ftpd daemon to serve ftp service. I've modified the init script to run multiple domains with different IPs, with separate DBs and separate WELCOME MSGs. daemon "$pure_launch_script ...
2
votes
0answers
51 views

Rsyslog : copy with changing the facility

I have saslauthd with save the logs in LOG_AUTH in our rsyslogd server. It can't be changed without recompiling, and I don't want to do that. I would like to see all the LOG_AUTH in LOG_MAIL, because ...
2
votes
2answers
353 views

rsyslog - regex trouble

I'm trying to setup the logentries service. If a log entry has a token in it then I would like to send it to api.logentries.com:10000. The token is a guid in the format ...
2
votes
1answer
89 views

Why don't cfn-init logs get sent by rsyslog?

I just signed up for Papertrail to aggregate logs from some AWS instances I'm setting up with CloudFormation::Init. I've followed the instructions and added *.* @logs.papertrailapp.com to the end of ...
2
votes
1answer
182 views

rsyslog appears to act on old configuration

I'm using a template to dynamically generate rsyslog filenames. I've made some changes from my original format, but rsyslog still appears to be using both the new template and the old after ...
2
votes
0answers
170 views

How to prevent rsyslog from relaying messages

How can I make rsyslog behave like the default of the old syslog, that it will not be relaying (not forward messages coming from remote hosts to another host)? I.e., that it will only forward locally ...
2
votes
0answers
331 views

rSyslog and short hostname

I'm working with rsyslog through multiple hops. What I want is the following, I do not want the short hostname in the msg I only want the IP. So the server sending the msg I do not want it to add its ...
2
votes
1answer
804 views

rsyslog configuration

I need some help :< Does anyone know how i can change the log severity ? What i want to do is somethink like this. node3 -> intermediate -> logserver I want in the intermediate node to filter ...
1
vote
2answers
1k views

rsyslog Text File Input Module error

I'm using: root@u1210: /etc () # lsb_release -d Description: Ubuntu 12.10 root@u1210: /etc () # dpkg -l | grep rsyslog ii rsyslog 5.8.6-1ubuntu9 ...
1
vote
2answers
577 views

Why aren't Heroku syslog drains logging to rsyslogd?

I'm having a problem using syslog drains as described in https://devcenter.heroku.com/articles/logging. To summarize, I have an Ubuntu 10.04 instance on EC2 that is running rsyslogd. I've also set ...
1
vote
1answer
627 views

Remote rsyslog on Debian

How does one enable remote listening with rsyslog (on Debian). Forgive what seems like a super basic question, but all the docs I'm finding about it seem to apply to older versions in which one would ...
1
vote
2answers
601 views

How to set up mysql storage for certain rsyslog input matches?

I'm draining various logs from Heroku to an rsyslog linux (ubuntu) server and am starting to have a little more to bite off than I can chew in terms of working with my log histories. I am needing to ...
1
vote
2answers
2k views

Filter log messages by program name and log level at the same time in rsyslogd

I want to save log messages from program foobar with log level err into file /var/log/foobar.log in rsyslogd. How can I do that? This is how I can filter messages by program name: ...
1
vote
2answers
241 views

Using Rsyslog to send application logs to syslog server

I'm trying to setup my rsyslog to send logs generated by an application under /opt/appname/logs to a remote syslog server. I have already configured rsyslog to send OS level logs but wanted to see if ...
1
vote
2answers
2k views

Remote logging - Nginx over Rsyslog or any other alternative

I need to setup centralized remote access logging of Auto Scaling Instances. Currently I have Rsyslog / Apache2 logging working just fine, but for the new project Nginx is used and I don't see any ...
1
vote
2answers
2k views

RSyslog does not work with a log file located outside of /var/log

I am unable to get rsyslog to write to a log file located in a directory other than /var/log. The server is RHELS 5.6 and for the most part with a default configuration. Other than the rsyslog ...
1
vote
2answers
2k views

rsyslog - relaying only remotely received messages (edit: nxlog will be better)

I am looking at building a syslog relay in order to move from my clients'-enforced UDP stream to TCP. Specifically, I would like to move from client --UDP_PORT_999--> server1 to client ...
1
vote
1answer
121 views

Pipe program output to rsyslog

I have a process running that writes it's output to a file, like this. processx > /var/log/processx.log 2>&1 How would I write/pipe/forward this to rsyslog instead (including the ...
1
vote
1answer
45 views

How can keep the log as it is without any additional information from syslog?

I have server with RHEL 6 and rsyslog-5.8 and Apache/2.2.23, I sent the access and error logs to syslog server but the syslog adds information in logs such as date and hostname: ex: Jun 5 14:17:28 ...
1
vote
1answer
83 views

What does “-/filepath” ACTION mean in rsyslog configuration

I came across this one Debian Linux installation (6.0.6), and examining its /etc/rsyslog.conf, I see configuration lines like this: auth,authpriv.* /var/log/auth.log ...
1
vote
2answers
1k views

Rsyslogd not listening on port

I installed rsyslogd on ubuntu server, started it and everything looks fine, but the port the server should listen on is not opened. ubuntu@node7:~$ sudo service rsyslog restart rsyslog stop/waiting ...
1
vote
1answer
400 views

rsyslog to fifo

I want to have a rsyslog log its data to a fifo that a daemon creates. However, if the daemon isn't running and the fifo isn't there then rsyslog will just start writing to a file in its place. Is ...
1
vote
1answer
57 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
1
vote
2answers
268 views

Trying to convert syslog-ng to rsyslog

I'me trying to get nginx to log direct to piwik. I am having problems getting rsyslog to accecpt some syslog-ng syntax. The rsyslog doc says syslog-ng conf is compatible with it. source s_nginx_20 { ...