rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

1
vote
2answers
221 views

haproxy rsyslog entries are without microsecond

I changed my (Debian 6.0) rsyslog configuration so that it uses high-precision timestamps. Indeed it does, and it gives me microseconds, both in kernel entries and in some other entries such as puppet'...
1
vote
1answer
577 views

rsyslog to fifo

I want to have a rsyslog log its data to a fifo that a daemon creates. However, if the daemon isn't running and the fifo isn't there then rsyslog will just start writing to a file in its place. Is ...
1
vote
1answer
34 views

How do I handle messages from my custom application in rsyslog?

I have a Ruby application on my server, let's call it "alpha". The application emits syslog messages with the program name "alpha". I want to separate my log messages into separate files based on what ...
1
vote
1answer
52 views

How can I add values to structured data with rsyslog?

Our logs are sent from our applications to rsyslog running on the same host. Rsyslog then forwards the messages to Sumo Logic. We need to add some metadata to our log messages in the structured data ...
1
vote
2answers
738 views

Logging not working on Centos 7

Long story short - somehow I managed to screw up rsyslogd service on Centos 7 server. Now only thing that appears in /var/log/messages is: Dec 14 22:13:27 {myhostname} rsyslogd: [origin software="...
1
vote
2answers
413 views

Unable to get Rsyslog structured data in syslog message

I am new to syslog module. I am trying to log messages with structured data by using this parameter in template. But it is showing null value for structured data. I am working with rsyslogd 5.8.11 ...
1
vote
1answer
37 views

Possible to have FQDN in Debian Logfiles?

Is it possible to have instead the hostname the fqdn inside debian log files? Example: Now its: Mar 2 18:00:12 www rsyslogd: [origin software="rsyslogd" swVersion="5.8.11" x-pid="2442" x-info="http:...
1
vote
1answer
209 views

Rsyslog refuses to log over OpenVPN

I'm trying to forward rsyslog from a client to a server over a VPN. I have it working across an internet link already (through eth0 to an edge router) but would like it to go through the OpenVPN ...
1
vote
1answer
401 views

Writing to Unix Domain Socket from rsyslog

I want to write output messages from rsyslog to a Unix Domain Socket. I want to do this so that I can read the messages from that socket using my script and parse log messages further. I try to use ...
1
vote
1answer
5k views

Snort not sending alert log file to syslog server?

I am set up with three virtual machines running Ubuntu - a Server, Client, and Gateway. I am tasked with setting up Snort on the Gateway to monitor "attacks" from the Client to the Server. Snort is ...
1
vote
1answer
912 views

Configuring MariaDB to log to mysql.log using rsyslog

I'm a little stumped - there is something obvious I'm missing here. Recently I made the switch from mySQL to mariaDB. Everything is working so far - except for the logging, as I realized today. All ...
1
vote
1answer
188 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
1
vote
1answer
867 views

How to use rsyslog to log files from client to server

I've setup an rsyslog server which accepts log information from clients. I can successfully receive syslog messages however I'm interested in logging a number of files too. Here is what my client ...
1
vote
2answers
1k views

Trying to convert syslog-ng to rsyslog

I'me trying to get nginx to log direct to piwik. I am having problems getting rsyslog to accecpt some syslog-ng syntax. The rsyslog doc says syslog-ng conf is compatible with it. source s_nginx_20 { ...
1
vote
1answer
1k views

rsyslogd not monitoring all files in config file

I am not seeing rsyslog pick up all files I am trying to monitor. I am using the standard config from Ubuntu 12.04 LTS but am adding the contents below to /etc/rsyslog.d/30-logentries.conf. I ...
1
vote
1answer
2k views

Centos syslog isn't logging to custom file from bash script

I'm trying to get a bash script to log to a custom log file using syslog on Centos release 6.5, but it always just logs to /var/log/messages like so: Jan 12 09:54:47 localhost nbsp: Test message blah!...
1
vote
2answers
186 views

Can I automate emailing of critical errors with systemd journal?

Fedora OS introduces journalctl as the new way to log error messages. I learn about this recently when I performed an upgrade. var/log/messages and many other log files are now combined into a ....
1
vote
1answer
5k views

Rsyslogd config error

I have this rsyslog.conf file: # /etc/rsyslog.conf Configuration file for rsyslog. # # For more information see # /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html ##########...
1
vote
2answers
3k views

rsyslog relp - preventing remote logs from being written to my local /var/log

I've set up a logging server using rsyslog with relp. It works just fine as far as receiving remote logs and placing them in /var/spool/rsyslog. My problem is: most of these messages are appearing in ...
1
vote
1answer
445 views

Centralized apache logging with rsyslog

I maintain many virtualhosts (over 60) hosted on a Centos server running Apache. The virtualhosts gets created using Plesk, which creates separate log files for each domain using the following pattern ...
1
vote
1answer
2k views

Write out bind/named log messages to a different file using rsyslog

Right now, the contents of /etc/rsyslog.conf which control disposition of the named log messages looks like: # Log anything (except mail) of level info or higher. # Don't log private authentication ...
1
vote
1answer
444 views

Rsyslog Central Server Log Rotation File/Folder Permission

I have setup a CentOS 6.3 box to collect logs from a few devices, I have log rotation setup for each host. Basically It rotates the log file by Year, Month, Day and the Host. Everything works great ...
1
vote
1answer
2k views

Ubuntu 12.04 - Change rsyslog to use EDT|EST instead of UTC

Right now, I have rsyslog handling a log for a PHP app. Well...I have PHP using rsyslog to do the logging. Currently, it logs time in UTC. I want it to log in EST/EDT as appropriate. How do I make ...
1
vote
1answer
325 views

Splitting rsyslog messages into files based on source (heroku drain)

I set up a heroku log drain, which sends messages to port 514 on my logging instance. The log server sends the messages /var/log/syslog, though, and I'd like it to send them to /var/log/appname.log or ...
1
vote
2answers
2k views

iptables doesn't log anything

I'm trying to defend my server (Ubuntu Lucid 10.04) from some brute force ssh attacks by configuring the iptables. I want to log the matches to DROP rules, but it wasn't working, so I tried the very ...
1
vote
1answer
341 views

Best practices for discarding messages in (r)syslog?

I've setup a central rsyslog server that is writing events to a MySQL database. Looking through the events one sees all kinds of events that are probably unnecessarily captured. On RHEL/CentOS ...
1
vote
4answers
2k views

Rsyslog mail module not working

I would like to email snort alerts from my Debian Lenny fw. Syslog is sending log messages from the firewalls to a central rsyslog. On my central rsyslog, I got something like : $ModLoad ommail $...
1
vote
2answers
30 views

I erased haproxy.log with old content but this file hasn't appeared again

I have a load balancer with HAProxy in Ubuntu 14.04. I did all configurations for turn on log and it works well. However, I erased haproxy.log file and that hasn't appeared again. Can someone help me? ...
1
vote
1answer
72 views

Forwarding specific logs rsyslog

TL;DR - send specific logs with rsyslog (to a redis server) : how to select the logs to be sent ? I want to forward to a redis server a set (and only that set) of logs, say for instance nginx logs in ...
1
vote
0answers
108 views

Nginx log to syslog on TCP port

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do: error_log syslog:server=192.168.1.1; However I need to ...
1
vote
0answers
53 views

Postfix logs to remote log host

On my Ubuntu 14.04 server, I'm using Postfix as a front-end mailserver, and I would like to send all mail related info, including email addresses, to a remote host. In the file /etc/rsyslog.d/50-...
1
vote
0answers
17 views

How to have upstart shutdown rsyslog as last job in Ubuntu 14.04

It seems like upstart decides to shutdown rsyslog on Ubuntu 14.04 as one of the first jobs if a machine shuts down. So most logging of shutting down jobs is lost. How to I instruct upstart to shutdown ...
1
vote
0answers
18 views

rsyslog parsing logs with liblognorm

I'm trying to use such .rb file to parse logs: version=2 rule=:%Server:char-to:\t%\t%stamp:char-to:\t%\t%ip:ipv4%\t%Site:char-to:\t%\t%BID:char-to:\t%\t%SID:char-to:\t%\t%LD:char-to:\t%\t%UserID:...
1
vote
1answer
131 views

rsyslog cannot send logs to logstash

Here is my rsyslog.conf (nothing in /etc/rsyslog.d/ folder): #### MODULES #### $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imklog # provides ...
1
vote
0answers
173 views

rsyslog filter on authpriv facility in rsyslog.conf

This has been addressed in other post(s), but I still can't get this to work properly. I am trying to OMIT (discard) certain entries from being written to my " /var/log/secure ". Namely, any line ...
1
vote
0answers
199 views

How can I separate logs with rsyslog from a remote location for devices using the same IP?

I have a number of Yealink SIP phones at different locations that I am trying to centralize log collection for. I have set up a CentOS server at my main location with rsyslog. I am forwarding all ...
1
vote
0answers
138 views

Rotation and continuous writing of large log files with rsyslogd

I have an extremely busy log file (let's call it /var/log/service.log) that is also frequently searched for troubleshooting reasons. Output to it is nearly continuous and 24/7. It probably puts out ...
1
vote
0answers
99 views

Sending RFC5452 messages to /dev/log

I would like to be able to send a RFC5452-format message to rsyslog using the /dev/log socket. I've tried a number of variations on the following: echo "<29>1 2003-10-11T22:14:15Z mymachine....
1
vote
0answers
103 views

rsyslog Email On SSH/SFTP Login Fails

I have tried the following on my Nginx server, but do not get any emails upon SSH (or SFTP) login. I put this code in /etc/rsyslog.d/notify.conf and have ensured this file is being called by /etc/...
1
vote
0answers
78 views

logger not logging to remote rsyslogd instance

I am running CentOS 7.0.1406 with rsyslogd 7.4.7 and logger from util-linux 2.23.2. I have two machines connected via a switch. When I try to use logger to log from one machine to the other, nothing ...
1
vote
1answer
247 views

Example syslog-ng configuration to replicate rsyslog filename & locations?

ng 3.6.3 from source compilation on CentOS 6.6 64bit to play with and was wondering if anyone has pointers or example syslog-ng.conf that would as close as possible replicate the default rsyslog ...
1
vote
1answer
108 views

What rsync options to use for the below mentioned scenario?

Greetings !!! This is regarding a specific requirement about rsync that we are trying to achieve. We have tried to achieve this by using various rsync options. However, we are encountering different ...
1
vote
0answers
414 views

Remote logging with rsyslog - Cannot load module lmnsd_gtls.so

I have 2 servers and an office NAS on which I want the two servers to dump their logs. Only 1 server is successfully logging to the NAS. The other server continues to produce this error message in /...
1
vote
0answers
88 views

Unable to get structured data in logged messages even after adding mmpstrucdata and mmrfc5424addhmac?(RFC5424)

I am trying to log messages with structured data . But it is showing null value for structured data. I am working with rsyslog 8.9.0.Can someone tell me either i need to load some module or modify ...
1
vote
1answer
979 views

Squid cannot log to syslog

According to this documentation: http://www.squid-cache.org/Doc/config/access_log/ squid should be able to log to rsyslog with the following directives: access_log syslog:daemon.info squid cache_log ...
1
vote
0answers
293 views

How to figure out why some characters go missing in rsyslog -> logstash pipeline

I am trying to figure out why some messages received by logstash have some text missing from them. I am sending the logs from an Untangle NGFW (11.0 - licensed) to logstash so that I can keep ...
1
vote
0answers
67 views

rsyslog regex global modifier

Many regex systems have the ability to set a global modifier to allow for multiple matches. Here's how it works in Javascript and Perl. /g Python is a little different Python doesn’t have a ...
1
vote
2answers
382 views

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
1
vote
1answer
412 views

configure and test rsyslog to UDP socket

I am trying to use https://github.com/gliderlabs/logspout so I can see all the logs from my containers in one place. I need rsyslog to listen on UDP socket on port 514. I uncommitted $ModLoad imudp ...
1
vote
0answers
153 views

Syslog connection to Logstash not resetting

We have a setup with one Logstash server (1.4.2, using embedded Elasticsearch) to receive logs from a number of other clients (via TCP and from their rsyslogd instances). One issue that now happens ...