rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

1
vote
2answers
572 views

Rsyslog filter by client

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side. I added this line ...
1
vote
0answers
170 views

Redirecting app log to rsyslog in upstart script

I have an upstart script that does the following start on runlevel [2345] stop on runlevel [06] respawn pre-start script exec >/dev/kmsg 2>&1 REPO=git@github.com:blabla/bli ...
1
vote
1answer
91 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
1
vote
1answer
870 views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
1
vote
0answers
326 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
1
vote
1answer
586 views

rsyslog forward all except ldap

I have Centos 6 servers running openLDAP. In the rsyslog.conf, I forward the logs to my central server with this line: *.* @10.10.10.10:514 openldap seems incredibly chatty. I have 3 servers in ...
1
vote
1answer
2k views

Getting logs from remote clients via rsyslog

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp ...
1
vote
1answer
1k views

rsyslog - template - regex data for insertion into db

I've been googling around the last few days looking for a solid example of how to regex a log entry for desired data, which is then to be inserted into a database, but apparently my google-fu is ...
1
vote
0answers
170 views

How to dynamically generate $LocalHostName value rsyslog

I have set up a central remote syslog server where I am sending all my logs. There will be many machines logging to the syslog server. On the client machine, in the rsyslog.conf I am trying to modify ...
1
vote
0answers
45 views

Why empty fields in Rsyslog?

In our Rsyslog database, we are using rsyslog version 5.8.6, we have so many empty fields for some columns, for example, EventBinaryData, EventSource, EventUser, EventCategory, all these fields are ...
1
vote
0answers
122 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
0answers
182 views

What's wrong with this rsyslog rule?

I'm trying to handle part of a log with a program: if $programname == 'Security-Alert' then |/usr/local/bin/handler The handler script works if I call echo blabla | /usr/local/bin/handler. Now I ...
1
vote
0answers
177 views

rsyslogd RepeatedMsgReduction on a per-facility basis

I am using rsyslogd to remotely log certain facilities. Repeated message reduction plays havok with the logserver filters, due to loss of information. I see that I can disable $RepeatedMsgReduction ...
1
vote
0answers
104 views

Why can't rsyslogd find libgcc_s.so.1?

Scenario: Running a debootstrapped Ubuntu 11.4 lxc guest on a Ubuntu 12.4 lxc host. Inside the lxc guest, rsyslogd is constantly crashing with SIGABRT stating: libgcc_s.so.1 must be installed for ...
1
vote
1answer
249 views

Haproxy log each frontend to different file with rsyslog

I have many frontends in haproxy, I plan to log each frontend to different file, for example, frontend a to /var/log/a.log, b to /var/log/b.log, but haproxy's log facility must be one of the 24 ...
1
vote
0answers
95 views

Rsyslog Not Getting the Logs on Time

I have two central rsyslog server accepting UDP logs from multiple client machines. Both are configured exactly the same. For some reason, the 1st server doesn't get the logs from the client ...
1
vote
1answer
803 views

what's causing rsyslog to log $msg**INVALID PROPERTY NAME** instead of the message contents from sonicwall devices?

I have a pair of sonicwall devices pointed at an rsyslog (v4.6.2) instance that are apparently formatting their messages unagreeably for the mysql plugin. The rsyslog instance logs other devices ...
1
vote
1answer
823 views

rsyslog to external script

Using CentOS I have rsyslog configured to send data to a python script via a shell execute action(^). I have python 2.7 installed, but when my script is called, the shell environment is referencing ...
1
vote
0answers
188 views

Rsyslog's RELP format; experience?

1) In your experience, does rsyslog's RELP log transfer format require a significant amount of resources over what plain TCP syslog transfer would use? (cpu, disk i/o, network) 2) IYHO, is TCP ...
1
vote
2answers
2k views

rsyslog-mysql on CentOS 5.3 does not have permission to access the mysql.sock

After installing and configuring both MySQL and rsyslog with the mysql extensions I get the following error in /var/log/messages: rsyslogd:db error (2002): Can't connect to local MySQL server ...
1
vote
2answers
211 views

Syslog does not record logs received over TCP to a file

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over ...
1
vote
1answer
186 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
1
vote
4answers
2k views

Rsyslog not logging from remote server

I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on ...
0
votes
4answers
2k views

remote server log viewer/analyzer

I have an rsyslog server running Ubuntu 12.04 which stores logs from different clients also running Ubuntu 12.04. Now I want to view those logs from my machine which also runs Ubuntu 12.04. One way ...
0
votes
2answers
47 views

Can I prevent some of the UFW messages from being logged?

My router broadcasts (sends to 224.0.0.1) something every forty seconds. This is caught by UFW which stores a log entry in syslog: Jan 5 03:49:02 log kernel: [ 1184.788900] [UFW BLOCK] IN=eth0 ...
0
votes
3answers
594 views

Remote Apache Logging

I have been researching remote logging of apache logs, and everything I have found involves piping to logger. Two questions: Is there any other way to remotely log apache logs? Is piping to ...
0
votes
2answers
349 views

Using rsyslogd on only 1 of 2 systems

I have two systems. One is a laptop and has rsyslog. The other is embedded system that doesn't have rsyslog. What I'd like to do is log messages from the embedded system on the laptop. I've ...
0
votes
1answer
2k views

rsyslog: large memory consumption

rsyslogd 4.6.4, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No FEATURE_NETZIP (message compression): Yes GSSAPI Kerberos 5 support: Yes ...
0
votes
2answers
869 views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...
0
votes
2answers
377 views

Find syslog priortiy/ severity of a message

Is there a way to find the syslog priority or severity of log entries using a standard unix tool? For example I could grep for the word error in a log. But not all logs will state the word "error" ...
0
votes
1answer
32 views

How to change rsyslog configuration file directory

Does anyone know how I can recompile rsyslog for Ubuntu 10.04 so that /etc/rsyslog.conf is read from another location, say for instance /tmp/rsyslog.conf?
0
votes
1answer
207 views

intercept, evaluate, change syslog messages

is it possible to intercept syslog messages and evaluate (in special cases change) them before they are written into /var/log/? At the moment i m using inotify to monitor the log file and write the ...
0
votes
1answer
526 views

rsyslog: “-” prepended to action path / ftp.* does not log

following config rules: auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log daemon.* ...
0
votes
1answer
510 views

Trouble with backslash characters and rsyslog writing to postgres

I have rsyslog 4.6.4 configured to write mail logs to a PostgreSQL database. It all works fine, until the log message contains a backslash, as in this example: Jun 12 11:37:46 dc5 ...
0
votes
1answer
45 views

Using rsyslog with TLS without generating a self signed cert

Just about every guide I have seen for using TLS with rsyslog involves generating a self signed cert and using that. If the boxes are already set up with a legit signed cert how do you set up the ...
0
votes
1answer
73 views

Suppressing rsyslog tls error messages

When configuring rsyslog with tls and using PermittedPeer or streamdriver.authmode name, if an unauthorized peer connects, rsyslog logs error messages like below. Jan 22 08:56:38 test rsyslogd-2089: ...
0
votes
1answer
494 views

nginx logs to syslog - connection refused

I'm trying to setup nginx 1.7.3 to send logs to syslog, but when I this configuration: server { access_log syslog:server=localhost; } this shows up in nginx's error log: 2015/01/15 21:42:47 ...
0
votes
1answer
377 views

Haproxy not logging requests?

So, I configured Haproxy so the logging would go through rsyslog and, for now, be all dumped in one file. It's definetly logging, as I get those "starting" messages on startup, but no HTTP requests ...
0
votes
1answer
448 views

Rsyslog queues and performance impacts

Having recently had a network failure that caused a major cascading series of other issues, I've been diving into our rsyslog.conf to try identify opportunities for more stable deployment. We have ...
0
votes
1answer
888 views

Forwarding from rsyslog to syslog-ng over TCP not working (although packets are reaching server)

We use syslog-ng on our central syslog server (syslog-ng-2.1.4-9.el5 on CentOS 5.9). We were happily sending logs using syslogd and rsyslog from a mixture of Linux and Solaris hosts over UDP until ...
0
votes
2answers
2k views

Remove Iptables log from kern.log syslog messages

I'm having trouble with Iptables logs, i'm not able to get them out from kern.log, syslog and message files. I added two rules in rsyslog.conf which redirect my messages to an "iptables.log" file but ...
0
votes
1answer
205 views

Centralized logging server failover

I'm planning a centralized log server for 200+ Linux boxes, rsyslog on both the client and server side. Here are my requirements: Do not log anything locally on Linux boxes and send everything to ...
0
votes
1answer
248 views

How do the slapd logging levels work?

I can't seem to find an example of how each of the log levels in slapd work. I want slapd to log the users who are logging in, and the server that they are trying to log into, as well as any ...
0
votes
2answers
93 views

Use RPM to add rsyslog rule

I'm using an RPM to install a binary and some config files to CentOS. My issue is that I need to find a way to set up the rsyslog rules during the RPM install. Up until now I've just been adding the ...
0
votes
1answer
174 views

Can Rsyslog process messages before saving them?

The messages that I'm sending to syslog have some tags like so: "[date] [text here] tags:tag1,tag2,tag3 [more text here]" I already have a rule that only saves lines that contain the text "tags:" ...
0
votes
1answer
558 views

How should I rotate rsyslog documents stored in mysql

I have setup rsyslog to dump syslog data into mysql so that LogAnalyzer can easily access and interact with it. How do I automate a job to remove syslog data of a certain age for the mysql database ...
0
votes
1answer
288 views

rsyslog. Filter doesn't work

I use ubuntu-server. I try to set filter in my rsyslog.conf for accepting only remote logs from my D-link. that is debug Debug line with all properties: FROMHOST: 'fromname', fromhost-ip: ...
0
votes
1answer
128 views

Compiling rsyslog with zlib

I'm trying to compile rsyslog but it fails with CC rsyslogd-smtradfwd.o CC rsyslogd-iminternal.o CC rsyslogd-pidfile.o CCLD rsyslogd ...
0
votes
2answers
179 views

Server unresponsive, messages shown on console but not in log files

I'm using Ubuntu Server 10.04.4, and once in a while the server hangs (once a month) and is totally unresponsive. The tty is flooded with messages like these. The problem is that these messages are ...
0
votes
2answers
163 views

haproxy rsyslog entries are without microsecond

I changed my (Debian 6.0) rsyslog configuration so that it uses high-precision timestamps. Indeed it does, and it gives me microseconds, both in kernel entries and in some other entries such as ...