rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

1
vote
0answers
273 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
1
vote
1answer
528 views

rsyslog forward all except ldap

I have Centos 6 servers running openLDAP. In the rsyslog.conf, I forward the logs to my central server with this line: *.* @10.10.10.10:514 openldap seems incredibly chatty. I have 3 servers in ...
1
vote
1answer
2k views

Getting logs from remote clients via rsyslog

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp ...
1
vote
1answer
928 views

rsyslog - template - regex data for insertion into db

I've been googling around the last few days looking for a solid example of how to regex a log entry for desired data, which is then to be inserted into a database, but apparently my google-fu is ...
1
vote
0answers
156 views

How to dynamically generate $LocalHostName value rsyslog

I have set up a central remote syslog server where I am sending all my logs. There will be many machines logging to the syslog server. On the client machine, in the rsyslog.conf I am trying to modify ...
1
vote
0answers
44 views

Why empty fields in Rsyslog?

In our Rsyslog database, we are using rsyslog version 5.8.6, we have so many empty fields for some columns, for example, EventBinaryData, EventSource, EventUser, EventCategory, all these fields are ...
1
vote
0answers
117 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
0answers
174 views

What's wrong with this rsyslog rule?

I'm trying to handle part of a log with a program: if $programname == 'Security-Alert' then |/usr/local/bin/handler The handler script works if I call echo blabla | /usr/local/bin/handler. Now I ...
1
vote
0answers
167 views

rsyslogd RepeatedMsgReduction on a per-facility basis

I am using rsyslogd to remotely log certain facilities. Repeated message reduction plays havok with the logserver filters, due to loss of information. I see that I can disable $RepeatedMsgReduction ...
1
vote
0answers
103 views

Why can't rsyslogd find libgcc_s.so.1?

Scenario: Running a debootstrapped Ubuntu 11.4 lxc guest on a Ubuntu 12.4 lxc host. Inside the lxc guest, rsyslogd is constantly crashing with SIGABRT stating: libgcc_s.so.1 must be installed for ...
1
vote
1answer
232 views

Haproxy log each frontend to different file with rsyslog

I have many frontends in haproxy, I plan to log each frontend to different file, for example, frontend a to /var/log/a.log, b to /var/log/b.log, but haproxy's log facility must be one of the 24 ...
1
vote
0answers
94 views

Rsyslog Not Getting the Logs on Time

I have two central rsyslog server accepting UDP logs from multiple client machines. Both are configured exactly the same. For some reason, the 1st server doesn't get the logs from the client ...
1
vote
1answer
751 views

what's causing rsyslog to log $msg**INVALID PROPERTY NAME** instead of the message contents from sonicwall devices?

I have a pair of sonicwall devices pointed at an rsyslog (v4.6.2) instance that are apparently formatting their messages unagreeably for the mysql plugin. The rsyslog instance logs other devices ...
1
vote
1answer
788 views

rsyslog to external script

Using CentOS I have rsyslog configured to send data to a python script via a shell execute action(^). I have python 2.7 installed, but when my script is called, the shell environment is referencing ...
1
vote
0answers
188 views

Rsyslog's RELP format; experience?

1) In your experience, does rsyslog's RELP log transfer format require a significant amount of resources over what plain TCP syslog transfer would use? (cpu, disk i/o, network) 2) IYHO, is TCP ...
1
vote
2answers
2k views

rsyslog-mysql on CentOS 5.3 does not have permission to access the mysql.sock

After installing and configuring both MySQL and rsyslog with the mysql extensions I get the following error in /var/log/messages: rsyslogd:db error (2002): Can't connect to local MySQL server ...
1
vote
2answers
149 views

Syslog does not record logs received over TCP to a file

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over ...
1
vote
1answer
146 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
1
vote
4answers
1k views

Rsyslog not logging from remote server

I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on ...
0
votes
4answers
1k views

remote server log viewer/analyzer

I have an rsyslog server running Ubuntu 12.04 which stores logs from different clients also running Ubuntu 12.04. Now I want to view those logs from my machine which also runs Ubuntu 12.04. One way ...
0
votes
2answers
35 views

Can I prevent some of the UFW messages from being logged?

My router broadcasts (sends to 224.0.0.1) something every forty seconds. This is caught by UFW which stores a log entry in syslog: Jan 5 03:49:02 log kernel: [ 1184.788900] [UFW BLOCK] IN=eth0 ...
0
votes
3answers
565 views

Remote Apache Logging

I have been researching remote logging of apache logs, and everything I have found involves piping to logger. Two questions: Is there any other way to remotely log apache logs? Is piping to ...
0
votes
2answers
314 views

Using rsyslogd on only 1 of 2 systems

I have two systems. One is a laptop and has rsyslog. The other is embedded system that doesn't have rsyslog. What I'd like to do is log messages from the embedded system on the laptop. I've ...
0
votes
1answer
1k views

rsyslog: large memory consumption

rsyslogd 4.6.4, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No FEATURE_NETZIP (message compression): Yes GSSAPI Kerberos 5 support: Yes ...
0
votes
2answers
721 views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...
0
votes
2answers
308 views

Find syslog priortiy/ severity of a message

Is there a way to find the syslog priority or severity of log entries using a standard unix tool? For example I could grep for the word error in a log. But not all logs will state the word "error" ...
0
votes
1answer
31 views

How to change rsyslog configuration file directory

Does anyone know how I can recompile rsyslog for Ubuntu 10.04 so that /etc/rsyslog.conf is read from another location, say for instance /tmp/rsyslog.conf?
0
votes
1answer
186 views

intercept, evaluate, change syslog messages

is it possible to intercept syslog messages and evaluate (in special cases change) them before they are written into /var/log/? At the moment i m using inotify to monitor the log file and write the ...
0
votes
1answer
495 views

rsyslog: “-” prepended to action path / ftp.* does not log

following config rules: auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log daemon.* ...
0
votes
1answer
489 views

Trouble with backslash characters and rsyslog writing to postgres

I have rsyslog 4.6.4 configured to write mail logs to a PostgreSQL database. It all works fine, until the log message contains a backslash, as in this example: Jun 12 11:37:46 dc5 ...
0
votes
1answer
25 views

Using rsyslog with TLS without generating a self signed cert

Just about every guide I have seen for using TLS with rsyslog involves generating a self signed cert and using that. If the boxes are already set up with a legit signed cert how do you set up the ...
0
votes
1answer
32 views

Suppressing rsyslog tls error messages

When configuring rsyslog with tls and using PermittedPeer or streamdriver.authmode name, if an unauthorized peer connects, rsyslog logs error messages like below. Jan 22 08:56:38 test rsyslogd-2089: ...
0
votes
1answer
121 views

nginx logs to syslog - connection refused

I'm trying to setup nginx 1.7.3 to send logs to syslog, but when I this configuration: server { access_log syslog:server=localhost; } this shows up in nginx's error log: 2015/01/15 21:42:47 ...
0
votes
1answer
315 views

Rsyslog queues and performance impacts

Having recently had a network failure that caused a major cascading series of other issues, I've been diving into our rsyslog.conf to try identify opportunities for more stable deployment. We have ...
0
votes
1answer
763 views

Forwarding from rsyslog to syslog-ng over TCP not working (although packets are reaching server)

We use syslog-ng on our central syslog server (syslog-ng-2.1.4-9.el5 on CentOS 5.9). We were happily sending logs using syslogd and rsyslog from a mixture of Linux and Solaris hosts over UDP until ...
0
votes
2answers
2k views

Remove Iptables log from kern.log syslog messages

I'm having trouble with Iptables logs, i'm not able to get them out from kern.log, syslog and message files. I added two rules in rsyslog.conf which redirect my messages to an "iptables.log" file but ...
0
votes
1answer
187 views

Centralized logging server failover

I'm planning a centralized log server for 200+ Linux boxes, rsyslog on both the client and server side. Here are my requirements: Do not log anything locally on Linux boxes and send everything to ...
0
votes
1answer
231 views

How do the slapd logging levels work?

I can't seem to find an example of how each of the log levels in slapd work. I want slapd to log the users who are logging in, and the server that they are trying to log into, as well as any ...
0
votes
1answer
289 views

Centralized apache logging with rsyslog

I maintain many virtualhosts (over 60) hosted on a Centos server running Apache. The virtualhosts gets created using Plesk, which creates separate log files for each domain using the following pattern ...
0
votes
2answers
90 views

Use RPM to add rsyslog rule

I'm using an RPM to install a binary and some config files to CentOS. My issue is that I need to find a way to set up the rsyslog rules during the RPM install. Up until now I've just been adding the ...
0
votes
1answer
155 views

Can Rsyslog process messages before saving them?

The messages that I'm sending to syslog have some tags like so: "[date] [text here] tags:tag1,tag2,tag3 [more text here]" I already have a rule that only saves lines that contain the text "tags:" ...
0
votes
1answer
532 views

How should I rotate rsyslog documents stored in mysql

I have setup rsyslog to dump syslog data into mysql so that LogAnalyzer can easily access and interact with it. How do I automate a job to remove syslog data of a certain age for the mysql database ...
0
votes
1answer
281 views

rsyslog. Filter doesn't work

I use ubuntu-server. I try to set filter in my rsyslog.conf for accepting only remote logs from my D-link. that is debug Debug line with all properties: FROMHOST: 'fromname', fromhost-ip: ...
0
votes
1answer
122 views

Compiling rsyslog with zlib

I'm trying to compile rsyslog but it fails with CC rsyslogd-smtradfwd.o CC rsyslogd-iminternal.o CC rsyslogd-pidfile.o CCLD rsyslogd ...
0
votes
2answers
171 views

Server unresponsive, messages shown on console but not in log files

I'm using Ubuntu Server 10.04.4, and once in a while the server hangs (once a month) and is totally unresponsive. The tty is flooded with messages like these. The problem is that these messages are ...
0
votes
2answers
158 views

haproxy rsyslog entries are without microsecond

I changed my (Debian 6.0) rsyslog configuration so that it uses high-precision timestamps. Indeed it does, and it gives me microseconds, both in kernel entries and in some other entries such as ...
0
votes
1answer
120 views

syslog - log line classifications [closed]

A very generic question; in the context of a programmer, with operational aspect of the process (program) in mind. Is there any sort of best-practice / guide to classify messages, particularly in the ...
0
votes
1answer
592 views

How to remote log with Nginx

Have anybody experience on remote access and error logging of Nginx? We have such setup for Apache, but would like to migrate to Nginx.
0
votes
1answer
649 views

rsyslog nested rules for snoopy

I currently have a rsyslog rule to split up all logging from snoopy into a file for each user ~$ cat /etc/rsyslog.d/10-snoopy.conf $template ...
0
votes
2answers
2k views

How to configure JBoss AS 7 to log to syslog?

How do i configure jboss to log to syslog?