rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

1
vote
2answers
158 views

Forwarding logs in nested directories with rsyslog

I have log forwarding set up using rsyslog and imfile. How could I go about watching nested log files? Right now I'm using wildcards to watch all files matching log/*.log, but I have logs nested 1 ...
1
vote
0answers
83 views

rsyslog: facilities not separating

I will preface this with, I am a Linux newbie. I had set up a Debian Linux rsyslog server that was working, but I had to switch to Ubuntu. I was hoping that I would be able to just copy the parts of ...
1
vote
0answers
133 views

Rsyslog won't monitor mysql-slow.log when written to by mysql

I'm going mad. I'm trying to get rsyslog to send log files to logentries.com. This works perfectly until I try to log mysql-slow.log. The config is pretty simple module(load="imfile" PollingInterval=...
1
vote
1answer
2k views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and kibana(...
1
vote
2answers
1k views

Centos: rsyslog blocks sshd and also local login if selinux is active

I have a very curious problem on an centos 6.5(now 6.6) machine. After an update between june 11th and october 21th the trouble begins (packages: http://pastebin.com/gXvaycLL). After a restart in ...
1
vote
0answers
112 views

Is it possible to filter rsyslog messages based on an environment variable, the content of a file or the output of a command?

I am configuring setup scripts for automatically created VMs which need to filter syslog messages in rsyslogd based on an environment variable. I need to be able to change where logs get sent based ...
1
vote
0answers
230 views

Receiving Apache access and error logs via rsyslog and possible catchall filter

I'm new to rsyslog and have been trying to figure out why I am not receiving any of my Apache and mysql logs which are configured on the client-side to sent via rsyslog. I am currently receiving all ...
1
vote
0answers
1k views

rsyslog - How to flush queue?

I'm using rsyslog to get logs from haproxy and put them into logstash for elasticsearch/kibana. Everything was working ok, but i've found something strange in rsyslog. I've found that i've got ...
1
vote
0answers
65 views

Rsyslog dynamic variables

I have a rsyslog config file for an application that filters logs as so: if $msg contains 'sid:31147' then ~ if $programname == 'myprog' then /var/log/myprog.log &~ The idea is that if the msg ...
1
vote
2answers
3k views

Rsyslog filter by client

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side. I added this line ...
1
vote
1answer
158 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
1
vote
1answer
858 views

Converting to rsyslog v7 new config format

I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy ...
1
vote
1answer
2k views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
1
vote
1answer
424 views

rsyslog with variable input file name

I am running an apache server which is creating log files using rotatelogs. It creates a new file every day with the date appended to it (e.g. filename.yyyy.mm.dd format). I want to use rsyslog to ...
1
vote
0answers
712 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
1
vote
1answer
892 views

rsyslog forward all except ldap

I have Centos 6 servers running openLDAP. In the rsyslog.conf, I forward the logs to my central server with this line: *.* @10.10.10.10:514 openldap seems incredibly chatty. I have 3 servers in ...
1
vote
1answer
3k views

Getting logs from remote clients via rsyslog

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp ...
1
vote
1answer
2k views

rsyslog - template - regex data for insertion into db

I've been googling around the last few days looking for a solid example of how to regex a log entry for desired data, which is then to be inserted into a database, but apparently my google-fu is ...
1
vote
0answers
294 views

How to dynamically generate $LocalHostName value rsyslog

I have set up a central remote syslog server where I am sending all my logs. There will be many machines logging to the syslog server. On the client machine, in the rsyslog.conf I am trying to modify ...
1
vote
0answers
59 views

Why empty fields in Rsyslog?

In our Rsyslog database, we are using rsyslog version 5.8.6, we have so many empty fields for some columns, for example, EventBinaryData, EventSource, EventUser, EventCategory, all these fields are ...
1
vote
0answers
144 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
1
vote
0answers
216 views

What's wrong with this rsyslog rule?

I'm trying to handle part of a log with a program: if $programname == 'Security-Alert' then |/usr/local/bin/handler The handler script works if I call echo blabla | /usr/local/bin/handler. Now I ...
1
vote
0answers
205 views

rsyslogd RepeatedMsgReduction on a per-facility basis

I am using rsyslogd to remotely log certain facilities. Repeated message reduction plays havok with the logserver filters, due to loss of information. I see that I can disable $RepeatedMsgReduction ...
1
vote
0answers
110 views

Why can't rsyslogd find libgcc_s.so.1?

Scenario: Running a debootstrapped Ubuntu 11.4 lxc guest on a Ubuntu 12.4 lxc host. Inside the lxc guest, rsyslogd is constantly crashing with SIGABRT stating: libgcc_s.so.1 must be installed for ...
1
vote
1answer
359 views

Haproxy log each frontend to different file with rsyslog

I have many frontends in haproxy, I plan to log each frontend to different file, for example, frontend a to /var/log/a.log, b to /var/log/b.log, but haproxy's log facility must be one of the 24 ...
1
vote
0answers
101 views

Rsyslog Not Getting the Logs on Time

I have two central rsyslog server accepting UDP logs from multiple client machines. Both are configured exactly the same. For some reason, the 1st server doesn't get the logs from the client ...
1
vote
1answer
1k views

what's causing rsyslog to log $msg**INVALID PROPERTY NAME** instead of the message contents from sonicwall devices?

I have a pair of sonicwall devices pointed at an rsyslog (v4.6.2) instance that are apparently formatting their messages unagreeably for the mysql plugin. The rsyslog instance logs other devices ...
1
vote
1answer
1k views

rsyslog to external script

Using CentOS I have rsyslog configured to send data to a python script via a shell execute action(^). I have python 2.7 installed, but when my script is called, the shell environment is referencing ...
1
vote
0answers
208 views

Rsyslog's RELP format; experience?

1) In your experience, does rsyslog's RELP log transfer format require a significant amount of resources over what plain TCP syslog transfer would use? (cpu, disk i/o, network) 2) IYHO, is TCP ...
1
vote
2answers
2k views

rsyslog-mysql on CentOS 5.3 does not have permission to access the mysql.sock

After installing and configuring both MySQL and rsyslog with the mysql extensions I get the following error in /var/log/messages: rsyslogd:db error (2002): Can't connect to local MySQL server ...
1
vote
2answers
539 views

Syslog does not record logs received over TCP to a file

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over ...
1
vote
1answer
380 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
1
vote
4answers
3k views

Rsyslog not logging from remote server

I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on ...
0
votes
4answers
3k views

remote server log viewer/analyzer

I have an rsyslog server running Ubuntu 12.04 which stores logs from different clients also running Ubuntu 12.04. Now I want to view those logs from my machine which also runs Ubuntu 12.04. One way ...
0
votes
2answers
153 views

Can I prevent some of the UFW messages from being logged?

My router broadcasts (sends to 224.0.0.1) something every forty seconds. This is caught by UFW which stores a log entry in syslog: Jan 5 03:49:02 log kernel: [ 1184.788900] [UFW BLOCK] IN=eth0 ...
0
votes
3answers
715 views

Remote Apache Logging

I have been researching remote logging of apache logs, and everything I have found involves piping to logger. Two questions: Is there any other way to remotely log apache logs? Is piping to ...
0
votes
2answers
2k views

Rsyslog through TLS

I have been trying to get rsyslog to transmit through TLS with no luck so far. There seems to be something wrong with my configuration, but I cannot pinpoint it. this is my server conf file: # ...
0
votes
2answers
532 views

Using rsyslogd on only 1 of 2 systems

I have two systems. One is a laptop and has rsyslog. The other is embedded system that doesn't have rsyslog. What I'd like to do is log messages from the embedded system on the laptop. I've ...
0
votes
1answer
2k views

rsyslog: large memory consumption

rsyslogd 4.6.4, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No FEATURE_NETZIP (message compression): Yes GSSAPI Kerberos 5 support: Yes ...
0
votes
1answer
46 views

Unable to log into a rsyslog filter using logger [duplicate]

Ubuntu 64 14.04 comes with rsyslog (7) built-in. I've added test.conf to /etc/rsyslog.d with the following line: :syslogtag,isequal,"test" /var/log/test.log I then restart rsyslog and log ...
0
votes
1answer
4k views

nginx logs to syslog - connection refused

I'm trying to setup nginx 1.7.3 to send logs to syslog, but when I this configuration: server { access_log syslog:server=localhost; } this shows up in nginx's error log: 2015/01/15 21:42:47 [...
0
votes
2answers
655 views

Find syslog priortiy/ severity of a message

Is there a way to find the syslog priority or severity of log entries using a standard unix tool? For example I could grep for the word error in a log. But not all logs will state the word "error" ...
0
votes
1answer
63 views

How to change rsyslog configuration file directory

Does anyone know how I can recompile rsyslog for Ubuntu 10.04 so that /etc/rsyslog.conf is read from another location, say for instance /tmp/rsyslog.conf?
0
votes
1answer
317 views

intercept, evaluate, change syslog messages

is it possible to intercept syslog messages and evaluate (in special cases change) them before they are written into /var/log/? At the moment i m using inotify to monitor the log file and write the ...
0
votes
1answer
806 views

rsyslog: “-” prepended to action path / ftp.* does not log

following config rules: auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log daemon.* ...
0
votes
1answer
695 views

Trouble with backslash characters and rsyslog writing to postgres

I have rsyslog 4.6.4 configured to write mail logs to a PostgreSQL database. It all works fine, until the log message contains a backslash, as in this example: Jun 12 11:37:46 dc5 postfix/smtp[...
0
votes
1answer
7k views

How does one enable remote listening with rsyslog?

I'm configuring a Debian Squeeze server to receive syslog from some appliances, but rsyslog is refusing to listen to UDP 514. The closest I have been able to get from it is to make it listen to TCP ...
0
votes
2answers
53 views

Redirecting log from /var/log/kern.log to a separate log file for iptables log

I am trying to redirect iptables log to another file. Based upon my reading on the net, I did the following: In my iptables rule, I have rules like: iptables -A INPUT -s ... -j LOG --log-prefix "...
0
votes
1answer
346 views

rsyslog upgrade fails: Sub-process /usr/bin/dpkg returned an error code (1)

I'm having trouble upgrading rsyslog on a Debian server. root@trip:/home# apt-get upgrade Reading package lists... Done Building dependency tree Reading state information... Done Calculating upgrade.....
0
votes
1answer
73 views

Is it possible for rsyslog to create a directory?

The Setup I have this in my /etc/rsyslog.conf: $template local1DynFile,"/path/to/my/log/%programname%.log.%NOW% $template local1LogFormat,"%msg:2:$:%\n" *,*;auth,authpriv,local0,local1.none ...