rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

0
votes
1answer
121 views

syslog - log line classifications [closed]

A very generic question; in the context of a programmer, with operational aspect of the process (program) in mind. Is there any sort of best-practice / guide to classify messages, particularly in the ...
0
votes
1answer
607 views

How to remote log with Nginx

Have anybody experience on remote access and error logging of Nginx? We have such setup for Apache, but would like to migrate to Nginx.
0
votes
1answer
683 views

rsyslog nested rules for snoopy

I currently have a rsyslog rule to split up all logging from snoopy into a file for each user ~$ cat /etc/rsyslog.d/10-snoopy.conf $template ...
0
votes
2answers
2k views

How to configure JBoss AS 7 to log to syslog?

How do i configure jboss to log to syslog?
0
votes
2answers
2k views

Redirecting Syslog events from RHEL 6 to RHEL 5: is it possible to provide with the same event format?

For some reasons, we redirect syslog events from RHEL 6 (with rsyslog) to RHEL 5 (with syslogd). On RHEL 6 in rsyslog.conf: *.* @10.30.46.211 On RHEL 5 in /etc/sysconfig/syslog: ...
0
votes
1answer
1k views

Logging MySQL events to file in addition to syslog on Debian

By default, Debian uses rsyslog to handle MySQL error logging. I like this behavior and do not want to change it. However, I would like rsyslog to write MySQL events to /var/log/mysqld.log in ...
0
votes
1answer
1k views

Sending multiple loglines (mysql-slow.log, php5-fpm.log.slow) to syslog

I'm trying to aggregate several sources of error messages into one place, to easier put things into context. I'm currently looking at rsyslog, but I can change this - if it's preventing me from doing ...
0
votes
1answer
6k views

How does one enable remote listening with rsyslog?

I'm configuring a Debian Squeeze server to receive syslog from some appliances, but rsyslog is refusing to listen to UDP 514. The closest I have been able to get from it is to make it listen to TCP ...
0
votes
1answer
753 views

Stop messages from going to /var/log/debug

I have a daemon running, milter-regex that is absolutely polluting my /var/log/debug file. After some digging around I thought by adding the "daemon.err;daemon.notice /var/log/milter-regex" that that ...
0
votes
1answer
925 views

how do you convert this syslog-ng cfg to rsyslog?

How do I convert the following to rsyslog syntax? filter local2 { facility(local2); }; filter not_local2 { not facility(local2); }; destination server2 { tcp("server2" port(1111)); }; ...
0
votes
0answers
19 views

getting /dev/kmsg into mongodb via rsyslog [closed]

Given the following config module(load="imkmsg") module(load="imtcp") module(load="mmjsonparse") module(load="ommongodb") input(type="imtcp" port="13514" Ruleset="mongodb") ...
0
votes
0answers
18 views

Sftp Log for every Jailed User

I've a sshd_config file like the following: Match user foo ChrootDirectory /mnt/foo-jail/ ForceCommand internal-sftp AllowTCPForwarding no AuthorizedKeysFile ...
0
votes
0answers
11 views

system log file not getting updated [migrated]

I am trying to add my system call to the Ubuntu. It is a simple hello world function that I am trying to write to the log file using printk(). The code is as follows: #include <linux/kernel.h> ...
0
votes
0answers
19 views

Why would kern.log stop logging after crash & reboot

Server: Ubuntu 12.04 I recently noticed that my servers kern.log had stopped logging. I've not separated iptables from the kern.log so it used to be very active, however recently it's been logging ...
0
votes
1answer
94 views

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
0
votes
1answer
24 views

rsyslogd not storing remote logging information

I have a rsyslogd on Ubuntu 14.0.1: $ModLoad imtcp $InputTCPServerRun 514 $template FILENAME,"/var/log/%fromhost%/syslog.log" *.* ?FILENAME If if run logger -p local0.crit -n 10.240.157.116 -u ...
0
votes
0answers
39 views

Rsyslog last line of old log retransmitted after log rotation

I have config setup on all my CentOS servers to forward all syslog messages to a Graylog server via rsyslog. In Graylog I have then configured streams to alert on the occurrence of certain message ...
0
votes
1answer
55 views

Unable to get Rsyslog structured data in syslog message

I am new to syslog module. I am trying to log messages with structured data by using this parameter in template. But it is showing null value for structured data. I am working with rsyslogd 5.8.11 ...
0
votes
0answers
147 views

sending tomcat catalina.out to syslog

we're on tomcat 6.4 on centos. I've been trying to get the catalina.out logs in tomcat to syslog. For reasons it's very important that I don't send the raw logs, they have to be tagged with OURTOMCAT: ...
0
votes
0answers
22 views

rsyslogd and FQDN - cannot get FQDN from clients

I setup a syslogserver with rsyslogd and 3 clients. Logs from 3 test clients are sent to the server, so far so good. My Problem is: I can't get the FQDN hostnames to work. According to rsyslog.com ...
0
votes
1answer
65 views

How to replace control characters in rsyslog

we have several (usually java) application and they log to centralized rsyslog server (version 7.6). We had problems with java exceptions as rsyslog was handling each line of stack trace as separate ...
0
votes
0answers
47 views

Writing to Unix Domain Socket from rsyslog

I want to write output messages from rsyslog to a Unix Domain Socket. I want to do this so that I can read the messages from that socket using my script and parse log messages further. I try to use ...
0
votes
2answers
58 views

Forwarding logs in nested directories with rsyslog

I have log forwarding set up using rsyslog and imfile. How could I go about watching nested log files? Right now I'm using wildcards to watch all files matching log/*.log, but I have logs nested 1 ...
0
votes
0answers
37 views

rsyslog v7 template conversion from v5

I need to convert my v5 rsyslog template to a v7 template. v5 template was this: $template Firewall,"/var/log/prd/fwlog-%$YEAR%-%$MONTH%-%$DAY%" $template ...
0
votes
0answers
78 views

rsyslog: one of two ruleset-specific main queues isn't processed

there is a Debian Wheezy server with stock rsyslog 5.8.11 which aggregate messages from two hosts, putting them into files at dynamically generated paths. A while ago we came to realization that a ...
0
votes
2answers
1k views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
0
votes
1answer
775 views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
0
votes
0answers
73 views

SSL with rsyslog on CentOS - protocol family not supported?

For the life of me, I can't seem to get rsyslog to have imrelp use TLS(SSL). I've engaged the good people on http://kb.monitorware.com/post25017.html#p25017 to try and chase the rsyslog angle, but I'm ...
0
votes
0answers
63 views

CentOS - php-fpm update - rsyslog issue

Strangest thing. After updating php from 5.4.24 to 5.4.33, I noticed that php errors are no longer going to /var/log/php/all.log, instead they are back in /var/log/messages. I checked my rsyslog ...
0
votes
1answer
63 views

Need to upgrade only rsyslog on Debian system

Just received a notice from apticron: apticron has detected that some packages need upgrading on: The following packages are currently pending an upgrade: rsyslog 5.8.11-3+deb7u1 ... Package ...
0
votes
0answers
54 views

php-fpm: Maintain php_mod logging format

I recently switched all my lab servers from apache pre_fork/mod_php to apache worker/fcgi/php-fpm, and after getting everything set-up correctly, I noticed one last issue; php-fpm is adding it's own ...
0
votes
1answer
269 views

RSyslog sends logs to logstash with host as IP not FQDN

I am having a issue. I am trying to send apache/nginx logs to logstash server. The problem is that rsyslog sends host as IP not the servers FQDN. Solutions that I have tried: PreserveFQDN on (did ...
0
votes
0answers
39 views

Input filtering in rsyslog 5?

I have some messages hitting my rsyslogd server which a network trace shows as: <5>1 2014-09-04T14:58:31Z HOSTNAME This=a message=that contains=some specially=formatted data= This is ...
0
votes
0answers
54 views

One rsyslog machine accepting encrypted and non encrypted logs on different ports

I'm trying to setup an rsyslog server to accept input from 2 different ports, one encrypted for our non internal servers, and one open for our internal servers. The reason for needing this is that ...
0
votes
0answers
107 views

Group Ownership in rsyslog?

What I would like would be to have all remote local7 facilities logged to: /var/log/cisco.log but the ownership needs to be under the group "cisco" in /etc/rsyslog.conf I have: # Logs for cisco ...
0
votes
0answers
88 views

rsyslog not writing remote host messages to specific file

I have the following in my rsyslog.conf file on my ubuntu 14.04 logging server: if $fromhost-ip = '192.168.10.37' then /var/log/netgear/switch.log I have changed the owner to be syslog adm 0 ...
0
votes
1answer
422 views

Proper rsyslog configuration

I'm trying to setup a syslog server but it doesn't appear to be working as intended. My client does not seem to be logging to it. Server Ubuntu 12.04 (192.168.1.10) Client Ubuntu 14.04 ...
0
votes
0answers
277 views

Setup CENTOS Centralized AUDIT and RSYSLOG server

Attempting to use these links: Sending audit logs to SYSLOG server or http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log I have been unable to get centralized AUDIT logging to work on my ...
0
votes
0answers
427 views

rsyslog - How to flush queue?

I'm using rsyslog to get logs from haproxy and put them into logstash for elasticsearch/kibana. Everything was working ok, but i've found something strange in rsyslog. I've found that i've got ...
0
votes
1answer
699 views

How to forward arbitrary files to graylog2 with rsyslog

I have some random files that I would like to collect and forward to my logging server. These are applications that don't really support GELF, so I am trying to forward these files with rsyslog: # ...
0
votes
1answer
352 views

Converting to rsyslog v7 new config format

I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy ...
0
votes
1answer
109 views

Syslog and LogAnalyzer - how to retrive source IPs and count them

I have set centralized Syslog (centOS + rsys) server which runs LogAnalyzer for better log presentation. Recently I have got asked to provide logs from the firewall of all IPs for particular firewall ...
0
votes
1answer
268 views

rsyslog with variable input file name

I am running an apache server which is creating log files using rotatelogs. It creates a new file every day with the date appended to it (e.g. filename.yyyy.mm.dd format). I want to use rsyslog to ...
0
votes
1answer
1k views

rsyslog dynamic file filter

I'm trying to get my local /var/log/syslog file under control. My current structure is to log remote files to /var/log/juniper/syslog/%fromhost-ip%/syslog.log. Below are my configurations. ...
0
votes
2answers
155 views

how to prevent crontab logs from registring in syslog?

I have separate my crontab log into cron.log file by uncommenting the below ling in /etc/syslog.conf, But it register in syslog too. cron.* /var/log/cron.log How ...
0
votes
1answer
224 views

rsyslog logging path with custom property

I have an rsyslog server running v7.4.3 receiving a stream with the format: <PRI>Date hostname app: name=VALUE message What I need to do is pull the VALUE out of the message, and log it in a ...
0
votes
0answers
45 views

software to view logs on remote server [closed]

I have configured syslog server on my linux machine like this Linux Machine (syslog client) -- > Linux Machine (syslog server) I have configured it and its working properly. Now, the problem is I ...
0
votes
0answers
122 views

Rsyslog filter packets from input file before sending to remote rsyslog host

I have my rsyslog configured to send logs from a logfile to a remote host $InputFileName /var/log/app/app.log $InputFileTag app $InputFileSeverity info $InputFileFacility local7 ...
0
votes
1answer
1k views

rsyslog relp - preventing remote logs from being written to my local /var/log

I've set up a logging server using rsyslog with relp. It works just fine as far as receiving remote logs and placing them in /var/spool/rsyslog. My problem is: most of these messages are appearing in ...
0
votes
1answer
219 views

Rsyslog configuration for changing source interface

I'm working on rsyslog.conf upon CentOS 6.2. Is there any configuration in rsyslog.conf to change the source interface (eg - eth0, eth1), so that the messages being sent to syslog server contains ...