rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

0
votes
1answer
112 views

Rsyslog not discarding lines

I'm trying to discard lines like this: httpd: - - - - [03/Jun/2013:23:04:10 +0000] "-" 408 - "-" "-" 32 - Based on the docs, I would think this would suffice: :msg, contains, "408 -" ~ I know that ...
0
votes
1answer
112 views

rsyslog - assigning a modified property to a cee variable

So I'm going nuts trying to get a sortable timestamp from rsyslog into a CEE variable which will go to ElasticSearch. Right now I'm using: set $!tgen = $timegenerated; from which the field looks ...
0
votes
1answer
101 views

imported log into rsyslog not sent to remote server when rotated

So right now I have a bunch of production servers, and I setup remote logging through rsyslog to our staging servers. For anything actually logged through rsyslog it works fine (Even when rotated) but ...
0
votes
1answer
1k views

why is stunnel doing this

I am trying to setup stunnel to encrypt traffic from rsyslog (using the relp protocol), but whenever I try starting stunnel and sending logs to the remote server, i get the following: Remote ...
0
votes
0answers
110 views

Filter rsyslog message by message id?

I'm trying to filter out some windows logs, that from program named Security-Auditing and with a message id 4624, but it doesn't work: if $programname == 'Security-Alert' and $msgid == '4624' then ...
0
votes
1answer
92 views

Monitor application log files with variable names with rsyslog

I have an application on linux that puts randomly (truly randomly, not following any pattern) named log files in /opt/application/logs. I need to read all these files with rsyslog and forward their ...
0
votes
1answer
149 views

Hosts.deny file not being updated by denyhost service

I have denyhosts running on my server to block IPs that repeated fail to login over ssh, for example brute force style attacks. I can see that entries in the auth.log file have not been updated in the ...
0
votes
1answer
115 views

How to forward postfix event logging to an http endpoint?

I would like to monitor postfix with a tool I wrote my self, I need to do it live right after sending, my optimal solution will be somehow make postfix send it's events to a logging system other then ...
0
votes
1answer
336 views

rsyslog from Heroku drain creates empty log files

I'm sending logs from my Heroku app to an rsyslog server, but the resulting log files seem to come up empty. The rsyslog configuration for receiving remote messages is as follows: $template ...
0
votes
0answers
199 views

vhost error log to rsyslog

For one of my websites in the vhost.conf file I have added a line to push what comes in the site specific error log to rsyslog. Problem with that is that it does not leave a copy or anything in the ...
0
votes
1answer
577 views

snoopy rsyslog output file rule

I'm just setting up snoopy logger on my personal machine to archive commands I've run. I'm attempting to setup an rsyslog rule to move its messages from /var/log/auth.log to /var/log/snoopy.log I've ...
0
votes
2answers
372 views

log forwarding performance and OS bottleneck

How many logs/second can usually be handled by syslog servers? By syslog servers, I am referring to rsyslog, syslog-ng, splunk etc. The intent of the question is to find out at what logs/second rate ...
0
votes
1answer
413 views

Send data from rsyslog to a application/script

So I currently have a rsyslog server running on ubuntu that is inserting into a db , this is all fine but I want to do some processing before the insert , I have a script that can do the formatting me ...
-1
votes
2answers
325 views

Rsyslog: Difference between logging to a UNIX domain socket or an INET socket (UDP)

I am observing the following behaviour when logging to syslog from an external application: if I send a well-formed syslog message to a UDP socket, rsyslog correctly parses it, however if the very ...
-1
votes
1answer
1k views

Ubuntu 12.04 - Change rsyslog to use EDT|EST instead of UTC

Right now, I have rsyslog handling a log for a PHP app. Well...I have PHP using rsyslog to do the logging. Currently, it logs time in UTC. I want it to log in EST/EDT as appropriate. How do I make ...
-2
votes
1answer
318 views

Remote logging from snort to rsyslog

As part of a school project, we are supposed to run snort on a Ubuntu server in IDS mode and log the packets to rsyslog on a remote Ubuntu server. I have been searching for manuals/tutorials for a ...