rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

4
votes
1answer
307 views

Random SSH entries in Auth.log out of date order [duplicate]

Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue. Some ...
3
votes
4answers
863 views

rsyslog or a similar distributed logging standard, for Windows?

I have a bunch of Windows Servers that run a bunch of apps, that log into local text files. I want to aggregate these text files into a centralized log server, where I can search them. Building ...
3
votes
3answers
2k views

Filtering bad requests from Apache -> logger -> rsyslog to syslog-ng on a remote logging server possible?

EDIT: Thanks for the help Here is a quick idea of the setup: webserver X In apache httpd.conf: LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vcombined CustomLog ...
11
votes
2answers
14k views

How do I get rsyslogd to log a server's FQDN instead of it's short hostname?

I'm trying to implement a simple centralized syslog server using stock rsyslogd (4.2.0-2ubuntu8.1) on Ubuntu 10.04 LTS. At this point I have all my client nodes sending logs to the central server, but ...
4
votes
4answers
12k views

Sending logs to Graylog2 server

I have just setup a Graylog2 server and I am looking to send all logs from my main server to the graylog server. I have enabled logging for the main server and am sending logs to my graylog server by ...
4
votes
2answers
5k views

syslog ip ranges to specific files using `rsyslog`

I have many Cisco / JunOS routers and switches that send logs to my Debian server, which uses rsyslogd. How can I configure rsyslogd to send these router / switch logs to a specific file, based on ...
0
votes
1answer
391 views

rsyslog from Heroku drain creates empty log files

I'm sending logs from my Heroku app to an rsyslog server, but the resulting log files seem to come up empty. The rsyslog configuration for receiving remote messages is as follows: $template ...
4
votes
2answers
1k views

How to escape or remove double quotes in rsyslog template

I want rsyslog to write log messages in JSON format, which requires to use double-quotes (") around strings. Problem is that values sometime include double-quotes themselves, and those need to be ...
3
votes
1answer
2k views

Errors using new rsyslog template syntax on RHEL6

I'm migrating our rsyslog config from an old server to a new one, and thought I'd use the opportunity to tidy up our config. The old config used "legacy" template definitions, and the rsyslog doc on ...
2
votes
1answer
960 views

snort not logging full output to syslog

I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
1
vote
4answers
2k views

Rsyslog not logging from remote server

I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on ...
1
vote
2answers
2k views

rsyslog - relaying only remotely received messages (edit: nxlog will be better)

I am looking at building a syslog relay in order to move from my clients'-enforced UDP stream to TCP. Specifically, I would like to move from client --UDP_PORT_999--> server1 to client ...
0
votes
1answer
1k views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and ...
0
votes
1answer
6k views

How does one enable remote listening with rsyslog?

I'm configuring a Debian Squeeze server to receive syslog from some appliances, but rsyslog is refusing to listen to UDP 514. The closest I have been able to get from it is to make it listen to TCP ...
0
votes
1answer
427 views

Send data from rsyslog to a application/script

So I currently have a rsyslog server running on ubuntu that is inserting into a db , this is all fine but I want to do some processing before the insert , I have a script that can do the formatting me ...