rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

12
votes
2answers
28k views

How to forward specific log file outside of /var/log with rsyslog to remote server?

How can I forward message from a specific log file like /www/myapp/log/test.log with rsyslog client to remote rsyslog server? This log file is outside of the directory /var/log.
7
votes
2answers
10k views

how to filter rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based ...
4
votes
1answer
672 views

Random SSH entries in Auth.log out of date order [duplicate]

Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue. Some ...
3
votes
3answers
2k views

Filtering bad requests from Apache -> logger -> rsyslog to syslog-ng on a remote logging server possible?

EDIT: Thanks for the help Here is a quick idea of the setup: webserver X In apache httpd.conf: LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vcombined CustomLog "|/...
16
votes
4answers
21k views

How do I get rsyslogd to log a server's FQDN instead of it's short hostname?

I'm trying to implement a simple centralized syslog server using stock rsyslogd (4.2.0-2ubuntu8.1) on Ubuntu 10.04 LTS. At this point I have all my client nodes sending logs to the central server, but ...
6
votes
4answers
17k views

Sending logs to Graylog2 server

I have just setup a Graylog2 server and I am looking to send all logs from my main server to the graylog server. I have enabled logging for the main server and am sending logs to my graylog server by ...
5
votes
2answers
8k views

syslog ip ranges to specific files using `rsyslog`

I have many Cisco / JunOS routers and switches that send logs to my Debian server, which uses rsyslogd. How can I configure rsyslogd to send these router / switch logs to a specific file, based on ...
1
vote
2answers
256 views

Stop crontab from filling syslog Ubuntu 15.04

How can I prevent (certain cronjobs) from filling my syslog in Ubuntu 15.04? I have some jobs that run 4 times a minute and quickly fill up my syslog files. I've tried adding: cron.* ...
0
votes
1answer
434 views

rsyslog from Heroku drain creates empty log files

I'm sending logs from my Heroku app to an rsyslog server, but the resulting log files seem to come up empty. The rsyslog configuration for receiving remote messages is as follows: $template ...
2
votes
1answer
1k views

snort not logging full output to syslog

I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
2
votes
2answers
3k views

rsyslog - relaying only remotely received messages (edit: nxlog will be better)

I am looking at building a syslog relay in order to move from my clients'-enforced UDP stream to TCP. Specifically, I would like to move from client --UDP_PORT_999--> server1 to client --...
1
vote
1answer
2k views

kibana: no indices error

None of the existing answers helped, so here a new question. Usecase: Redirecting syslog (or) monitoring static file. I have successfully installed logstash (1.4.2), elasticsearch(1.1.1) and kibana(...
1
vote
1answer
2k views

Ubuntu 12.04 - Change rsyslog to use EDT|EST instead of UTC

Right now, I have rsyslog handling a log for a PHP app. Well...I have PHP using rsyslog to do the logging. Currently, it logs time in UTC. I want it to log in EST/EDT as appropriate. How do I make ...
0
votes
1answer
457 views

Send data from rsyslog to a application/script

So I currently have a rsyslog server running on ubuntu that is inserting into a db , this is all fine but I want to do some processing before the insert , I have a script that can do the formatting me ...
0
votes
1answer
7k views

How does one enable remote listening with rsyslog?

I'm configuring a Debian Squeeze server to receive syslog from some appliances, but rsyslog is refusing to listen to UDP 514. The closest I have been able to get from it is to make it listen to TCP ...