rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

17
votes
1answer
46k views

How to restart rsyslog daemon on ubuntu

how can i restart rsyslog or rsyslogd on ubuntu 10 root@terminator:/etc/init.d# service rsyslog status rsyslog stop/waiting root@terminator:/etc/init.d# service rsyslog stop stop: Unknown instance: ...
14
votes
3answers
16k views

How to keep haproxy log messages out of /var/log/syslog

I set up haproxy logging via rsyslogd using the tips from this article, and everything seems to be working fine. The log files get the log messages. However, every log message from haproxy also shows ...
12
votes
2answers
15k views

How do I get rsyslogd to log a server's FQDN instead of it's short hostname?

I'm trying to implement a simple centralized syslog server using stock rsyslogd (4.2.0-2ubuntu8.1) on Ubuntu 10.04 LTS. At this point I have all my client nodes sending logs to the central server, but ...
11
votes
2answers
18k views

How to forward specific log file outside of /var/log with rsyslog to remote server?

How can I forward message from a specific log file like /www/myapp/log/test.log with rsyslog client to remote rsyslog server? This log file is outside of the directory /var/log.
8
votes
2answers
63 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
7
votes
2answers
3k views

Syslog forwarding loses original hostname

I have DMZ hosts forwarding to a DMZ syslog which in turn forwards all the syslog messages to an internal syslog server. It's working fine for the most part but the internal syslog host messages ...
7
votes
3answers
2k views

Configuring Rsyslog To Stop The Logging Of Certain Messages

I want to stop rsyslog logging these messages. [168707.740364] TCP: Peer 192.168.100.1:46199/41503 unexpectedly shrunk window 2027330493:2027331431 (repaired) I tried this in the /etc/rsyslog.conf ...
6
votes
1answer
7k views

Rsyslog.conf disable mail.info and/or disable postfix reporting

I have log entries like: Apr 8 10:25:31 monitor postfix/smtpd[3131]: connect from localhost[127.0.0.1] Apr 8 10:25:31 monitor postfix/smtpd[3131]: lost connection after CONNECT from ...
6
votes
2answers
3k views

Rsyslog stops sending data to remote server after log rotation

In my configuration, I have rsyslog who is in charge of following changes of /home/user/my_app/shared/log/unicorn.stderr.log using imfile. The content is sent to another remote logging server using ...
5
votes
2answers
5k views

rsyslogd: Any way to get around the number of local facilities?

We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
5
votes
2answers
6k views

how to filter rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based ...
5
votes
2answers
469 views

Best place in network to put syslog server for DMZ hosts?

I have a firewalled router that connects to two virtual Lans. The first lan is an administration network and the second a DMZ. My virtual machines in the DMZ need to send syslog messages to a syslog ...
5
votes
1answer
724 views

rsyslog update on Amazon Linux suddenly treats INFO level messages as EMERG

I'm having strange issue with rsyslog on some of my EC2 instances running Amazon Linux 2012.3. Upon yum upgrading rsyslog 4.6 to 5.8.10, it seems like every INFO level log message is suddenly treated ...
5
votes
1answer
3k views

How to maintain the log source host using logstash

I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter. In the ...
4
votes
3answers
6k views

Log Locally and Remotely with rsyslogd

How can I make it so log file is stored both remotely and locally using rsyslog?
4
votes
4answers
13k views

Sending logs to Graylog2 server

I have just setup a Graylog2 server and I am looking to send all logs from my main server to the graylog server. I have enabled logging for the main server and am sending logs to my graylog server by ...
4
votes
1answer
7k views

manually rotating logfile with rsyslogd

I want to force logfile rotation using logrotate -f /var/log/syslog, but it's only return tones of: error: syslog:1 unknown option 'May' -- ignoring line error: syslog:1 unexpected text I know that ...
4
votes
1answer
2k views

Different permissions per log file when using rsyslog

Is it feasible to define different permissions per log file, using rsyslog? $FileCreateMode applies to all, but I want different permissions for a specific file.
4
votes
2answers
5k views

syslog ip ranges to specific files using `rsyslog`

I have many Cisco / JunOS routers and switches that send logs to my Debian server, which uses rsyslogd. How can I configure rsyslogd to send these router / switch logs to a specific file, based on ...
4
votes
1answer
3k views

haproxy not logging

I have configured rsyslog (CentOS 6.3) adding the -c 0 -r options and the line local2.* /var/log/haproxy.log and restarted rsyslog but all that happens is an haproxy.log gets created. It is never ...
4
votes
2answers
3k views

rsyslog - configuration help - logrotate and compression

I am a newbie to Linux and rsyslog. I have used the logfiles for many years, but I have never had to set one up. At this point I have some Proof of Concept devices pointing to my Debain Linux server. ...
4
votes
2answers
3k views

rsyslogd not monitoring all files

So.. I've installed Logstash, and instead of using the logstash shipper (because it needs the JVM and is generally massive), I'm using rsyslogd with the following configuration. # Use traditional ...
4
votes
1answer
11k views

rsyslog not logging messages

i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check ...
4
votes
1answer
381 views

Random SSH entries in Auth.log out of date order [duplicate]

Running an Ubuntu Trusty 14.04.1 LTS server at Rackspace but recently after running updates for bash, then with the reboots for the xen host vulnerability, I have the following weird issue. Some ...
4
votes
3answers
2k views

Wildcard support for InputFileName in rsyslog?

We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName? Example: InputFileName: ...
4
votes
1answer
8k views

How can I log iptables in Ubuntu just in /var/log/firewall with rsyslogd

I am using ubuntu 10.10. with iptables! I want to log my firewall drops in the file /var/log/firewall and NOT in any other logfile. So I added the following line to my file: ...
4
votes
4answers
1k views

CentOS centralised logging, syslogd, rsyslog, syslog-ng, logstash sender?

I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc. I've found a few different options but I'm not sure what would be best. ...
4
votes
1answer
515 views

Rsyslog Discarding Unwanted Messages

Once again, i found that Rsyslog is not as flexible as i expected... My application logs to LOCAL5.* ( depending on the severity ) I would like to see on my centralized log server only ...
4
votes
2answers
668 views

Is there a way to make TLS work with rsyslog in Ubuntu 12.04?

I configure rsyslog to load the TLS module (to talk to loggly) and I'm getting this error: Jun 20 13:14:00 feynman rsyslogd-2068: could not load module '/usr/lib/rsyslog/lmnsd_gtls.so', rsyslog error ...
4
votes
2answers
1k views

How to escape or remove double quotes in rsyslog template

I want rsyslog to write log messages in JSON format, which requires to use double-quotes (") around strings. Problem is that values sometime include double-quotes themselves, and those need to be ...
4
votes
1answer
2k views

how to troubleshoot using rsyslog to output to a mysql database

Using FreeBSD 8.0 32 bit. I have installed rsyslogd 5.5.5 with ommysql. (installed ports /usr/ports/sysutils/rsyslog55 and /usr/ports/sysutils/rsyslog55-mysql) My rsyslog.conf file looks like: ...
4
votes
2answers
409 views

Ubuntu 12.04 logger won't write to remote syslog

I'm trying to use logger to send events to a remote syslog server. The syslog server is Ubuntu 12.04 running the default rsyslogd. The "client" servers are both Ubuntu 12.04 and SLES11SP1. On SLES11, ...
4
votes
0answers
356 views

rSyslog and short hostname

I'm working with rsyslog through multiple hops. What I want is the following, I do not want the short hostname in the msg I only want the IP. So the server sending the msg I do not want it to add its ...
3
votes
2answers
3k views

Increase rsyslog/syslog precision to include fractional seconds?

I use syslog and rsyslog to handle logging on my Linux & FreeBSD systems. The timestamp is currently in seconds but I would like to increase the precision of these timestamps to include ...
3
votes
4answers
896 views

rsyslog or a similar distributed logging standard, for Windows?

I have a bunch of Windows Servers that run a bunch of apps, that log into local text files. I want to aggregate these text files into a centralized log server, where I can search them. Building ...
3
votes
2answers
961 views

How to redirect third party logs to log server in Centos

I want to setup a simple log server to accept logs from all clients. I am not talking about standard system logs such as /var/log/mail , message, boot etc. I want to redirect or send application logs ...
3
votes
1answer
529 views

Difference between /dev/udp and netcat

I have a syslog server listening on localhost:514 as UDP and would like to write messages to it on that port. (Using Ubuntu 14.04) If I run either of these commands this from bash it prints the date ...
3
votes
1answer
481 views

How do I configure rsyslog to deal with MySQL Slow Query Log multi-line messages?

Using rsyslog v8.2.2, I would like to group multi-line messages, such as those output by the MySQL Slow Query log. Each new message begins with three consecutive lines having '#' as the first char of ...
3
votes
2answers
2k views

Rsyslog duplicate logs (rsyslog.conf and rsyslog.d/something.conf)

I've created a custom log (php sends log entries to rsyslog) using local0. It uses a new custom file (/var/log/sea.log). The problem is that logs are being sent to /var/log/sea.log , ...
3
votes
2answers
922 views

Centralized logging over intermittent connection

I'm using rsyslog to forward syslog entries from a pile of servers to Loggly The configuration looks something like this: # Config for loggly upload *.* @@logs.loggly.com:12345 This works, but ...
3
votes
2answers
550 views

How can you filter mail.info from syslog?

How do I filter mail.info from /var/log/syslog (rsyslog.conf/Debian) while keeping messages greater than or equal to mail.warn? I've tried just about every different variation of appending and ...
3
votes
1answer
5k views

How do I setup rsyslog to send all logs to multiple remote servers?

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails. *.* @@server1 *.* @@server2 If I put the above in ...
3
votes
2answers
6k views

Rsyslog is not working properly, it does not log anything

I'm running a Debian server and a couple of days ago my rsyslog started to behave very weird, the daemon is running but it doesn't seem to do anything. Many people use the system but I'm the only one ...
3
votes
1answer
103 views

Why Postfix on Linux require a “-” character before the pathname?

I´ve found the following here: IMPORTANT: on Linux you need to put a "-" character before the pathname, e.g., -/var/log/maillog, otherwise the syslogd process will use more system resources than ...
3
votes
1answer
3k views

Does the ``-'' sign have meaning in rsyslog.conf

Rsyslog is backwards-compatible with Syslog configuration files. The syslog.conf man page has: You may prefix each entry with the minus ``-'' sign to omit syncing the file after every ...
3
votes
1answer
4k views

rsyslog server - Can you split up and organize logs?

I recently setup one of our servers as an rsyslog server. I now have our firewall setup to log everything to that rsyslog server. But there doesn't seem to be an organization of the logs. All the ...
3
votes
1answer
1k views

Failing forwarding rsyslog

I have a centralised rsyslog server A that receives a bunch of logs through TCP from servers X, Y, Z. It then stores the files on disk but also forwards them to logstash server B (on a different ...
3
votes
1answer
2k views

Errors using new rsyslog template syntax on RHEL6

I'm migrating our rsyslog config from an old server to a new one, and thought I'd use the opportunity to tidy up our config. The old config used "legacy" template definitions, and the rsyslog doc on ...
3
votes
2answers
575 views

Removing 'local7' log entries from /var/log/messages

Using rsyslog.conf on Ubuntu - The default line for /var/log/messages in 50-default.conf is: *.*;auth,authpriv.none -/var/log/syslog I'm starting to log a lot of things at the local7 level - ...
3
votes
1answer
2k views

syslog writing to general instead of specific file

I'm running Ubuntu and Postgresql 9. I've enabled postgresql to log to syslog, and added the following directive to the config file: syslog_facility = 'local0'". I've tried to configure syslog ...