rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

learn more… | top users | synonyms (1)

11
votes
2answers
5k views

How to keep haproxy log messages out of /var/log/syslog

I set up haproxy logging via rsyslogd using the tips from this article, and everything seems to be working fine. The log files get the log messages. However, every log message from haproxy also shows ...
7
votes
2answers
1k views

Syslog forwarding loses original hostname

I have DMZ hosts forwarding to a DMZ syslog which in turn forwards all the syslog messages to an internal syslog server. It's working fine for the most part but the internal syslog host messages ...
6
votes
1answer
22k views

How to restart rsyslog daemon on ubuntu

how can i restart rsyslog or rsyslogd on ubuntu 10 root@terminator:/etc/init.d# service rsyslog status rsyslog stop/waiting root@terminator:/etc/init.d# service rsyslog stop stop: Unknown instance: ...
6
votes
2answers
9k views

How do I get rsyslogd to log a server's FQDN instead of it's short hostname?

I'm trying to implement a simple centralized syslog server using stock rsyslogd (4.2.0-2ubuntu8.1) on Ubuntu 10.04 LTS. At this point I have all my client nodes sending logs to the central server, but ...
5
votes
1answer
4k views

Rsyslog.conf disable mail.info and/or disable postfix reporting

I have log entries like: Apr 8 10:25:31 monitor postfix/smtpd[3131]: connect from localhost[127.0.0.1] Apr 8 10:25:31 monitor postfix/smtpd[3131]: lost connection after CONNECT from ...
5
votes
2answers
136 views

Best place in network to put syslog server for DMZ hosts?

I have a firewalled router that connects to two virtual Lans. The first lan is an administration network and the second a DMZ. My virtual machines in the DMZ need to send syslog messages to a syslog ...
5
votes
1answer
468 views

rsyslog update on Amazon Linux suddenly treats INFO level messages as EMERG

I'm having strange issue with rsyslog on some of my EC2 instances running Amazon Linux 2012.3. Upon yum upgrading rsyslog 4.6 to 5.8.10, it seems like every INFO level log message is suddenly treated ...
5
votes
1answer
1k views

How to maintain the log source host using logstash

I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter. In the ...
4
votes
1answer
7k views

How to forward specific log file outside of /var/log with rsyslog to remote server?

How can I forward message from a specific log file like /www/myapp/log/test.log with rsyslog client to remote rsyslog server? This log file is outside of the directory /var/log.
4
votes
1answer
6k views

How can I log iptables in Ubuntu just in /var/log/firewall with rsyslogd

I am using ubuntu 10.10. with iptables! I want to log my firewall drops in the file /var/log/firewall and NOT in any other logfile. So I added the following line to my file: ...
4
votes
2answers
949 views

rsyslogd not monitoring all files

So.. I've installed Logstash, and instead of using the logstash shipper (because it needs the JVM and is generally massive), I'm using rsyslogd with the following configuration. # Use traditional ...
4
votes
2answers
718 views

How to escape or remove double quotes in rsyslog template

I want rsyslog to write log messages in JSON format, which requires to use double-quotes (") around strings. Problem is that values sometime include double-quotes themselves, and those need to be ...
4
votes
2answers
276 views

Is there a way to make TLS work with rsyslog in Ubuntu 12.04?

I configure rsyslog to load the TLS module (to talk to loggly) and I'm getting this error: Jun 20 13:14:00 feynman rsyslogd-2068: could not load module '/usr/lib/rsyslog/lmnsd_gtls.so', rsyslog error ...
4
votes
1answer
1k views

how to troubleshoot using rsyslog to output to a mysql database

Using FreeBSD 8.0 32 bit. I have installed rsyslogd 5.5.5 with ommysql. (installed ports /usr/ports/sysutils/rsyslog55 and /usr/ports/sysutils/rsyslog55-mysql) My rsyslog.conf file looks like: ...
3
votes
3answers
3k views

rsyslogd: Any way to get around the number of local facilities?

We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
3
votes
4answers
730 views

rsyslog or a similar distributed logging standard, for Windows?

I have a bunch of Windows Servers that run a bunch of apps, that log into local text files. I want to aggregate these text files into a centralized log server, where I can search them. Building ...
3
votes
2answers
590 views

How to redirect third party logs to log server in Centos

I want to setup a simple log server to accept logs from all clients. I am not talking about standard system logs such as /var/log/mail , message, boot etc. I want to redirect or send application logs ...
3
votes
2answers
1k views

syslog ip ranges to specific files using `rsyslog`

I have many Cisco / JunOS routers and switches that send logs to my Debian server, which uses rsyslogd. How can I configure rsyslogd to send these router / switch logs to a specific file, based on ...
3
votes
1answer
3k views

manually rotating logfile with rsyslogd

I want to force logfile rotation using logrotate -f /var/log/syslog, but it's only return tones of: error: syslog:1 unknown option 'May' -- ignoring line error: syslog:1 unexpected text I know that ...
3
votes
2answers
537 views

Rsyslog stops sending data to remote server after log rotation

In my configuration, I have rsyslog who is in charge of following changes of /home/user/my_app/shared/log/unicorn.stderr.log using imfile. The content is sent to another remote logging server using ...
3
votes
2answers
910 views

how to filer rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based ...
3
votes
1answer
63 views

Why Postfix on Linux require a “-” character before the pathname?

I´ve found the following here: IMPORTANT: on Linux you need to put a "-" character before the pathname, e.g., -/var/log/maillog, otherwise the syslogd process will use more system resources than ...
3
votes
4answers
6k views

Sending logs to Graylog2 server

I have just setup a Graylog2 server and I am looking to send all logs from my main server to the graylog server. I have enabled logging for the main server and am sending logs to my graylog server by ...
3
votes
1answer
3k views

rsyslog server - Can you split up and organize logs?

I recently setup one of our servers as an rsyslog server. I now have our firewall setup to log everything to that rsyslog server. But there doesn't seem to be an organization of the logs. All the ...
3
votes
1answer
5k views

rsyslog not logging messages

i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check ...
3
votes
2answers
184 views

Removing 'local7' log entries from /var/log/messages

Using rsyslog.conf on Ubuntu - The default line for /var/log/messages in 50-default.conf is: *.*;auth,authpriv.none -/var/log/syslog I'm starting to log a lot of things at the local7 level - ...
3
votes
1answer
901 views

Does the ``-'' sign have meaning in rsyslog.conf

Rsyslog is backwards-compatible with Syslog configuration files. The syslog.conf man page has: You may prefix each entry with the minus ``-'' sign to omit syncing the file after every ...
3
votes
2answers
266 views

Properly Configured Rsyslog on CentOS

I'm trying to configure Rsyslog 5.8.10 on CentOS 6.4 to send Apache's error and access logs to a remote server. It's working, but I have a couple questions. A) I would like to use as few queues (and ...
3
votes
1answer
132 views

firewall output flooding dmesg

I log all dropped packets using following iptables rule: -A INPUT -j LOG --log-prefix "FW_DROP: " --log-level 7 and then in rsyslog.conf, I redirect this output to a separate file, so that my ...
3
votes
4answers
824 views

CentOS centralised logging, syslogd, rsyslog, syslog-ng, logstash sender?

I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc. I've found a few different options but I'm not sure what would be best. ...
3
votes
1answer
951 views

Configuring Rsyslog To Stop The Logging Of Certain Messages

I want to stop rsyslog logging these messages. [168707.740364] TCP: Peer 192.168.100.1:46199/41503 unexpectedly shrunk window 2027330493:2027331431 (repaired) I tried this in the /etc/rsyslog.conf ...
3
votes
2answers
2k views

named stopped logging to rsyslog after logs rotate

CentOS 6.2, bind 9.7.3, rsyslog 4.6.2 I recently set up a server, and I noticed that named had stopped logging to /var/log/messages after the logs had rotated. I thought that was odd, since all ...
3
votes
1answer
316 views

rsyslog with heroku

I'm trying to capture logs from Heroku. I have setup as suggested http://devcenter.heroku.com/articles/logging#syslog_drains. I'm completely new to the rsyslog, please bear with me. Where do I see ...
3
votes
3answers
2k views

Filtering bad requests from Apache -> logger -> rsyslog to syslog-ng on a remote logging server possible?

EDIT: Thanks for the help Here is a quick idea of the setup: webserver X In apache httpd.conf: LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vcombined CustomLog ...
3
votes
1answer
3k views

Most functional log analysis tools? [closed]

I am curious as to what others find to be the most useful log analysis tools for *nix. Presently I am simply tailing output and grepping through things, however I'd like to use something that would ...
3
votes
1answer
171 views

Ubuntu 12.04 logger won't write to remote syslog

I'm trying to use logger to send events to a remote syslog server. The syslog server is Ubuntu 12.04 running the default rsyslogd. The "client" servers are both Ubuntu 12.04 and SLES11SP1. On SLES11, ...
2
votes
2answers
1k views

Increase rsyslog/syslog precision to include fractional seconds?

I use syslog and rsyslog to handle logging on my Linux & FreeBSD systems. The timestamp is currently in seconds but I would like to increase the precision of these timestamps to include ...
2
votes
2answers
1k views

Forward Windows Events Logs to Rsyslog

I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on. Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
2
votes
2answers
591 views

Centralized logging over intermittent connection

I'm using rsyslog to forward syslog entries from a pile of servers to Loggly The configuration looks something like this: # Config for loggly upload *.* @@logs.loggly.com:12345 This works, but ...
2
votes
1answer
39 views

Different permissions per log file when using rsyslog

Is it feasible to define different permissions per log file, using rsyslog? $FileCreateMode applies to all, but I want different permissions for a specific file.
2
votes
1answer
125 views

How to prevent logging of duplicated error messages in rsyslog?

After performing a software update, I got hundreds of errors that read like this: 2013-11-11 19:00:00 err user audispd - queue is full - dropping event Not sure if this is a bug, but it is rapidly ...
2
votes
3answers
228 views

Logging doesn't work after rsyslog upgrade

I have several different django applications under apache on a Red Hat server. These applications use SysLogHandler for sending log messages to the local rsyslog service. In order to pipe log messages ...
2
votes
1answer
368 views

Reason to use rsyslog for log rotating?

Is there any benefit to using rsyslog's rotation abilities over the standard /sbin/logrotate?
2
votes
2answers
19 views

Rsyslog duplicate logs (rsyslog.conf and rsyslog.d/something.conf)

I've created a custom log (php sends log entries to rsyslog) using local0. It uses a new custom file (/var/log/sea.log). The problem is that logs are being sent to /var/log/sea.log , ...
2
votes
3answers
167 views

How can I forward an application log to a remote log server?

I have an application which writes its own log file in /var/log/app/app.log. How can I forward these logs to a remote Rsyslog server?
2
votes
1answer
733 views

syslog writing to general instead of specific file

I'm running Ubuntu and Postgresql 9. I've enabled postgresql to log to syslog, and added the following directive to the config file: syslog_facility = 'local0'". I've tried to configure syslog ...
2
votes
3answers
1k views

Chained Syslog forwarding

Is there a way to chain syslog forwarding? For example, how can a clienthost forward its syslogs to ServerA and ServerA forward everything to CentralSyslogServer? I'm using rsyslog. The reason is ...
2
votes
1answer
1k views

rsyslog not logging to auth.log

I'm running Ubuntu server 10.04, and my auth.log is no longer getting updated. And actually my auth.log is empty and everything was being logged to auth.log.1, same with syslog, mail, and other logs. ...
2
votes
1answer
239 views

Failing forwarding rsyslog

I have a centralised rsyslog server A that receives a bunch of logs through TCP from servers X, Y, Z. It then stores the files on disk but also forwards them to logstash server B (on a different ...
2
votes
1answer
861 views

How do I setup rsyslog to send all logs to multiple remote servers?

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails. *.* @@server1 *.* @@server2 If I put the above in ...