Tagged Questions
0
votes
1answer
33 views
Rsyslog: Difference between logging to a UNIX domain socket or an INET socket (UDP)
I am observing the following behaviour when logging to syslog from an external application: if I send a well-formed syslog message to a UDP socket, rsyslog correctly parses it, however if the very ...
2
votes
1answer
43 views
Wildcard support for InputFileName in rsyslog?
We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName?
Example:
InputFileName: ...
0
votes
1answer
37 views
Can Rsyslog process messages before saving them?
The messages that I'm sending to syslog have some tags like so:
"[date] [text here] tags:tag1,tag2,tag3 [more text here]"
I already have a rule that only saves lines that contain the text "tags:" ...
0
votes
0answers
31 views
Rsyslog Output Files - Reload on Rotate?
Good morning,
I'm new to everything sysadmin.
I"m trying to set a few server processes to log to rsyslog (for future shipping abilities, etc.), but want to have clean log files on my local machine ...
1
vote
0answers
57 views
Writing templates for rsyslog
When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
2
votes
1answer
100 views
Rsyslog messages are truncated, not sent to the correct file
On Ubuntu 10.04 LTS, I'm using the stock rsyslog configuration and added a custom file in /etc/rsyslog.d with the following contents:
# cat /etc/rsyslog.d/62-pc
local3.debug /var/log/pc/debug.log
...
2
votes
2answers
190 views
rsyslog - regex trouble
I'm trying to setup the logentries service. If a log entry has a token in it then I would like to send it to api.logentries.com:10000. The token is a guid in the format ...
0
votes
0answers
141 views
Apache multiple vhost logs, stored locally and sent to remote logstash
I'm investigating centralised logging and it seems there's so many different ways this can be done.
I don't want to run logstash as a log "sender", preferring to keep the web servers as lean and ...
3
votes
2answers
510 views
CentOS centralised logging, syslogd, rsyslog, syslog-ng, logstash sender?
I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc.
I've found a few different options but I'm not sure what would be best. ...
2
votes
1answer
39 views
How to configure syslogd name/identifier?
I'm forwarding all syslog events to papertrailapp.com, and they are identified as sent by localhost. It's not convenient, since I have a few servers and all of them are localhost-s. How can I ...
0
votes
1answer
167 views
imuxsock messages in syslog and system becomes unresponsive
I am getting such messages in syslog.
rsyslogd-2177: imuxsock lost 21869 messages from pid 3418 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 3427 due to rate-limiting
...
1
vote
1answer
237 views
Ubuntu syslog: After log rotation nothing is written on /var/log/syslog
I've been running a Ubuntu VPS for a few weeks now, so a couple of monthly log rotations took place yestarday. For things like /var/log/wtmp things look as expected: logfile has recent entries, while ...
2
votes
0answers
53 views
Why don't cfn-init logs get sent by rsyslog?
I just signed up for Papertrail to aggregate logs from some AWS instances I'm setting up with CloudFormation::Init. I've followed the instructions and added *.* @logs.papertrailapp.com to the end of ...
1
vote
2answers
392 views
Forward Windows Events Logs to Rsyslog
I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on.
Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
3
votes
1answer
3k views
rsyslog not logging messages
i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check ...
0
votes
0answers
127 views
Expression-Based Filters not working in rsyslog
Probably a Quick one.
What is wrong with my syntax in this statement? rsyslog keeps complaining.
if $fromhost-ip == "172.16.255.3" and $programname == "named" then /syslogs/named.log
in logs when ...
1
vote
1answer
148 views
Rsyslog Discarding Unwanted Messages
Once again, i found that Rsyslog is not as flexible as i expected...
My application logs to LOCAL5.* ( depending on the severity )
I would like to see on my centralized log server only ...
1
vote
2answers
380 views
Why aren't Heroku syslog drains logging to rsyslogd?
I'm having a problem using syslog drains as described in https://devcenter.heroku.com/articles/logging.
To summarize, I have an Ubuntu 10.04 instance on EC2 that is running rsyslogd. I've also set ...
1
vote
2answers
2k views
rsyslog: How do I direct messages from all remote machines to one file?
We have a syslog server and we have all our servers logging to it.
We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.
Anyone know how to ...
2
votes
3answers
1k views
rsyslogd: Any way to get around the number of local facilities?
We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
5
votes
1answer
809 views
How to maintain the log source host using logstash
I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter.
In the ...
2
votes
1answer
440 views
syslog writing to general instead of specific file
I'm running Ubuntu and Postgresql 9.
I've enabled postgresql to log to syslog, and added the following directive to the config file:
syslog_facility = 'local0'".
I've tried to configure syslog ...
2
votes
2answers
809 views
Increase rsyslog/syslog precision to include fractional seconds?
I use syslog and rsyslog to handle logging on my Linux & FreeBSD systems.
The timestamp is currently in seconds but I would like to increase the precision of these timestamps to include ...
0
votes
1answer
69 views
syslog - log line classifications [closed]
A very generic question; in the context of a programmer, with operational aspect of the process (program) in mind.
Is there any sort of best-practice / guide to classify messages, particularly in the ...
2
votes
3answers
425 views
Syslog severity levels when to use Alert vs Critical
Short overview: Is Alert more severe than Critical.
RFC 5424 briefly defines syslog severity levels and gives a short description. Each syslog level is given a code 0 - 7. It was my understanding ...
0
votes
2answers
911 views
RSyslog does not work with a log file located outside of /var/log
I am unable to get rsyslog to write to a log file located in a directory other than /var/log.
The server is RHELS 5.6 and for the most part with a default configuration. Other than the rsyslog ...
0
votes
2answers
793 views
0
votes
2answers
307 views
log forwarding performance and OS bottleneck
How many logs/second can usually be handled by syslog servers? By syslog servers, I am referring to rsyslog, syslog-ng, splunk etc. The intent of the question is to find out at what logs/second rate ...
1
vote
2answers
439 views
How to set up mysql storage for certain rsyslog input matches?
I'm draining various logs from Heroku to an rsyslog linux (ubuntu) server and am starting to have a little more to bite off than I can chew in terms of working with my log histories.
I am needing to ...
2
votes
1answer
450 views
snort not logging full output to syslog
I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
0
votes
2answers
1k views
Redirecting Syslog events from RHEL 6 to RHEL 5: is it possible to provide with the same event format?
For some reasons, we redirect syslog events from RHEL 6 (with rsyslog) to RHEL 5 (with syslogd).
On RHEL 6 in rsyslog.conf:
*.* @10.30.46.211
On RHEL 5 in /etc/sysconfig/syslog:
...
0
votes
1answer
435 views
Sending multiple loglines (mysql-slow.log, php5-fpm.log.slow) to syslog
I'm trying to aggregate several sources of error messages into one place, to easier put things into context. I'm currently looking at rsyslog, but I can change this - if it's preventing me from doing ...
7
votes
2answers
822 views
Syslog forwarding loses original hostname
I have DMZ hosts forwarding to a DMZ syslog which in turn forwards all the syslog messages to an internal syslog server. It's working fine for the most part but the internal syslog host messages ...
2
votes
3answers
573 views
Chained Syslog forwarding
Is there a way to chain syslog forwarding? For example, how can a clienthost forward its syslogs to ServerA and ServerA forward everything to CentralSyslogServer?
I'm using rsyslog.
The reason is ...
3
votes
4answers
625 views
rsyslog or a similar distributed logging standard, for Windows?
I have a bunch of Windows Servers that run a bunch of apps, that log into local text files.
I want to aggregate these text files into a centralized log server, where I can search them. Building ...
1
vote
2answers
910 views
Using rsyslog to create different log files for different processes
Scenario: I am running a cluster of machines. Each machine runs various python programs with a unique (across the cluster), but dynamically set, ID.
Right now, they are all logging locally. So, I ...
1
vote
0answers
151 views
Rsyslog's RELP format; experience?
1) In your experience, does rsyslog's RELP log transfer format require a significant amount of resources over what plain TCP syslog transfer would use? (cpu, disk i/o, network)
2) IYHO, is TCP ...
1
vote
1answer
249 views
Best practices for discarding messages in (r)syslog?
I've setup a central rsyslog server that is writing events to a MySQL database.
Looking through the events one sees all kinds of events that are probably unnecessarily captured.
On RHEL/CentOS ...
4
votes
1answer
3k views
Rsyslog.conf disable mail.info and/or disable postfix reporting
I have log entries like:
Apr 8 10:25:31 monitor postfix/smtpd[3131]: connect from localhost[127.0.0.1]
Apr 8 10:25:31 monitor postfix/smtpd[3131]: lost connection after CONNECT from ...
0
votes
1answer
3k views
How does one enable remote listening with rsyslog?
I'm configuring a Debian Squeeze server to receive syslog from some appliances, but rsyslog is refusing to listen to UDP 514.
The closest I have been able to get from it is to make it listen to TCP ...
1
vote
1answer
295 views
rsyslog to fifo
I want to have a rsyslog log its data to a fifo that a daemon creates. However, if the daemon isn't running and the fifo isn't there then rsyslog will just start writing to a file in its place.
Is ...
0
votes
1answer
462 views
Stop messages from going to /var/log/debug
I have a daemon running, milter-regex that is absolutely polluting my /var/log/debug file. After some digging around I thought by adding the "daemon.err;daemon.notice /var/log/milter-regex" that that ...
1
vote
1answer
3k views
rsyslog filters on message contents and facility
I have found examples of how to filter based on the contents of a log entry with rsyslog. But is there a way to do this so it is only filtering on the contents of a certain facility? For example ...
1
vote
3answers
3k views
Log Locally and Remotely with rsyslogd
How can I make it so log file is stored both remotely and locally using rsyslog?
0
votes
1answer
567 views
how do you convert this syslog-ng cfg to rsyslog?
How do I convert the following to rsyslog syntax?
filter local2 { facility(local2); };
filter not_local2 { not facility(local2); };
destination server2 { tcp("server2" port(1111)); };
...
