0
votes
0answers
16 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
1
vote
2answers
30 views

Rsyslog filter by client

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side. I added this line ...
1
vote
1answer
28 views

Forwarding Syslog/Event Log Across Networks

I am trying to Forward syslogs and Event Logs across networks (internet). Win Computer ----| (There will be multiples of these forwarding to a single ...
0
votes
1answer
38 views

Converting to rsyslog v7 new config format

I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy ...
0
votes
1answer
29 views

Syslog and LogAnalyzer - how to retrive source IPs and count them

I have set centralized Syslog (centOS + rsys) server which runs LogAnalyzer for better log presentation. Recently I have got asked to provide logs from the firewall of all IPs for particular firewall ...
1
vote
1answer
47 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
1
vote
1answer
78 views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
0
votes
2answers
58 views

Find syslog priortiy/ severity of a message

Is there a way to find the syslog priority or severity of log entries using a standard unix tool? For example I could grep for the word error in a log. But not all logs will state the word "error" ...
1
vote
0answers
67 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
1
vote
2answers
111 views

Log ssh sessions to rsyslog

How can I setup rsyslog to log commands typed in a ssh session? Just in case someone unauthorized ever accesses the system, I'd like to know what he did.
1
vote
1answer
64 views

Pipe program output to rsyslog

I have a process running that writes it's output to a file, like this. processx > /var/log/processx.log 2>&1 How would I write/pipe/forward this to rsyslog instead (including the ...
3
votes
2answers
266 views

Properly Configured Rsyslog on CentOS

I'm trying to configure Rsyslog 5.8.10 on CentOS 6.4 to send Apache's error and access logs to a remote server. It's working, but I have a couple questions. A) I would like to use as few queues (and ...
0
votes
0answers
37 views

software to view logs on remote server [closed]

I have configured syslog server on my linux machine like this Linux Machine (syslog client) -- > Linux Machine (syslog server) I have configured it and its working properly. Now, the problem is I ...
1
vote
1answer
152 views

Getting logs from remote clients via rsyslog

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp ...
1
vote
1answer
241 views

Configuring JBoss AS 7.2 to log to syslog

In my standalone.xml, I have the syslog-handler configured like so: <syslog-handler name="SYSLOG" enabled="true"> <level name="INFO"/> <hostname value="i-XXXXXXX"/> ...
2
votes
1answer
241 views

Failing forwarding rsyslog

I have a centralised rsyslog server A that receives a bunch of logs through TCP from servers X, Y, Z. It then stores the files on disk but also forwards them to logstash server B (on a different ...
1
vote
1answer
201 views

cPanel and forwarding logs to the remote syslog server

I have fully working remote syslog server which receiving logs from servers and devices. I have try to setup cPanel/WHM syslog to forward logs to that remote server but so far I'm not seeing anything ...
2
votes
1answer
441 views

How to send NAGIOS alerts to OSSIM server

I've installed an OSSIM server and I wanto to retrieve the alerts generated by a remote Nagios server in order to analyze them and perform correlation of security events. Before putting hands on it, ...
1
vote
2answers
167 views

How can you filter mail.info from syslog?

How do I filter mail.info from /var/log/syslog (rsyslog.conf/Debian) while keeping messages greater than or equal to mail.warn? I've tried just about every different variation of appending and ...
2
votes
1answer
870 views

How do I setup rsyslog to send all logs to multiple remote servers?

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails. *.* @@server1 *.* @@server2 If I put the above in ...
1
vote
0answers
57 views

How to dynamically generate $LocalHostName value rsyslog

I have set up a central remote syslog server where I am sending all my logs. There will be many machines logging to the syslog server. On the client machine, in the rsyslog.conf I am trying to modify ...
3
votes
2answers
917 views

how to filer rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based ...
0
votes
1answer
98 views

intercept, evaluate, change syslog messages

is it possible to intercept syslog messages and evaluate (in special cases change) them before they are written into /var/log/? At the moment i m using inotify to monitor the log file and write the ...
2
votes
1answer
644 views

How to configure rsyslog to log into PostgreSQL without too much latency?

I'm trying to configure RSyslog on a Debian machine to log everythingo into PostgreSQL, while also logging as usual on disk. I'm using a pretty stock Debian configuration and I activated the related ...
-1
votes
2answers
286 views

Rsyslog: Difference between logging to a UNIX domain socket or an INET socket (UDP)

I am observing the following behaviour when logging to syslog from an external application: if I send a well-formed syslog message to a UDP socket, rsyslog correctly parses it, however if the very ...
2
votes
1answer
458 views

Wildcard support for InputFileName in rsyslog?

We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName? Example: InputFileName: ...
0
votes
1answer
70 views

Can Rsyslog process messages before saving them?

The messages that I'm sending to syslog have some tags like so: "[date] [text here] tags:tag1,tag2,tag3 [more text here]" I already have a rule that only saves lines that contain the text "tags:" ...
1
vote
0answers
91 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
2
votes
1answer
159 views

Rsyslog messages are truncated, not sent to the correct file

On Ubuntu 10.04 LTS, I'm using the stock rsyslog configuration and added a custom file in /etc/rsyslog.d with the following contents: # cat /etc/rsyslog.d/62-pc local3.debug /var/log/pc/debug.log ...
2
votes
2answers
332 views

rsyslog - regex trouble

I'm trying to setup the logentries service. If a log entry has a token in it then I would like to send it to api.logentries.com:10000. The token is a guid in the format ...
3
votes
4answers
825 views

CentOS centralised logging, syslogd, rsyslog, syslog-ng, logstash sender?

I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc. I've found a few different options but I'm not sure what would be best. ...
2
votes
1answer
41 views

How to configure syslogd name/identifier?

I'm forwarding all syslog events to papertrailapp.com, and they are identified as sent by localhost. It's not convenient, since I have a few servers and all of them are localhost-s. How can I ...
0
votes
3answers
479 views

imuxsock messages in syslog and system becomes unresponsive

I am getting such messages in syslog. rsyslogd-2177: imuxsock lost 21869 messages from pid 3418 due to rate-limiting rsyslogd-2177: imuxsock begins to drop messages from pid 3427 due to rate-limiting ...
2
votes
1answer
688 views

Ubuntu syslog: After log rotation nothing is written on /var/log/syslog

I've been running a Ubuntu VPS for a few weeks now, so a couple of monthly log rotations took place yestarday. For things like /var/log/wtmp things look as expected: logfile has recent entries, while ...
2
votes
0answers
82 views

Why don't cfn-init logs get sent by rsyslog?

I just signed up for Papertrail to aggregate logs from some AWS instances I'm setting up with CloudFormation::Init. I've followed the instructions and added *.* @logs.papertrailapp.com to the end of ...
2
votes
2answers
1k views

Forward Windows Events Logs to Rsyslog

I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on. Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
3
votes
1answer
5k views

rsyslog not logging messages

i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check ...
1
vote
1answer
201 views

Rsyslog Discarding Unwanted Messages

Once again, i found that Rsyslog is not as flexible as i expected... My application logs to LOCAL5.* ( depending on the severity ) I would like to see on my centralized log server only ...
1
vote
2answers
530 views

Why aren't Heroku syslog drains logging to rsyslogd?

I'm having a problem using syslog drains as described in https://devcenter.heroku.com/articles/logging. To summarize, I have an Ubuntu 10.04 instance on EC2 that is running rsyslogd. I've also set ...
1
vote
2answers
4k views

rsyslog: How do I direct messages from all remote machines to one file?

We have a syslog server and we have all our servers logging to it. We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for. Anyone know how to ...
3
votes
3answers
3k views

rsyslogd: Any way to get around the number of local facilities?

We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
5
votes
1answer
1k views

How to maintain the log source host using logstash

I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter. In the ...
2
votes
1answer
734 views

syslog writing to general instead of specific file

I'm running Ubuntu and Postgresql 9. I've enabled postgresql to log to syslog, and added the following directive to the config file: syslog_facility = 'local0'". I've tried to configure syslog ...
2
votes
2answers
1k views

Increase rsyslog/syslog precision to include fractional seconds?

I use syslog and rsyslog to handle logging on my Linux & FreeBSD systems. The timestamp is currently in seconds but I would like to increase the precision of these timestamps to include ...
0
votes
1answer
82 views

syslog - log line classifications [closed]

A very generic question; in the context of a programmer, with operational aspect of the process (program) in mind. Is there any sort of best-practice / guide to classify messages, particularly in the ...
2
votes
3answers
595 views

Syslog severity levels when to use Alert vs Critical

Short overview: Is Alert more severe than Critical. RFC 5424 briefly defines syslog severity levels and gives a short description. Each syslog level is given a code 0 - 7. It was my understanding ...
0
votes
2answers
2k views

RSyslog does not work with a log file located outside of /var/log

I am unable to get rsyslog to write to a log file located in a directory other than /var/log. The server is RHELS 5.6 and for the most part with a default configuration. Other than the rsyslog ...
0
votes
2answers
1k views

How to configure JBoss AS 7 to log to syslog?

How do i configure jboss to log to syslog?
0
votes
2answers
360 views

log forwarding performance and OS bottleneck

How many logs/second can usually be handled by syslog servers? By syslog servers, I am referring to rsyslog, syslog-ng, splunk etc. The intent of the question is to find out at what logs/second rate ...
1
vote
2answers
578 views

How to set up mysql storage for certain rsyslog input matches?

I'm draining various logs from Heroku to an rsyslog linux (ubuntu) server and am starting to have a little more to bite off than I can chew in terms of working with my log histories. I am needing to ...