Hot answers tagged

40

sudo service rsyslog restart That should do it.


21

Just setup an imfile rule in your /etc/rsyslog.conf #/etc/rsyslog.conf $ModLoad imfile $InputFileName /data/mysql/error.log $InputFileTag mysql-error $InputFileStateFile stat-mysql-error $InputFileSeverity error $InputFileFacility local3 $InputRunFileMonitor local3.* @@hostname:<portnumber> This watches a file and saves to the local3 facility in ...


18

You could also do the following which will make it so they don't go in any other logs: local0.* -/var/log/haproxy.log & ~ The & ~ means not to put what matched in the above line anywhere else for the rest of the rules.


18

I ran into this issue as well. Here is how I was able to fix it. On the clients modify the /etc/hosts file so the desired hostname comes before localhost. 127.0.0.1 hostnameforlogs localhost On the clients and server modify /etc/rsyslog.conf to include this statement: $PreserveFQDN on On the server I used the %HOSTNAME% variable for the templates in ...


11

Log the application name in your messages. Filter on the application name instead of facility. If your applications aren't generating syslog messages directly, you can apply an output filter (e.g., sed) to massage things to look the way you want. Take a look at the Rsyslog documentation on filter conditions to see how you might configure this behavior. ...


10

You don't tell logrotate which file to rotate on the command line. You pass it a configuration file. So in your case, logrotate is reading /var/log/syslog and trying to parse it as a config file and failing (hence your errors). If you want to rotate /var/log/syslog it needs to be listed in a logrotate config file somewhere, and you just run logrotate. If ...


9

FileCreateMode may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next $FileCreateMode directive. Order of lines is vitally important. http://www.rsyslog.com/doc/omfile.html


9

these are 3 different kind of log managers : it enables your system to collect filter, and transmit/store logs. Syslog (daemon also named sysklogd) is the default LM in common Linux distributions. Light but not very flexible, you can redirect log flux sorted by facility and severity to files and over network (TCP, UDP). rsyslog is an "advanced" version of ...


8

I've not used if like that (or syslogtag) but I have used :<blah>,<condition> ... (in particular :msg, contains,...) but try :syslogtag, isequal, "giomanager:" /var/log/giomanager.log & ~ The & ~ causes the matched message to be discarded after logging otherwise it will be further parsed by other rules. Update: tested and The ...


8

You are using the wrong syntax, you have to use ";" as a delimiter. This worked for me: *.*;mail.none;mail.error;auth,authpriv.none -/var/log/syslog You need to restart rsyslog after the changes. Reloading isn't enough.


7

Configure /etc/rsyslog.conf to preserve the FQDN: $PreserveFQDN on


7

Most modern Syslog daemons (including rsyslog and syslog-ng) support high precision timestamping. If you're using one of these tools, you should have no difficulty configuring it. As to it's accuracy. . . it depends. First of all, it's going to be dependent on the hardware. Most modern hardware supports high precision time, but not all. Assuming the ...


7

rsyslogd Configuration In /etc/rsyslogd.conf # provides remote UDP syslog reception $ModLoad imudp $UDPServerRun 514 # If logging to an NFS mount, use these settings... # "OMFileFlushOnTXEnd off" avoids fsync on every write... # mount -o hard,rsize=32768,wsize=32768,noacl,noatime,nodiratime -t nfs $OMFileIOBufferSize 768k $OMFileAsyncWriting on ...


7

this is only required if you still use syslogd or older rsyslog versions from http://www.rsyslog.com/doc/v3compatibility.html , section "Output File Syncing " Rsyslogd tries to keep as compatible to stock syslogd as possible. As such, it retained stock syslogd's default of syncing every file write if not specified otherwise (by placing a dash in ...


7

The problem was actually coming from logrotate. Basically with my configuration, running unicorn, I don't need to use the copytruncate directive. (which is what causes problems here) USR1 - Reopen all logs owned by the worker process. See Unicorn::Util.reopen_logs for what is considered a log. Log files are not reopened until it is done processing ...


6

This appears to be a bug in nc. The nc command uses the poll system call to wait until input is received from either stdin or the socket. When a UDP packet has been send to a closed UDP port on the receiving end, an error message is send back. The poll call will return this status to the nc command, but nc does not actually process the error. Instead nc ...


6

I believe haproxy only have syslog logging via UDP. What is your log config line in haproxy.cfg? Is it? log 127.0.0.1 local2 If so, you'll need to enable the UDP server modules in the rsyslog configuration by uncommenting: $ModLoad imudp.so $UDPServerRun 514 Tip: I run the following command on all my haproxy servers: sudo sed -i 's/#$ModLoad ...


6

This is old, but I thought I would write this method which I use for low/medium traffic site (don't know if it will work well for heavy traffic site): In Apache, I define a CustomLog format called graylog2_access which formats the access log into a GELF format and then I send my log through Graylog2 by piping the log data through nc to send GELF messages to ...


5

rsyslog needs a statement to stop logging after the match. Add this line immediately after the if statement you already have. & ~ You may also need to move both statement up in the conf file so that they are parsed before some of the other statements which might be logging them to messages. I change my rsyslog config to look like the following ...


5

It looks like it's as simple as two lines in the config file: *.* @loghost *.* /var/log/messages The rsyslog example configs have a few instances of teeing like this. The key one: kern.* /var/adm/kernel kern.crit @finlandia;RFC3164fmt kern.crit /dev/console kern.info;kern.!err /var/adm/kernel-info The second statement directs all kernel messages of the ...


5

AppArmor is possibly blocking rsyslogd from listening on this port. You can verify this by looking in the system log: grep apparmor /var/log/syslog If you see lines mentioning rsyslog then this is probably the cause. Edit /etc/apparmor.d/local/usr.sbin.rsyslogd (or /etc/apparmor.d/usr.sbin.rsyslogd if that doesn't exist) and add this between the curly ...


5

The only thing you need in rsyslog.conf to forward to a remote IP address is *.* @@192.0.2.25:514; Regarding your other question... I tried executing logger -p cron.info TEST on the client machine and found nothing is added to /var/log/cron! Be sure you restart rsyslogd after changing the configuration; you also need to be sure that /var/log/cron ...


5

You might be also interested in nxlog as it provides a wealth of features such as rfc5424 syslog format, TLS/SSL, filtering, rewrite, etc. (note: I'm affiliated with the project).


5

Rsyslog can group multiline log message into a single message via imfile module, however only following three read modes are supported: Line based (default) - each line is a new message. Paragraph - there is a blank line between log messages. Indented - new log messages start at the beginning of a line. If a line starts with a space it is part of the log ...


5

Most probably it's a file ownership problem. rsyslog starts running as root but then drops privileges and runs as user syslog (configuration directive $PrivDropToUser). syslog files (auth.log, daemon.log, etc.) initially are owned by syslog:adm but if you change ownership to root (as it seems from your file list) then no matter if you HUP (i.e., reload) ...


5

I want to rotate and separate the routers and switches in a log with a date stamp called 'rslog-YYYY-MM-DD' also the firewalls into a log with a date stamp called 'fwlog-YYYY-MM-DD' To start, you need to separate your firewall and switches with filtering in rsyslog. Exactly how to do this varies based on the version of rsyslog you are running. They have ...


4

To answer your question, you fist need to understand the different trade-off of reload and copytruncate: reload: the old log file is renamed and the process writing into that log is notified (via Unix signal) to re-create its log file. This is the fastest / lower overhead method: rename/move operations are very fast and have a constant execution time. ...


4

From Forwarding to More than One Server; What is important to know, however, is that the full set of directives make up an action. So you can not simply add (just) a second forwarding rule, but need to duplicate the rule configuration as well. Be careful that you use different queue file names for the second action, else you will mess up your system. ...


4

This is actually a deceptively complex question. :) One of my favorites. The question can be restated as "should a less trusted network be allowed access to a more trusted network, given that the only protocol is syslog"? You need to weigh the cost / benefit of placing your syslog server on the inside. I'm personally a proponent of having the syslog ...



Only top voted, non community-wiki answers of a minimum length are eligible