Tag Info

Hot answers tagged

26

sudo service rsyslog restart That should do it.


15

Just setup an imfile rule in your /etc/rsyslog.conf #/etc/rsyslog.conf $ModLoad imfile $InputFileName /data/mysql/error.log $InputFileTag mysql-error $InputFileStateFile stat-mysql-error $InputFileSeverity error $InputFileFacility local3 $InputRunFileMonitor local3.* @@hostname:<portnumber> This watches a file and saves to the local3 facility in ...


13

You could also do the following which will make it so they don't go in any other logs: local0.* -/var/log/haproxy.log & ~ The & ~ means not to put what matched in the above line anywhere else for the rest of the rules.


9

Log the application name in your messages. Filter on the application name instead of facility. If your applications aren't generating syslog messages directly, you can apply an output filter (e.g., sed) to massage things to look the way you want. Take a look at the Rsyslog documentation on filter conditions to see how you might configure this behavior. ...


8

You are using the wrong syntax, you have to use ";" as a delimiter. This worked for me: *.*;mail.none;mail.error;auth,authpriv.none -/var/log/syslog You need to restart rsyslog after the changes. Reloading isn't enough.


8

You don't tell logrotate which file to rotate on the command line. You pass it a configuration file. So in your case, logrotate is reading /var/log/syslog and trying to parse it as a config file and failing (hence your errors). If you want to rotate /var/log/syslog it needs to be listed in a logrotate config file somewhere, and you just run logrotate. If ...


7

Most modern Syslog daemons (including rsyslog and syslog-ng) support high precision timestamping. If you're using one of these tools, you should have no difficulty configuring it. As to it's accuracy. . . it depends. First of all, it's going to be dependent on the hardware. Most modern hardware supports high precision time, but not all. Assuming the ...


6

I ran into this issue as well. Here is how I was able to fix it. On the clients modify the /etc/hosts file so the desired hostname comes before localhost. 127.0.0.1 hostnameforlogs localhost On the clients and server modify /etc/rsyslog.conf to include this statement: $PreserveFQDN on On the server I used the %HOSTNAME% variable for the templates in ...


6

FileCreateMode may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next $FileCreateMode directive. Order of lines is vitally important. http://www.rsyslog.com/doc/omfile.html


6

This appears to be a bug in nc. The nc command uses the poll system call to wait until input is received from either stdin or the socket. When a UDP packet has been send to a closed UDP port on the receiving end, an error message is send back. The poll call will return this status to the nc command, but nc does not actually process the error. Instead nc ...


5

It looks like it's as simple as two lines in the config file: *.* @loghost *.* /var/log/messages The rsyslog example configs have a few instances of teeing like this. The key one: kern.* /var/adm/kernel kern.crit @finlandia;RFC3164fmt kern.crit /dev/console kern.info;kern.!err /var/adm/kernel-info The second statement directs all kernel messages of the ...


5

Configure /etc/rsyslog.conf to preserve the FQDN: $PreserveFQDN on


5

rsyslogd Configuration In /etc/rsyslogd.conf # provides remote UDP syslog reception $ModLoad imudp $UDPServerRun 514 # If logging to an NFS mount, use these settings... # "OMFileFlushOnTXEnd off" avoids fsync on every write... # mount -o hard,rsize=32768,wsize=32768,noacl,noatime,nodiratime -t nfs $OMFileIOBufferSize 768k $OMFileAsyncWriting on ...


5

You might be also interested in nxlog as it provides a wealth of features such as rfc5424 syslog format, TLS/SSL, filtering, rewrite, etc. (note: I'm affiliated with the project).


5

I've not used if like that (or syslogtag) but I have used :<blah>,<condition> ... (in particular :msg, contains,...) but try :syslogtag, isequal, "giomanager:" /var/log/giomanager.log & ~ The & ~ causes the matched message to be discarded after logging otherwise it will be further parsed by other rules. Update: tested and The ...


5

Rsyslog can group multiline log message into a single message via imfile module, however only following three read modes are supported: Line based (default) - each line is a new message. Paragraph - there is a blank line between log messages. Indented - new log messages start at the beginning of a line. If a line starts with a space it is part of the log ...


4

It has the same function. Docs (cached version, since the original is returning an error right now)


4

Rsyslog has a pretty good configuration system which allows you to create logs in many different ways. Check the online docs. Specifically you may want to check out the configuration samples. This recipe may be close to what you want. http://wiki.rsyslog.com/index.php/Sysklogd_drop-in_with_remote_logs_separated_by_dynamic_directory


4

I would suggest that if you're already using logrotate, there's no reason to switch. In particular, since logrotate will handle log rotation for things other than syslog (e.g., Apache logfiles), this lets you configure your log rotation policies in one location rather than having to create per-application rotation policies.


4

Splunk? http://www.splunk.com You get the centralized logging and searching all together, and there is a windows version


4

Have you read the man page for the rsylog.conf (or rsyslog.config) file? It says: Modules ... imudp Input plugin for UDP syslog. Replaces the deprecated -r option. Can be used like this: $ModLoad imudp $UDPServerRun 514 ...


4

SELinux will prevent processes that are labeled syslogd_t to write to files that are (probably) labeled default_t. You need to label the file with something syslogd_t can write to. Files in /var/log are mostly labeled var_log_t, a type syslogd_t can surely write to. You should not just relabel the files in /Testing to var_log_t, because that's bound to ...


4

Rsyslog is able to buffer messages to disk if it is unable to contact a remote server. The default rsyslog.conf on my Fedora system includes the following example: # ### begin forwarding rule ### # The statement between the begin ... end define a SINGLE forwarding # rule. They belong together, do NOT split them. If you create multiple # forwarding rules, ...


4

I found out what I had done wrong, with the help of Heroku Support. (Thanks guys!) I had used the wrong security group name (default instead of logplex). (Dynos run under default, so that's why nc worked.) These are the appropriate values for the fields in the AWS Security Group web interface: Create a new rule: Custom TCP rule Port range: 514 Source: ...


4

Most likely you are running into a bug/limitation of SysLogHandler that leads to a BOM inserted in the wrong place. This confuses the rsyslog parser, and leads to the message being attributed the EMERG priority. This has been "fixed" in Python 2.7 by removing the BOM insertion altogether. You have two options: Upgrade to Python 2.7 Encode the message ...


4

There are two main approaches to this I've seen. Firstly many applications will have the ability to write to a syslog host natively. This is the best route to go. In other cases I'll use a basic script - something like shown below works. sudo tail /my/app/log | nc -w0 -u 192.168.1.1 514 EDIT - there is indeed a way to handle this within syslog-ng if ...


4

I believe haproxy only have syslog logging via UDP. What is your log config line in haproxy.cfg? Is it? log 127.0.0.1 local2 If so, you'll need to enable the UDP server modules in the rsyslog configuration by uncommenting: $ModLoad imudp.so $UDPServerRun 514 Tip: I run the following command on all my haproxy servers: sudo sed -i 's/#$ModLoad ...


4

this is only required if you still use syslogd or older rsyslog versions from http://www.rsyslog.com/doc/v3compatibility.html , section "Output File Syncing " Rsyslogd tries to keep as compatible to stock syslogd as possible. As such, it retained stock syslogd's default of syncing every file write if not specified otherwise (by placing a dash in ...


4

This is actually a deceptively complex question. :) One of my favorites. The question can be restated as "should a less trusted network be allowed access to a more trusted network, given that the only protocol is syslog"? You need to weigh the cost / benefit of placing your syslog server on the inside. I'm personally a proponent of having the syslog ...


4

The problem was actually coming from logrotate. Basically with my configuration, running unicorn, I don't need to use the copytruncate directive. (which is what causes problems here) USR1 - Reopen all logs owned by the worker process. See Unicorn::Util.reopen_logs for what is considered a log. Log files are not reopened until it is done processing ...



Only top voted, non community-wiki answers of a minimum length are eligible