Tag Info

Hot answers tagged

31

sudo service rsyslog restart That should do it.


17

Just setup an imfile rule in your /etc/rsyslog.conf #/etc/rsyslog.conf $ModLoad imfile $InputFileName /data/mysql/error.log $InputFileTag mysql-error $InputFileStateFile stat-mysql-error $InputFileSeverity error $InputFileFacility local3 $InputRunFileMonitor local3.* @@hostname:<portnumber> This watches a file and saves to the local3 facility in ...


13

You could also do the following which will make it so they don't go in any other logs: local0.* -/var/log/haproxy.log & ~ The & ~ means not to put what matched in the above line anywhere else for the rest of the rules.


10

Log the application name in your messages. Filter on the application name instead of facility. If your applications aren't generating syslog messages directly, you can apply an output filter (e.g., sed) to massage things to look the way you want. Take a look at the Rsyslog documentation on filter conditions to see how you might configure this behavior. ...


9

I ran into this issue as well. Here is how I was able to fix it. On the clients modify the /etc/hosts file so the desired hostname comes before localhost. 127.0.0.1 hostnameforlogs localhost On the clients and server modify /etc/rsyslog.conf to include this statement: $PreserveFQDN on On the server I used the %HOSTNAME% variable for the templates in ...


8

You are using the wrong syntax, you have to use ";" as a delimiter. This worked for me: *.*;mail.none;mail.error;auth,authpriv.none -/var/log/syslog You need to restart rsyslog after the changes. Reloading isn't enough.


7

Most modern Syslog daemons (including rsyslog and syslog-ng) support high precision timestamping. If you're using one of these tools, you should have no difficulty configuring it. As to it's accuracy. . . it depends. First of all, it's going to be dependent on the hardware. Most modern hardware supports high precision time, but not all. Assuming the ...


7

You don't tell logrotate which file to rotate on the command line. You pass it a configuration file. So in your case, logrotate is reading /var/log/syslog and trying to parse it as a config file and failing (hence your errors). If you want to rotate /var/log/syslog it needs to be listed in a logrotate config file somewhere, and you just run logrotate. If ...


7

I've not used if like that (or syslogtag) but I have used :<blah>,<condition> ... (in particular :msg, contains,...) but try :syslogtag, isequal, "giomanager:" /var/log/giomanager.log & ~ The & ~ causes the matched message to be discarded after logging otherwise it will be further parsed by other rules. Update: tested and The ...


7

FileCreateMode may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next $FileCreateMode directive. Order of lines is vitally important. http://www.rsyslog.com/doc/omfile.html


6

This appears to be a bug in nc. The nc command uses the poll system call to wait until input is received from either stdin or the socket. When a UDP packet has been send to a closed UDP port on the receiving end, an error message is send back. The poll call will return this status to the nc command, but nc does not actually process the error. Instead nc ...


6

Configure /etc/rsyslog.conf to preserve the FQDN: $PreserveFQDN on


5

It looks like it's as simple as two lines in the config file: *.* @loghost *.* /var/log/messages The rsyslog example configs have a few instances of teeing like this. The key one: kern.* /var/adm/kernel kern.crit @finlandia;RFC3164fmt kern.crit /dev/console kern.info;kern.!err /var/adm/kernel-info The second statement directs all kernel messages of the ...


5

rsyslogd Configuration In /etc/rsyslogd.conf # provides remote UDP syslog reception $ModLoad imudp $UDPServerRun 514 # If logging to an NFS mount, use these settings... # "OMFileFlushOnTXEnd off" avoids fsync on every write... # mount -o hard,rsize=32768,wsize=32768,noacl,noatime,nodiratime -t nfs $OMFileIOBufferSize 768k $OMFileAsyncWriting on ...


5

You might be also interested in nxlog as it provides a wealth of features such as rfc5424 syslog format, TLS/SSL, filtering, rewrite, etc. (note: I'm affiliated with the project).


5

Rsyslog can group multiline log message into a single message via imfile module, however only following three read modes are supported: Line based (default) - each line is a new message. Paragraph - there is a blank line between log messages. Indented - new log messages start at the beginning of a line. If a line starts with a space it is part of the log ...


5

The problem was actually coming from logrotate. Basically with my configuration, running unicorn, I don't need to use the copytruncate directive. (which is what causes problems here) USR1 - Reopen all logs owned by the worker process. See Unicorn::Util.reopen_logs for what is considered a log. Log files are not reopened until it is done processing ...


4

This is actually a deceptively complex question. :) One of my favorites. The question can be restated as "should a less trusted network be allowed access to a more trusted network, given that the only protocol is syslog"? You need to weigh the cost / benefit of placing your syslog server on the inside. I'm personally a proponent of having the syslog ...


4

Putting that error (without the datetime) into google and following the first link and the response it gets leads to reading the audispd and audispd.conf man pages, the latter contains this useful information q_depth This is a numeric value that tells how big to make the internal queue of the audit event dis- patcher. ...


4

Most likely you are running into a bug/limitation of SysLogHandler that leads to a BOM inserted in the wrong place. This confuses the rsyslog parser, and leads to the message being attributed the EMERG priority. This has been "fixed" in Python 2.7 by removing the BOM insertion altogether. You have two options: Upgrade to Python 2.7 Encode the message ...


4

I found out what I had done wrong, with the help of Heroku Support. (Thanks guys!) I had used the wrong security group name (default instead of logplex). (Dynos run under default, so that's why nc worked.) These are the appropriate values for the fields in the AWS Security Group web interface: Create a new rule: Custom TCP rule Port range: 514 Source: ...


4

There are two main approaches to this I've seen. Firstly many applications will have the ability to write to a syslog host natively. This is the best route to go. In other cases I'll use a basic script - something like shown below works. sudo tail /my/app/log | nc -w0 -u 192.168.1.1 514 EDIT - there is indeed a way to handle this within syslog-ng if ...


4

Most probably it's a file ownership problem. rsyslog starts running as root but then drops privileges and runs as user syslog (configuration directive $PrivDropToUser). syslog files (auth.log, daemon.log, etc.) initially are owned by syslog:adm but if you change ownership to root (as it seems from your file list) then no matter if you HUP (i.e., reload) ...


4

From Forwarding to More than One Server; What is important to know, however, is that the full set of directives make up an action. So you can not simply add (just) a second forwarding rule, but need to duplicate the rule configuration as well. Be careful that you use different queue file names for the second action, else you will mess up your system. ...


4

I believe haproxy only have syslog logging via UDP. What is your log config line in haproxy.cfg? Is it? log 127.0.0.1 local2 If so, you'll need to enable the UDP server modules in the rsyslog configuration by uncommenting: $ModLoad imudp.so $UDPServerRun 514 Tip: I run the following command on all my haproxy servers: sudo sed -i 's/#$ModLoad ...


4

this is only required if you still use syslogd or older rsyslog versions from http://www.rsyslog.com/doc/v3compatibility.html , section "Output File Syncing " Rsyslogd tries to keep as compatible to stock syslogd as possible. As such, it retained stock syslogd's default of syncing every file write if not specified otherwise (by placing a dash in ...


4

Rsyslog has a pretty good configuration system which allows you to create logs in many different ways. Check the online docs. Specifically you may want to check out the configuration samples. This recipe may be close to what you want. http://wiki.rsyslog.com/index.php/Sysklogd_drop-in_with_remote_logs_separated_by_dynamic_directory


4

It has the same function. Docs (cached version, since the original is returning an error right now)


4

Splunk? http://www.splunk.com You get the centralized logging and searching all together, and there is a windows version


4

It sounds like logrotate successfully moved /var/log/auth.log to /var/log/auth.log.1 , but did not successfully reload the rsyslog daemon. Therefore, the rsyslog thinks it is still writing to /var/log/auth.log . If you reload the rsyslog daemon, does it work for you? A quick manual fix for this is be to restart the rsyslog daemon. rsyslog will then write ...



Only top voted, non community-wiki answers of a minimum length are eligible