Tag Info

New answers tagged

0

The command is "$stop", not "$ stop". There's a huge difference there.


0

Just in case you keep looking for it, here's the answer. At rsyslog server, if for example you have defined this template for remote logs, you should use %FROMHOST% variable instead of %HOSTNAME% : $template RemoteLogs, "/media/largeHDD/logs/%FROMHOST%/%PROGRAMNAME%.log" * *.* ?RemoteLogs & ~


0

I don't recommend relying on the inode. It will change any time the file moves from the source to the destination machine. It will also change if the files are restored from backups. If the log processing system depends on the inode, if you ever restore from backups the system will not work as you expected. My recommendation is to NOT copy A.log, but ...


0

Ok, I figured it out, I just had to add this in /etc/rsyslog.conf: $template RemoteHost,"/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/syslog.log" *.* ?RemoteHost *.* @@127.0.0.1:514 & ~


0

rsyslog can emit RFC5424 messages with structured data. But do you also have a way to send RFC5424 messages to rsyslog? -- It should work if you log your messages directly via UDP or TLS. But if you log via traditional BSD Syslog functions then there will not be any structured data, nor any MSGID. (AFAIK NetBSD has the only RFC5424 capable libc with a ...


1

you must have something like that at your rsyslog config file *.*;auth,authpriv.none -/var/log/syslog If you take a look, you are registering ALL severities from ALL facilities, to the syslog file, except auth and authpriv facilities. Simply add the facility wich you don't want to log, plus the "none" severity. I.E: local6: ...


3

Basically, they are all the same, in the way they all permit to log data from different types of systems in a central repository. But they are three different project, each project trying to improve the previous one with more reliability and functionnalities. The Syslog project was the very first project. It started in 1980. It is the root project to ...


3

these are 3 different kind of log managers : it enables your system to collect filter, and transmit/store logs. Syslog (daemon also named sysklogd) is the default LM in common Linux distributions. Light but not very flexible, you can redirect log flux sorted by facility and severity to files and over network (TCP, UDP). rsyslog is an "advanced" version of ...


0

Reading from /proc/kmsg require superuser permissions. Did you start rsyslogd as root? If so, please run the command ls -al /proc/kmsg and paste here the output.


0

This depends completely on how the process is writing logs. copytruncate only works, if the log messages are appended to the file (e.g. whatever >> logfile. And not when it is redirecting the output (e.g. whatever > logfile).


2

To answer your question, you fist need to understand the different trade-off of reload and copytruncate: reload: the old log file is renamed and the process writing into that log is notified (via Unix signal) to re-create its log file. This is the fastest / lower overhead method: rename/move operations are very fast and have a constant execution time. ...


2

You are using a customized path for your log file, so selinux is blocking you. Try to issue setenforce 0 and to restart rsyslog. If it now work, it is confirmed that your problem was selinux. To permanently correct that while continue to use selinux, you need to issue semanage fcontext -a -t var_log_t '/opt/rsyslog(/.*)?'; restorecon -RF /opt/rsyslog ...



Top 50 recent answers are included