Tag Info

New answers tagged

5

Rsyslog can group multiline log message into a single message via imfile module, however only following three read modes are supported: Line based (default) - each line is a new message. Paragraph - there is a blank line between log messages. Indented - new log messages start at the beginning of a line. If a line starts with a space it is part of the log ...


1

rsyslogd is not configured to break lines like that. It's possible to use log format templates but I'm not sure they allow lines to be broken like that. This is most likely what the application is sending to rsyslogd. You can try to capture the communication on port and check what is being sent (tcpdump -s 0 -A port 514). Another test is to use logger to ...


1

Yes, templates is a standard and recommended way to generate dynamic file names in rsyslog. They allow you to logically separate the file name format from the action and introduce clear structure to your config. Regarding TCP, Jenny D already gave you correct answer. Please note that your hosts need to support syslog over TCP. Syslog was initially based on ...


0

From the manual page: To forward messages to another host via UDP, prepend the hostname with the at sign ("@"). To forward it via plain tcp, prepend two at signs ("@@"). So change your config line like so: kern.* @@loghost and tell rsyslog to reread the config file.


-5

EDIT:Not applicable here, but if you stumble on this thread while trying to debug a similar issue for http/https: Ensure that you put in https and not http in the browser/client. Stunnel does not do a automatic redirect to https when someone goes to http


2

If I'm not mistaken, rsyslog forwards logs over TCP (in the config file, this is listed as "for reliability"), but fluentD's listener defaults to listening on UDP. This change to your fluentD config should allow you to receive the logs on TCP: <source> type syslog port 42185 protocol_type tcp tag rsyslog </source> I would check with ...


0

Finally got access to a testing Linux system. Suddenly I remembered: rsyslogd writes syslogs as the syslog user, not as root. (Verified using ps aux | grep [r]syslog) So, chown syslog.syslog /var/log/iptables.log should fix the problem. (Solution tested and working on my system)


6

This appears to be a bug in nc. The nc command uses the poll system call to wait until input is received from either stdin or the socket. When a UDP packet has been send to a closed UDP port on the receiving end, an error message is send back. The poll call will return this status to the nc command, but nc does not actually process the error. Instead nc ...


0

I don't know about creating the directories, but the rest should be handled by filters and dynamic file names. Normally in a case like this I would log file pattern like. /var/log/<server_name>{messages,mail,auth,etc}.YYYYMMDD Having the logs separated by server may make tracing conditions across servers difficult. The log messages typically ...



Top 50 recent answers are included