New answers tagged

0

the logging via unix socket log does not work for me on my rhel 6.7.you can have a try with this conf. haproxy (working on 81) forward http request to httpd (working on 80) /etc/haproxy/haproxy.cfg frontend web_front log 127.0.0.1 local6 option httplog bind *:81 default_backend web_back backend web_back server ...


1

First, make a config file in /etc/rsyslog.d, such as 01-alpha.conf, to make things organized. This way, your 01-alpha.conf will be read first than 50-default.conf. 50-default.conf has a rule to log everything in /var/log/syslog, so in this example we will be discarding the message after writing it in alpha's logs. In 01-alpha.conf: :programname, isequal, ...


0

I would suggest to avoid the "pull" method, unless you are completely sure (or completely don't care) about your security. If logs are stored localhost (on the client side) the intruder can easily tamper them and not only make the investigation harder, but also lead you to false directions. Having that said, maybe the best way to go is to forward logs into ...


0

I assume you can ssh between your machines. Maybe you can try to tunnel syslog over ssh


1

For your rsyslog listen to the UDP port that you defined, you need to discomment or include this module on your rsyslog.conf: $ModLoad imudp $UDPServerRun 514 On the client that is going to send the messages to the server, use this syntax for UDP: *.* @SERVER-IP:UDP-PORT You can manipulate the above example as you wish. Like: local1.* ...


0

If you have sure that your configurations files is right, make the file yourself, but make sure to give permissions to syslog user. chown syslog:adm /var/log/haproxy.log This should do the trick. Make sure to restart both rsyslog and haproxy.


1

When your /etc/rsyslog.conf loads yours *.conf in /etc/rsyslog.d, it reads your files alphabetically. So, you need to make sure that your rules are in a file that comes before 50-default.conf, like: 01-myiptablesrules.conf This way, your rules will be read first, and discard it. You should also use this syntax: :msg, contains, "iptables@@" { *.* ...


0

Please restart haproxy to create new file. For erasing haproxy use this command Echo > /haproxy log location


0

You probably want to look at this: http://www.rsyslog.com/doc/droppriv.html Even though rsyslog starts as root, it's quite possible it changes it's user inside /etc/rsyslog.conf. You may want to change rsyslog's privileges inside your rsyslog configuration.


0

Is there a line in your rsyslog config files that prints the message to /var/log/kern.log? If so, post that code. Also post your rsyslog verison number. In the meantime, this could work: :msg,contains,"iptables@@" /var/log/iptables.log :msg,contains,"iptables@@" ~ Though I believe once you do that second line, rsyslog will ...



Top 50 recent answers are included