Questions tagged [rsyslog]

rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

Rsyslog imfile from NFS

The logs from DNS servers are written to a NFS shared directory which is mounted on the Linux syslog server. I want to use rsyslog filter on those files to look for specific keyword and if it exists ...
1
vote
0answers
8 views

Rsyslog Filter in Ruleset

I want to create a central rsyslog server, and I want to create a file per type of log received. I need a filter that will look for specific strings in the incoming messages and then place them in the ...
1
vote
0answers
16 views

append rsyslog PID in template filename

I have a template in my rsyslog and what i wish to do is add the process id of rsyslog to the end of the generated file. Note here that i need the pid of rsyslog server not the pid of the process ...
0
votes
1answer
13 views

Configure rsyslog to fallback to local logging

I have rsyslog setup to log to a central server over TCP. I'd prefer for it to log locally if the network or remote server is not available, but otherwise omit local logs. It's straight forward to log ...
0
votes
0answers
19 views

rsyslog - combining multiple property-based filters

I'm trying to write rsyslog messages received from a specific host to a log file based on the message content. Let's say I'd like to send messages received from "myserver" that contains the ...
0
votes
0answers
17 views

Duplicated log rsyslog 8.24

I received cisco asa syslog. The problem is the duplicated log. I try using $RepeatedMsgReduction in rsyslog.conf and change the /etc/systemd/journald.conf. My Rsyslog version is rsyslog-8.24 and ...
0
votes
0answers
36 views

Logrotate with nocreate not working

Below is my logrotate config. #copytruncate #nocreate compress dateformat %Y-%m-%d. dateext extension log /opt/logs/events/security_*.log { olddir /opt/archive_logs/events/ nocreate ...
0
votes
0answers
19 views

Rsyslogd module Error

I want to use capture packets by rsyslog with impcap but when I use it on configuration file I get this error: rsyslogd: version 8.2102.0, config validation run (level 1), master config /etc/rsyslog....
0
votes
1answer
42 views

How to configure log rotate to compress and archive logs weekly [closed]

We have rsyslog that save logs based on requirement to various directories: /opt/logs/stats/dc1/stats_YYYY-MM-DD_%somename%.log /opt/logs/stats/dc2/stats_YYYY-MM-DD_%somename%.log /opt/logs/events/dc1/...
0
votes
1answer
19 views

Save rsyslog messages to dynafile that extracts text from rawmsg

We have a few appliances that are sending syslog, unfortunately their hostname are not the same as the actual name configured on the service I'm running the latest rsyslog version. Currently I have ...
0
votes
1answer
44 views

Log systemd service stderr to different file using rsyslog

I have the following config in a systemd service: StandardOutput=syslog StandardError=syslog SyslogIdentifier=udocit And this rsyslog conf file: if $programname == 'udocit' and $syslogseverity > 5 ...
0
votes
0answers
17 views

CentOS - I have to restart rsyslog service to send logs again

Yesterday, I have configured some servers in my network so they was sending logs to a siem. Today, I noticed that there was no new logs on the SIEM. I had to restart the Rsyslog service and the ...
0
votes
1answer
17 views

rsyslog is putting log entries into an included file

I have an include directive in my rsyslog.conf file and rsyslog is appending data to it! I don't know why. I am running rsyslog 8.24 on RHEL7.7: rsyslog-8.24.0-38.el7.x86_64, kernel 3.10.0-1062.el7....
0
votes
1answer
87 views

rsyslog- what's the difference between $ModLoad and module(load)?

I'm on an RHEL 7.7 machine: Linux myhost 3.10.0-1062.el7.x86_64 #1 SMP Thu Jul 18 20:25:13 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux Running rsyslog-8.24.0-38.el7.x86_64 According to the rsyslog docs (...
0
votes
0answers
12 views

RSyslog v5 embedded system - template support for environment variables

I am trying to manipulate how Rsyslog sends data to a syslog server on an embedded system that runs Rsyslog version 5. As it is an embedded system there is no option to upgrade to a later version ...
0
votes
1answer
20 views

rsyslog tag based forwarding

I'm looking to do a tag based forwarding instead of using local1. local1 is used for other things so I don't want it to get mixed up. How can I do this? Here's my config forwarding nginx logs under /...
0
votes
1answer
66 views

Exclude remote syslog client logs from /var/log/syslog on host machine

Background: I have a lil Raspberry Pi server running the latest Raspbian OS running a number of network appliances to help manage a complex IOT LAN for a client. I have been using rsyslog to write ...
0
votes
0answers
18 views

Relay all received udp syslog only from any hosts to logstash, ignoring local socket collected syslog routed to /var/log files by default config

I have rsyslog server who should relay all received from network udp syslog (hundreds of hosts) to logstash syslog plugin on localhost:5514. How could I forward received from any hosts (0.0.0.0/0) ...
1
vote
0answers
61 views

How to include dynamic file as condition to rsyslog

I need to filter messages with rsyslog according dynamic hostnames, which are stored in external file. I would like to ask you, if it's possible something like this: if ($msg contains 'for i in `cat /...
1
vote
0answers
32 views

When restarting rsyslog for config reload, some logs are missed. How to avoid losing logs?

As per the answers here and here, restarting rsyslog is the correct way to do a config reload. But logs which rsyslog may have been processing at the time may be lost. Is there a way to avoid this by ...
0
votes
0answers
20 views

rsyslog queue doesn't retain the data to specified size

I've configured rsyslog to forward data using TCP output to serverX and in case of lack of connection to that server, the events should be cached to file and wait to return the connection (that is my ...
1
vote
0answers
89 views

Syslog-NG Error processing log message using IETF format

we've just changed our logging application on our AS/400 partitions and are now using a product called PowerTech SIEM agent for IBM I The tool used to format messages using the old syslog convention ...
0
votes
1answer
44 views

Rsyslog rotates, but still logging to old log

Server: Ubuntu Server 14.04 I have a Watchguard Firebox logging to a server. It is supposed to rotate daily, however, when the rotate occurs, it doesn't write to the new log. It keeps writing to the ...
0
votes
0answers
55 views

Configure rsyslog on a haproxy1.7 container

I'm using HAProxy 1.7 which needs rsyslog to push logs to stdout. Once the container writes logs to stdout, programs like filebeat or fluentd will pickup. Docker container has: Ubuntu 20.04, HAProxy ...
0
votes
1answer
27 views

rsyslog single filter conditional syntax

I'm looking for a way to write a single rule with multiple match values, don't write those rows to logfile if the message contain first word or second word. This works but isn't DRY: if $msg contains &...
0
votes
1answer
66 views

rsyslog conf file syntax multiple filters

I'm setting up rsyslog on a Red Hat 8 system. I have the the first part working, that being filtering based on source IP, putting logs in a specific file, like this: if $fromhost-ip startswith '10.1.2....
2
votes
1answer
56 views

rsyslog unexpected end of file on log files with OMFileZipLevel

OS: Centos7 rsyslog: 8.24.0 I have various hosts sending logs to my centralised rsyslog server. I use OMFileZipLevel option in my config file to compress my logs and then zcat anytime i wish to view ...
2
votes
0answers
31 views

Recommendations for high-volume request logs from containers

We have a service that uses raw AWS EC2 instances to field requests. Response times are in the 2-3 ms range. That response time is important to the health and success of the service. Part of the ...
0
votes
1answer
45 views

Rsyslog using more memory on CentOS 7

I see rsyslog is using more memory on my EC2 instance. Is there a way we can fix it? I tried cat /proc/<pid_of_rsyslogd>/limits and tried changing the limit value but no luck. Max stack size ...
0
votes
0answers
135 views

Messages appears with delayed in /var/log/messages

I'm using rsyslog to collect logs from multiple servers which are all being sent to a single server. I've noticed that logs sometime appears with delay of 2-5 minutes in /var/log/messages of the ...
1
vote
2answers
45 views

Rsyslog forward log with space in path or name

How would one go about forwarding a log file with a space in the filename or path using Rsyslog? $ModLoad imfile $InputFileName /var/lib/plexmediaserver/Library/Application\ Support/Plex\ Media\ ...
0
votes
0answers
26 views

Why is rsyslog concatenating log entries and inserting “var - - - ” into them?

I have rsyslog setup and it is full of entries looking like this: <133>1 2020-12-11T10:22:31.865164+00:00 example-hostname var - - - <133>1 2020-12-11T10:15:51.647499+00:00 example-...
1
vote
1answer
25 views

Unable to get rsyslog to save only msg without timestamp

When I have the default settings, my logs are like this: 2020-12-01T18:34:06+02:00 10.132.90.194 {"wfd_successful_hits_sec": "0", "sql_hits_sec_max": "0", "...
0
votes
0answers
62 views

forward logfiles of any format using rsyslog

I want to forward the log-files of some applications on my linux-system (periodically) from server A to server B. I could probably use FTP but there are probably other tools which are more "...
0
votes
0answers
21 views

Rsyslog: Template filtering on properties

I have been using a legacy template for my rsyslog server. We are trying to upgrade to v8 of rsyslog. One of the things I noticed happening was the rsyslog was that messages coming in from my Cisco ...
0
votes
1answer
35 views

rsyslog on CentOS 8.2

I just configured rsyslog 8.1911 on CentOS 8.2. The server rsyslog.conf has these lines $template RemoteLogs,"/logs/serverlogs/%$YEAR%-%$MONTH%-$DAY%/%HOSTNAME%/%PROGRAMNAME%.log" *.* ?...
0
votes
0answers
48 views

send logs of flask through rsyslog on remote server

I have flask running in my environment which creates logs in /var/log/api/api.log. i have configured rsyslog service to send all logs to my remote server but rsyslog sending api.logs to syslog file ...
1
vote
1answer
212 views

Rsyslog 8 dynafile with a template

I'm trying to setup rsyslog to use the template RSYSLOG_TraditionalFileFormat as the default action template, but for some specific messages i need to use another template. In both cases i need ...
0
votes
0answers
96 views

LogAnalyzer some fields does not work

I have recently installed adiscon loganalyzer on my CentOS 8 central logs database server. I managed to install it but it came out with some issues. First of all, all the fields during installation ...
0
votes
0answers
42 views

Forward log only from a specific log file

I have an application sending logs to var/log/myapplication.log. I wish to send these logs to a remote syslog server. I am sending them currently via rsyslog, but the application logs are being ...
1
vote
1answer
221 views

Rsyslog forward using original source IP over TLS

I'm trying to forward all syslog messages over TLS from our enviroment to an external syslog server (dest.syslog.example.com) using rsyslog. Unfortunately the source IP is changed to that of the relay ...
0
votes
0answers
171 views

Why does custom rsyslog log file permissions comes up all questions marks?

This is infuriating me. I have a basic rsyslog.d customization to write a dedicated log file for a service, but the file ownership is all ??? when I try to read it as a non-root user. I feel it's a ...
0
votes
0answers
24 views

Rsyslog - monitoring multiple files with tagging

I going to monitor multiple files in a directory with wildcard. My config looks like that: input(type="imfile" tag="cmd1" ruleset="debug_file" file="/my_dir/*") ...
1
vote
1answer
262 views

How to use rsyslog templates to write log files based on a wildcard syslog facility?

My systemd target/service design has multiple sub-services all uniquely identified. My test.target requires 10 test-@.service instances. The result is target runs and there are 10 identified services....
0
votes
0answers
26 views

rsyslog: Filter and Consolidate

I've got a very simple setup with logs being collected from three servers: 10.0.4.1, 10.0.4.2, and 10.0.4.3 Config files, in /etc/rsyslog.d/syslogconfig.conf, follow this pattern [with changed IP ...
0
votes
0answers
155 views

Rsyslog custom imfile, multiline sending as separate messages on remote server

I am having a custom log file which i need to send to remote server with start and end tags. My log file: <exclusive-start 1 <exclusive-end <exclusive-start 2 <exclusive-end assdaddas <...
0
votes
1answer
60 views

sshd doesn't show failed login attempts in syslog on CentOS 7

after some tinkering with rsyslog, sshd no longer logs information about failed login attempts to syslog for some reason. I've returned both sshd and rsyslog configs back to where it was: rpm -V $(rpm ...
0
votes
0answers
34 views

automatically retrieve some fields from log file

My fortigate firewall send log message to my syslog server (CentOS 7). The syslog server store them to *.log file with rsyslog. Like this: Sep 24 00:00:00 192.168.20.20 date=2020-09-24 time=01:00:00 ...
0
votes
1answer
269 views

rsyslog filter not working

I am on debian 10 and I'm trying to do a very simple thing with rsyslog : I would like to redirect all logs from a particuliar docker container into a log file. I set a tag to my docker container, and ...
0
votes
0answers
41 views

Forwarded syslogs received on port 514 of local system doesn't shows up in /var/log/messages despite configured UDP/TCP input

Below the rsyslog.conf file is the "Out Of the Box" unmodified except UDP and TCP input have been uncommented . Using tcpdump I can see logs arriving on port 514 TCP but they are not copied ...

1
2 3 4 5
13