Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [rsyslog]

rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Kubernetes pod name or print something unique in the pod logs entries or any alternative (rsyslog implementation)

I have implemented Rsyslog server for fetch the pod logs from EKS nodes (Rsyslog client). Everything is working fine but in the logs I need pod name or something uniq to identify the log entries ...
Harish KM's user avatar
0 votes
1 answer
39 views

Is there a way to prevent log spamming with rsyslog?

I have AuditD running and one process like to constantly spawn children processes that do the same activity. Is there a way to have rsyslog not send in the same log message again? The hard part is the ...
Jason's user avatar
  • 3,941
0 votes
0 answers
70 views

Re-configuration of rsyslog

Probably a bit of an "off-kilter" question, but I want to conduct some experiments with rsyslog. I'd like to configure it to log nothing except the messages that I send with logger. This is ...
Seamus's user avatar
  • 293
0 votes
0 answers
22 views

Rsyslog is not saving logs from different networks correctly

I am trying to set up rsyslog server, that would save the logs into database. I coded web app easily maintain and search through logs. But I have multiple networks there (not at home, but in work ...
Izzy's user avatar
  • 1
0 votes
1 answer
77 views

Rsyslog filter on machine hostname and not previous rsyslog server

I have a requirement to forward logs from hostname X to IP 1.1.1.1. However, the feed that is being received is from another Rsyslog server Y. Due to this, the existing condition is not working as it ...
helpthehelper's user avatar
0 votes
1 answer
98 views

How can I prepend the sender IP on each line in Rsyslog, using the newer template() syntax?

I've run an rsyslog server at our organization for a decade or so now. When we get a new device we want to centralize the logging for, we point it at the rsyslog server's IP address and away it logs. ...
HappMacDonald's user avatar
0 votes
0 answers
23 views

Rsyslog storing only certain type of events in a file

I am collecting TM Deepsecurity events on my syslog server. The TM manager sends logs to my syslog server on port 514. There are two types of events TM sends. Deep Security Agent & Deep ...
Nav's user avatar
  • 1
0 votes
0 answers
34 views

How to get syslogd and/or Apache2 to STOP logging DEBUG messages to console

When I SSH into one of my Linux boxes (Ubuntu 20.04.2), I periodically see messages appear on the console screen: Message from syslogd@my-hostname at Jan 30 21:35:17 ... apache2: [MY-APP] DEBUG - 2024-...
GregSD's user avatar
  • 1
0 votes
1 answer
28 views

How to send rotated logs to rsyslog server?

I want to send all the rotated logs from client to my rsyslog server. I already tried using the modfile, but it sends the running logs not the rotated logs (gunzip).
Jessica Martinez's user avatar
0 votes
1 answer
51 views

Failed to make rsyslog filter to particular file

I configure the rsyslog server with /var/rsyslog/foo.conf to accept the udp messages $ModLoad imudp $UDPServerRun 514 And try to filter the log contents start with "foo" to /var/log/foo.log....
Hans Chen's user avatar
  • 101
7 votes
2 answers
15k views

Where is some os logs in Debian 12

It seems that some of the system log files (/var/log/syslog, /var/log/auth.log, /var/log/kern.log, ...) have been removed in the latest version of Debian, Debian Bookworm. What should be done to ...
Omidreza Bagheri's user avatar
0 votes
1 answer
138 views

Ubuntu system logs written to ".log.1" instead of ".log" after rotation

I have an EC2 instance on AWS with Ubuntu 16.04.4 LTS where system logs are written into ".log.1" instead of ".log" (e.g. /var/log/auth.log.1 instead of /var/log/auth.log). This is ...
Henrik Koberg's user avatar
0 votes
1 answer
151 views

How can I monitor journald to invoke a program on a condition?

Before I reinvent the wheel and start scripting, is there a simple way (or existing tool) that can watch the systemd journal and take actions when certain log entries or conditions are detected? ...
Nick's user avatar
  • 4,636
0 votes
1 answer
100 views

logrotate wont compress and delete syslog templated files

I am facing a very weird issue with logrotate and syslog files on my central syslog server. What is happening is that files generated by syslog templates are not compressed nor deleted when logrotate ...
giomanda's user avatar
  • 1,854
0 votes
0 answers
82 views

Enable $RepeatedMsgReduction only for specific log file

If this were the script for routing messages to log files in rsyslog.conf, is it possible to activate RepeatedMsgReduction only for app_log? if ($syslogfacility-text == "auth") then { ...
zeroKool's user avatar
1 vote
0 answers
60 views

Configuration Issues for Log Collection and Sending in rSyslog Linux

I am trying to send logs to an NLB endpoint from Syslog on a Linux server using local0, local1, etc. variables and pointing to etl folders that I have on the same server. I am having trouble with the ...
Kenneth Quintal's user avatar
0 votes
0 answers
169 views

Rsyslog output to Kafka Timing Out

I'm having trouble setting up Rsyslog output to Kafka using the omkafka module. I have a robust Kafka cluster running in a production environment. In the current workflow, Rsyslog receives events on ...
Anthony Collier's user avatar
0 votes
1 answer
419 views

Rysyslog is not using the short hostname, and is instead using the FQDN

I have an ryslog server (V8.2112.0) running on Ubuntu (22.04.2), with very basic setup to receive logs from Cisco switches. The server and all the switches are in the same domain. I'm trying to use ...
RazzyKitty's user avatar
0 votes
1 answer
252 views

Rsyslog not writing any logs from Cisco network devices - all other remote syslog works fine

tcpdump confirms valid syslog is coming in from multiple remote systems - servers and Cisco network equipment. OS is Linux RHEL 8.8 The servers all come in fine and write to disk, and are shown as ...
mkramer317's user avatar
1 vote
0 answers
225 views

How to set proctitle to ascii in auditd?

I configured auditd to send the logs to SIEM through rsyslog. But when I get those logs the proctitle is in hex. Ex.: <134>Aug 25 17:08:44 vmauditd tag_audit_log: node=vmauditd type=PROCTITLE ...
Sandson Costa's user avatar
0 votes
1 answer
2k views

Issue Getting Rsyslog TLS Configuration Working

Overview I have a server that receives Syslog data from external clients, and I do not have administrative access to these clients. The goal is to move the existing configuration to data in transit ...
g9s0x1's user avatar
  • 1
0 votes
0 answers
98 views

Split logging on rsyslogd

My goal is to send all logs to one source remote and still log local but then send all the AuditD logs to its own source on port 20002. But for some reason, my auditd logs are still ending up with my ...
Jason's user avatar
  • 3,941
0 votes
0 answers
108 views

Forwarding log of a specific cPanel user from rsyslog.conf to an IP address using TCP

Server is on CloudLinux, cPanel, LiteSpeed, imunify and CSF as firewall. i have multiple domains hosted on my server. I only want to forward one user (all) logs to an specific IP address. Using this ...
Mishael Khan's user avatar
0 votes
1 answer
83 views

postfix logging no the known defaults

Actually i overtook the administration of a mail cluster which uses postfix. And i was really confused when i saw the different loggings: one of the servers logs to a custom logfile, instead there is ...
germebl's user avatar
  • 11
0 votes
0 answers
177 views

Add mac address in rsyslog template

I am trying to add system/device mac address in syslog. No solution is working for me. Following command gives me mac address, just wanted to use in rsyslog template. mac_addr=$(ifconfig en0 | awk '/...
sandip karanjekar's user avatar
0 votes
1 answer
47 views

Write path for logging is problematic

My config for my template is as follows. template (name="macfilter" type="string" string="/home/pi/nas/f/remotelogs/%programname:R,ERE,0,FIELD:(([0-9A-fa-f][0-9A-fa-f]: ?[0-9A-...
David Conway's user avatar
1 vote
1 answer
212 views

Rsyslog prepend text to messages in certain facility

OS: Debian 11 Rsyslog version 8.2102 Squid version 4.13 I am attempted to remote log squid logs without going through a file. I am using the following logging line for the store log in squid.conf: ...
user avatar
0 votes
1 answer
356 views

For rsyslog - to what facility do ssh and scp belong to?

I am trying to send all the ssh and scp error messages to a pipe and to configure this in the rsyslog.conf I need to know the facility for these services. Does anybody know this or a resource where ...
A Mere's user avatar
  • 3
0 votes
1 answer
42 views

Combine thousands of logger instances

We have Apache 2.4 setup with over 1000 vhosts, and multiple instances of logger in each : CustomLog "|/usr/bin/logger -t apache-access -p local6.notice -n x.x.x.x" access_log Restarting ...
Bastien974's user avatar
  • 1,916
0 votes
1 answer
132 views

rSyslog stopped sending only SOME data

I have configured a remote logging from one of my servers to the central log server via rsyslog TCP/SSL Everything worked fine until yesterday where most of the files just stop being transmitted while ...
Mr.P's user avatar
  • 119
0 votes
1 answer
1k views

Postfix logging to syslog even though it's excluded

Ubuntu 22.04 and postfix 3.6.4 Postfix config is set to use syslog_facility=mail, and I have modified /etc/rsyslog.d/50-default.conf to the following *.*;mail,auth,authpriv.none -/var/log/syslog ...
Brett A.'s user avatar
  • 156
0 votes
1 answer
3k views

In Rsyslog, how do you replace regex matches with custom text?

I'm trying to capture text via regular expression and replace the text with a custom string. My current code successfully captures IP addresses, but I don't know how to replace the IP address with ...
Drin's user avatar
  • 3
2 votes
0 answers
658 views

rsyslog is not forwarding logs to elasticsearch

I'm trying to configure rsyslog to send logs to logstash and then forward them to elasticsearch. I have create a config file /etc/rsyslog.d/60-output.conf with the following content: *.* @localhost:...
Croviajo's user avatar
  • 141
2 votes
2 answers
3k views

rsyslog won't start - pid already exist

I was trying to configure rsyslog to forward logs from a specific file to a syslogserver and I ended up purging the whole configuration (the rsyslog service was stuck - wouldn't start) .. so I purged ...
Mr.P's user avatar
  • 119
0 votes
0 answers
192 views

Proper rsyslog configuration

I have Debian 8 (Jessie) and need to write messages to log. Suppose, I have a program which sends to syslog: #include <syslog.h> int main() { openlog("progname", LOG_CONS, LOG_USER);...
Boris's user avatar
  • 1
1 vote
0 answers
1k views

SFTP logs to different files

I'm configuring an SFTP server and having some issues with logs ending up in different places, depending on a group membership. This is on RHEL 8 but the same issue exists on an old RHEL 6 machine. ...
anlag's user avatar
  • 136
0 votes
1 answer
289 views

define custom fields for systemd-journald

The doc states, it may be possible to define new fields by applications. What does it mean? Can one define arbitrary fields or are only those possible listed in the doc USER JOURNAL FIELDS? If ...
woodz's user avatar
  • 146
3 votes
1 answer
1k views

SELinux is preventing in:imjournal from unlink accesses on the file imjournal.state

I have a problem on Fedora 36 with rsyslog, selinux and /var/log/messages components. As you can see: AVC avc: denied { unlink } for pid=XXX comm="in:imjournal" name="imjournal.state&...
bugmeu's user avatar
  • 31
0 votes
0 answers
1k views

php-fpm access log to rsyslog

I am trying to find a solution for getting logs from php72 php-fpm yii2 application behind nginx on several numbers of servers: at now application writes its logs to files on server disk, yii performs ...
Илья Бугримов's user avatar
1 vote
0 answers
192 views

Syslog server redundancy

Gentlemen , There’s a requirement for syslog server redundancy. Most of the syslog clients are network devices and appliances on which you can configure only one syslog server as destination. I been ...
MrBuzz73663's user avatar
1 vote
0 answers
906 views

Rsyslog sends logs by batch to destination after restart

I have a fleet of ~70 servers sending logs to Papertrail using Rsyslog. On September 20th Papertrail encountered an issue and most of our servers logged theses messages: Sep 20 11:42:30 server-name ...
Poney's user avatar
  • 111
0 votes
1 answer
24 views

syslog access beginning of log line

I would like to filter the content of my logs generated by Syslog, I'm applying a filter based on $msg but it is not containing the beggining of the line: 2022-09-29T16:39:39Z SYS_SERVER_2 - - - - - A ...
tiamat's user avatar
  • 103
0 votes
1 answer
2k views

Combining multiple Property-Based Filters for Rsyslog

I was trying to set up a specific Rsyslog configuration file to catch all incoming kernel messages of a few types. For example, I want to dump all logs containing "example message 1" and &...
jeff's user avatar
  • 1
0 votes
0 answers
3k views

rsyslog: action suspended, next retry is

I'm trying to configure rsyslog to receive logs sent from other devices on port 3100 (my manager chose that port and I will get him to change it to 514 later), and save (append) those logs in local ...
Michael NGV's user avatar
0 votes
0 answers
477 views

Redirect systemd service logs to /dev/kmsg for all running services

Currently systemd service files will redirect the logs to journal buffer by default. But I need to get all the userspace services logs as part of /dev/kmsg buffer. I was able to add StandardOutput=...
Rckzz's user avatar
  • 1
0 votes
1 answer
2k views

rsyslog forward with ;RSYSLOG_SyslogProtocol23Format

I am trying to forward rsyslog with ;RSYSLOG_SyslogProtocol23Format It works fine for an all log forward: *.* @@syslogserver.com:6789;RSYSLOG_SyslogProtocol23Format But does anyone know how it can be ...
Henric Carlsson's user avatar
3 votes
2 answers
510 views

Sending remaining network traffic with RSYSLOG to specific file

I'm trying to concentrate logs from multiple equipments from multiple clients on my RSYSLOG server. My server runs on Debian 11 with RSYSLOG v8.2102 The configuration is quite simple at the moment: I'...
Cool34's user avatar
  • 53
0 votes
1 answer
538 views

Rsyslog server - conditionally forward logs

The idea is to receive the logs on the Rsyslog server and then send them to a specific Kafka server depending on the log contents. For example, Logs are being received on a single port, 514 Forwarding ...
Iggy's user avatar
  • 15
0 votes
1 answer
229 views

Reliable rsyslog logging to a remote server

Is there any way to configure rsyslog to send logs to a remote instance so that it does not loose several minutes of messages? I am finding this difficult in following scenario: Yank the ethernet ...
fastfox's user avatar
  • 101
0 votes
1 answer
881 views

rsyslog ruleset for encrypted logging

I've setup managed to setup rsyslog to accept TLS traffic from a clients server. When I configured the certificate and the port originally, it all worked fine. The problem is it is dumping the logs ...
itinneed2022_1's user avatar

1
2 3 4 5
14