Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsyslog]

rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

1
vote
0answers
22 views

rsyslog/syslog-ng pattern to log ssh and related sftp session for an user

I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename: I have this: Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port ...
0
votes
2answers
35 views

Delete a log while is written using SED - /var/log/messages

I had a filesystem that was over 60%. I found that the file /var/log/messages had more than 4 million lines so I decided to delete 2 million lines in order to clear some space. I executed the command ...
1
vote
0answers
29 views

Log loadballancing using HAproxy

I'm trying to loadballance logs to a pool of rsyslog server using HAproxy but I'm failing to find a suitable solution when the source is a single client. HAproxy opens a session to one of the backend ...
-1
votes
1answer
13 views

Does rsyslog configuration support case statement?

Does rsyslog support case statement similar to C? switch ($programname) ​{ case "nginx": // code to be executed if n is equal to constant2; break; case "java": // code ...
0
votes
0answers
20 views

Rsyslog is adding square brackets

I am forwarding events from a server on UDP/514 via syslog and have rsyslog collector running on Redhat machine receiving these events. But for some reasons, rsyslog is modifying the events please ...
1
vote
0answers
28 views

Rsyslog default action name not sequential?

I would like to ask question about rsyslog. I am using rsyslog v7 and gathering stats using impstats module. According to document, default naming of action queue is sequential based on occurrence of ...
0
votes
1answer
31 views

rsyslog writing to postgres. rsyslog process very high cpu, postgres very low cpu

I'm using rsyslog to write dns data to postgres. The messages are always quite short and similar to each other: <ip of host making dns request> <dns request> I use a regex to pull ip ...
1
vote
0answers
49 views

Rsyslog messages not making it to local logfile

I've been tasked with setting up longer/better log retention for our postgres servers, but after configuring postgres to ship logs to syslog via local0 I've found that they never actually hit the ...
0
votes
1answer
59 views

What is localhost.webcache in tcpdump

I'm trying to verify that a user is actually logging into my machine and I figured out that looking at tcpdump would be reasonable. I'm using the new omhttp module for Rsyslog to send logs via http ...
0
votes
0answers
30 views

tls session resumption in rsyslog

Background I have set up centralized rsyslog server that listens at some port for tls connections from rsyslog clients.The rsyslog clients establish tls connections with server and pushes their logs ...
-1
votes
0answers
39 views

rsyslog: Host specific log file is not created as well as not writing logs all the time for some hosts

I'm trying to get rsyslog working on Oracle Linux Server release 7.4. My goal is to have a separate log file for my selected servers and that too on a daily basis, something like this: rsyslog folder ...
0
votes
2answers
35 views

How to pass system stats to syslog

I want to pass system stats, especially CPU usage to rsyslog. Can somebody help me on this? Can we use logger tool to achieve this task? Thank you Luke
1
vote
1answer
75 views

What is the meaning of these HAProxy configuration lines?

I've seen several examples (see below) of HAProxy logging configuration that all look like this: /etc/haproxy/haproxy.cfg global log /dev/log local0 log /dev/log local1 notice ...
0
votes
2answers
60 views

Rsyslog Remote Logging: Garbled Text when using TLS

I've set up Rsyslog with TLS on two Debian machines and configured remote logging (log-server, log-shipper). However, I am getting "garbled" Text in the logs on the server: Oct 22 07:58:45 log-...
0
votes
1answer
44 views

postgres log workflow : filter the log events with specific working hours

To analyze postgres logs, our workflow is: postgres logs via syslog rsyslog writes to one text file at midnight we stop postgres pgbadger reads and parses the daily logfile (about 2 Gbyte) We want ...
0
votes
1answer
63 views

Logrotate Separate Policies in Same Directory

I am running rsyslog on CentOS and logrotate to rotate my logs. All hosts write their logs to /var/log/syslog/ in their own separate directory in this manner: /var/log/syslog/host1 /var/log/syslog/...
0
votes
0answers
16 views

Journal metadata not taken as Rsyslog structured-data

I would like to use rsyslog with the imjournal module. I was expecting the same metadata I see when I read verbose journal entries to be taken as the STRUCTURED_DATA field in rsyslog (RFC5424), but it ...
0
votes
0answers
37 views

See docker container logs on host while using gelf driver

I am using gelf as log driver for my docker container. In log options i provided udp endpoint. Now when i start the container, everything is working as expected. My question is, if it is possible to ...
0
votes
1answer
36 views

Rsyslog eats up storage

I have set up rsyslog to grab various logs on my ubuntu 16.4 instance, but for some reason it eats up my storage until I have no free storage left. So far I couldnt find out what the issue is, also ...
0
votes
1answer
174 views

Logrotate Not Deleting Compressed Logs

I have a CentOS box running rsyslog and logrotate as my syslog server for a whole bunch of network devices. I've been toying around with this for a while, the logrotate/compression piece is working ...
0
votes
0answers
39 views

rsyslog - queues with expiration time

I've configured rsyslog with Disk Assisted options to forward logs to Logstash server. Last night, the status of network of Logstash became unstable. Consequently, bunch of backlog files that contain ...
1
vote
1answer
547 views

System logs are empty (/var/log/messages; /var/log/secure; etc)

I found that rsyslog stopped writing on logs (messages; secure; cron;etc) System information: NAME="Red Hat Enterprise Linux Server" VERSION="7.4 (Maipo)" ID="rhel" ID_LIKE="fedora" VARIANT="Server" ...
0
votes
1answer
46 views

Centos7 Stop bloated logging

I have a server with the OS Centos 7 and looking at log file(s) such as the messages log file ("/var/log/messages") I can see it is primarily filled with entries like the following: Aug 29 12:46:01 ...
0
votes
1answer
90 views

CRON messages being delayed for arbitrary long time in syslog

I found in a few servers's syslog that some of the CRON related messages are written in a wrong time, like the following: Aug 21 06:26:01 hty-controller CRON[30159]: (root) CMD ( python /.../...
0
votes
0answers
53 views

is there any way to filter in syslog (not rsyslog) such as programname?

I need to add filter in my syslogs. I know how to do in rsyslogs. But we need to add same logs in syslogs as well in legacy systems.Is there any way to do it? Corresponding rsyslog entries are: :msg,...
0
votes
0answers
22 views

How can I set templates and apply different condition?

I try to set rules of rsyslog that make following rule: 1. my programs send log to local0 2. log file store in directory by program name and filename has time information So I write following rule ...
2
votes
0answers
176 views

IPVS (keepalived) doesn't balance UDP connections

I have two load balancer with Debian 8 and three Graylog server with Debian 9. Every server in my network sends logs via rsyslog to a virtual server configured on the LB. The connection is UDP. The ...
0
votes
0answers
47 views

forward original syslog message

I would like to forward from a log collector many syslog message to another log collector and maintain the original syslog message. When I forward maybe the first log collector add a data and source ...
1
vote
0answers
81 views

rsyslog mysql change format

I have rsyslog 7.6.7 on server with some file who contains 2018-07-19 12:38:49~,~"Phone" <672094>~,~672094~,~0~,~atx_78342~,~SIP/teleserver-1.ha-000000ce~,~SIP/s_ru-000000cf~,~Dial~,~SIP/s_ru/1#...
0
votes
1answer
197 views

rsyslogd uses 435M of swap memory right after restart

I have Centos 7 # cat /etc/centos-release CentOS Linux release 7.3.1611 (Core) fresh rsyslogd # rsyslogd -version rsyslogd 8.36.0, compiled with: enough free memory # free ...
0
votes
0answers
118 views

rsyslogd action suspended using omfwd

We're trying to upload an Apache log to a syslog server, however the upload doesn't happen and in /var/log/syslog we see: Jun 20 02:16:21 caes8 rsyslogd-2007: action 'action 10' suspended, next ...
0
votes
0answers
207 views

How to do logging in a NFS share

I'm trying to log events occurring into a NFS share. But I don't understand the difference between the usage of rsyslog and auditd in the logs of a NFS share. Is rsyslog required to log events ...
0
votes
0answers
195 views

How to view audit logs on the server

I'm trying to do a nfs share. I've configured the share. Now I want to view the logs associated with the files in the nfs share. I've created a centralized log server. I don't know the difference ...
0
votes
0answers
239 views

rsyslog not parsing RFC5424 messages

I have several rsyslog clients sending data to a centralized rsyslog server which sends data to logstash. I'm using the following format on the clients which is suppose to be RFC 5424: $template ...
0
votes
1answer
74 views

rsyslog adding year and changing directory for logs file

I allready have template in rsyslog.conf file changing directory to store log files but now we must add year to every log msg in this file. $template TmplAuth, "/home/someuser/logs/%HOSTNAME%/%...
0
votes
1answer
205 views

rsyslog ommail sends messages with empty bodies

I'm trying to send email from rsyslog (using the ommail module) on certain events, but no matter what I do the message bodies are always empty. My configuration file says: module(load="ommail") ...
1
vote
1answer
524 views

Redirect Auditd.log data to rsyslog in RHEL-7

I would like to redirect the auditd log data into rsyslog instead of audit.log file. I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to ...
1
vote
0answers
105 views

Making Rest Api post call from rsyslog

I want to make a REST API call from rsyslog. This is how the curl command looks like curl --request POST \ --url http://10.1.1.1:9000/logforwarder \ --header 'Accept: application/json' \ --...
1
vote
1answer
153 views

Rsyslog pass log to script?

I have been trying to pass captured log to a perl script, however I can not seem to find the right way. Do you have any suggestions for correct way of sending captured log to a script for further ...
0
votes
0answers
32 views

How to write the mail command in /etc/rlogrotate.conf?

When the following line added in /etc/rlogrotate.conf ,some syslogn such as /var/log/syslog.8.gz and /var/log/cups/access_log.8.gz and /var/log/cups/error_log.8.gz will send to my email. mail xxxx@...
0
votes
1answer
349 views

global configuration rsyslog using RainerScript how to?

Right now i have this in my rsyslog.conf file. /* GLOBAL DIRECTIVES */ # Global umask for all actions $umask 0022 # Set the default permissions for all log files. module(load="buildin:omfile" ...
0
votes
1answer
387 views

Rsyslog creating duplicate entries when forwarding application logs

I'm trying to add a new application log forward to a host which is already setup to send it's logs to a remote syslog server. I'm following the directions here: http://www.rsyslog.com/doc/v7-stable/...
0
votes
0answers
181 views

What should be done after updating rsyslog configuration on Centos 7?

I mostly have the default /etc/rsyslog.conf except I have an include to this file: $EscapeControlCharactersOnReceive off *.info;auth,authpriv.none /var/log/some_other_log_file I ...
0
votes
0answers
46 views

Rsyslog logging into /var/log/messages instead of custom file

I have multiple perl daemon processes which should be logging to a specific log file. They use the local1 facility with priority info. Here is the /etc/rsyslog.conf we are using: $ModLoad ...
0
votes
0answers
73 views

Disable cron events sent to remote server rsyslog?

We have rsyslog pushing the logs to a external server Alienvault server. I want to disable or minimize the amount of cron events being sent to the server but I have not been able to figure out how to ...
2
votes
1answer
631 views

Interpreting DHCP related message from rsyslog

In /var/log/messages from an EC2 instance there are a lot of lines such as: <date/timestamp> ip-<IP_HERE> ec2net: [get_meta] Trying to get http://169.254.169.254/latest/meta-data/network/...
1
vote
1answer
6k views

Create separated syslog file for each host with rsyslog

I have a syslog server (running rsyslog on RHEL 7.4) that consolidates all the syslogs from my network devices. It's listening on port TCP/514. I want to redirect the logs of each device to a ...
0
votes
1answer
110 views

rsyslog upload limitation?

I use rsyslog to upload logs to my Graylog server /etc/rsyslog.conf: $InputFileName /var/log/apache-error.log $InputFileFacility apache $InputFileTag #apacheError: $InputFileStateFile apache-error $...
0
votes
0answers
352 views

net_ratelimit: 1 callbacks suppressed

I read a number of answers about log messages like the above net_ratelimit: n callbacks suppressed where n was said to be the number of log messages dropped because of ratelimiting. makes sense. ...
-1
votes
2answers
483 views

Don't see syslog get logged anywhere on server

I want to export syslog from an IP phone to a remote syslog server. I have set everything up, I can see the syslog packets getting to the server when doing a tcpdump, but I don't see the syslog in a ...