Questions tagged [rsyslog]

rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

Rsyslog tcp forward failed

I've this sub configuration : UDP configuration : Works template(name="template1" type="string" string="/var/log/rsyslog/%$YEAR%/%$MONTH%/%HOSTNAME%/%HOSTNAME%-%FROMHOST-IP%.log") ruleset(name="...
0
votes
1answer
47 views

Rsyslog / CentOS 8 / no write logs|no catch?

I use rsyslog (8.37.0-13) on CentOS 8 (CentOS Linux release 8.1.1911) and I've type error with my configuration. My rsyslog.conf is : module(load="imuxsock") module(load="imjournal") module(load="...
0
votes
1answer
12 views

Seperate PROCID from SYSLOGTAG using $template

Im setting up a centralized rsyslog server using a Raspberry Pi with LogAnalyzer web frontend to view the logs. Everything is setup and working except the parsing of fields into the MySQL database. As ...
0
votes
0answers
42 views

PHP binaries are deleted every hour for no apparent reason and other issues

Since yesterday I am fighting with very strange issues on one of our servers. Environment: We use proxmox to run few LXC containers based Debian virtual machines. Yesterday night something happened ...
0
votes
1answer
30 views

Rsyslog “typo error” CentOS 8

I use rsyslog (8.37.0-13) on CentOS 8 (CentOS Linux release 8.1.1911) and I've type error with my configuration. My configuration is : template(name="template1" type="string" string="/data/%HOSTNAME%...
1
vote
1answer
73 views

Rsyslog not sending buffered messages

My requirement is to log all messages on the remote machine. In order to achieve the goal I have two identical versions of rsyslog (rsyslogd 8.1901.0 (aka 2019.01)) on both machines (server: 192.168....
0
votes
0answers
20 views

/var/log/messages not sending to the rsyslog central logging server

Everything else is being logged to the central rsyslog server but not the /var/log/messages of the rsyslog client. server: learn -> 192.168.1.100 client: server101 -> 192.168.1.200 From the rsyslog ...
0
votes
0answers
43 views

How to restart rsyslog on alpine?

In my alpine 3.1..5 linux docker container, I installed rsyslog as: # apk add --no-cache rsyslog I am running rsyslogd as: # rm -f /var/run/rsyslogd.pid # rsyslogd How do I restart rsyslogd ...
0
votes
0answers
19 views

CentOS 6 rsyslog continuous stream of entries filling up /var/log/messages

After running yum update on one of my boxes, I am receiving a continuous stream of entries in /var/log/messages and fill up the disk. I could not make out where the events are coming from Linux host1 ...
0
votes
0answers
9 views

How to define custom time format and different file for each other in a single rsyslog template?

I am trying to define custom log format and separate log file for each host in a single template. I am getting my desired log-line though following template. template(name="servers" type="string" ...
0
votes
1answer
16 views

rsyslog logging asa data to multiple files

I setup rsyslog to log asa data to /var/log/asa/asa.log. That worked fine. But it's also logging asa details to /var/log/messages. I only want it to go to /var/log/asa/asa.log/. Here is the ...
0
votes
1answer
23 views

rsyslog with avro encoded log decoding fails

I am using rsyslog, I have my devices send custom logs to rsyslog encoded in avro. When i receive this log in rsyslog via udp port, I am able t decode. But when it get stored in rsyslog and I try to ...
0
votes
0answers
11 views

Rsyslog udp input on a port output via inputname to a file using the omfile plug-in?

Is it possible to write all logs received on a specific port (ie. udp 1514) to 1 log file using the omfile plug-in ? Like this or similar? $UDP514ServerRun 514 $UDP1514ServerRun 1514 if $...
0
votes
0answers
15 views

Logging chrooted users with different socket/hide “/dev” folder

I have a few chrooted users on my sftp-server. Logging works as intended, but I have one simple question: Is it possible to hide the "/dev" folder for the users? My configuration now: module(load="...
0
votes
0answers
18 views

ommail module; regex expression html format body

Rsyslog version: rsyslogd 8.24.0-41.el7_7.2 I am trying to format an email as html and extract some piece of msg for subject, and the rest for mail body. I am testing regex expressions on https://www....
0
votes
1answer
31 views

how to send log from post-auth with Freeradius?

I want to send message to remote syslog in post-auth section. Simple string with "'%{User-Name}', '%{reply:Packet-Type}', '%{Calling-Station-Id}'" How do it with FreeRADIUS 3 ? Or.. How to split ...
0
votes
1answer
62 views

rsyslog sending custom log to remote sever

I have found an answer on stackoverflow, but using same exact config, apart changing the mine to minecraft_server, returns: Mar 25 05:21:29 gameserver rsyslogd[7027]: invalid or yet-unknown config ...
0
votes
0answers
36 views

Display the custom token of a cloud based application on rsyslog with it's original syslog messages automatically just like in syslog-ng

I Was wondering whether there's a way to display the custom token of a cloud based application on rsyslog with it's original message automatically just like in syslog-ng without manually adding the ...
2
votes
1answer
150 views

pam_unix generates a lot of open/close sessions for my domain user

I setup a new VPS with ubuntu 18.04, including virtualmin/usermin. In auth.log I see a lot of su[12936]: Successful su for domain by root su[12936]: + ??? root:domain systemd-logind[148]: New ...
0
votes
1answer
42 views

Log a message from Windows to a Syslog server (Wireguard)

I would like to know when a Wireguard client set a tunnel up. So is it possible to do something like : PostUp=command_which_creates_a_syslog_event Because I don't see any other way to log when a ...
0
votes
1answer
136 views

Sending e-mails alerts with rsyslog

I was requested to enrich our current alerting system on rsyslog by adding mailing capabilities for some specific use cases. The plug-in ommail seems to be the one to use with rsyslog to do so. ...
0
votes
1answer
94 views

rsyslog over RELP fails on Ubuntu 18.04

On Ubuntu 18.04 and rsyslogd 8.32 logs are sent correctly over tcp without RELP with the next configuration: Server [192.168.1.201] (/etc/rsyslog.conf): module(load="imuxsock") # provides support ...
0
votes
0answers
41 views

Define rsyslog templates for files and logs

In rsyslog there is a default config for $ActionFileDefaultTemplate that defines the default log format type. A user can also define a template to send those logs to a file with a dynamic name. My ...
0
votes
0answers
21 views

no kernel log when plugging device

I'd want to get informations about and USB keyboard that I've just plugged on my Linux host (shared USB device from a Host, using vmware). Usually, I expect to see a message inside /var/log/kern.log, ...
0
votes
2answers
289 views

/var/log/messages Not Created Although restart rsyslog.service

I use centos7 and /var/log/messages has not worked for a while although I restarted rsyslog.service. Its size was always 0. I then deleted the messages file, and restarted rsyslog again but it was ...
0
votes
0answers
26 views

CentOS7: For a particular cronjob entry, it runs but does not log to /var/log/cron [duplicate]

We operate the server of the following environment. $ cat /etc/redhat-release CentOS Linux release 7.7.1908 (Core) $ uname -r 3.10.0-1062.9.1.el7.x86_64 $ rpm -q cronie cronie-1.4.11-23.el7.x86_64 $ ...
0
votes
1answer
153 views

rsyslog fromhost-ip using external lookup table

Working on a RHEL 7 host, configuring rsyslog to collect udp/tcp events from a wide range of devices (routers, switches, appliances, etc.) from several hundred IP's. Using the config below to start ...
0
votes
0answers
28 views

Is there a difference in network behaviour between disconnecting network in VM and shutting it down?

that might be a strange question. I'll try to clarify. I played around with rsyslog and it's ability to change the server it is sending to if the first one is suddenly disconnected. I'll call them: ...
1
vote
1answer
212 views

rsyslog template stop ignored

I try to configure get my template for remote logging working but the stop statement is ignored and everiting is logged duplicate in the syslog and in my generated file %programname%.log. I want the ...
0
votes
0answers
68 views

How to enable sending logs to rsyslog server with iptables

Scenario I have a rsyslog server and a client. I have a bash script with iptables rules on both sides (client and server).The trouble is the following: if i don't run any of the bash script then it ...
0
votes
1answer
51 views

rsyslog configuration based on port

I need some help configuring my rsyslog service. I was wondering if it was possible to configure remote logging based on incoming ports. For example: If the logs are coming from 172.28.132.43 then ...
0
votes
0answers
51 views

rsyslog logging based on sending host behind NAT

I have multiple Juniper devices behind one NAT'd IP sending their logs to a single host. On the wire the message looks like this: Dec 4 07:38:31 tor-29-1: dot1xd[1585]: task_connect: task PNACAUTH./...
0
votes
0answers
38 views

Configuring dnscacheEnableTTL on rsyslog on Debian

I am trying to configure the dnscacheEnableTTL on rsyslog on Debian stable, as I have rsyslog sending GELF messages to three Graylog instances, and sometimes I notice the local DNS has the wrong IP ...
0
votes
0answers
126 views

Run sshd in a non-root container along with rsyslog

I'm trying to build a deployment of an ssh server running sshd in a non-root container. Despite could sound quite smooth there are some caveats hidden. in order to print out auth.log file, an ...
1
vote
1answer
164 views

CentOS rsyslog how to split log files by date?

In the /var/log/ directory, we can see that the messages logs are split by a date stamp, roughly every week. Logs older than one month are automatically deleted. [root@localhost ~]# ls -lh /var/log/ ...
0
votes
1answer
164 views

Rsyslog not logging Windows Events

I am trying to configure sending Windows Events to rsyslog server, but rsyslog ignores them. $EscapeControlCharactersOnReceive off template(name="OnlyMsg" type="string" string="%msg:::drop-last-lf%\...
0
votes
1answer
33 views

How to set-up Syslog-NG with MonitorWare schema?

we are setting up a centralized logging server which receives logs from many devices and servers and stored them into a database. The syslog on the central server is syslog-ng. It is chosen because ...
1
vote
0answers
20 views

How to split logs into monthly, daily and hourly folders when bringing in syslog events?

I am bringing in log files via rsyslog and my config looks like the following: root@rhel:/etc/rsyslog.d# head mail_prod_logs.conf if $fromhost-ip=="10.10.10.10" and $programname=="AMP_Logs" then -/...
1
vote
2answers
36 views

Extrange logs appearing on /usr/share/nginx

We have a remote syslog server where we store the logs of all our VMs. Everything is working fine except that, on some machines with nginx, a log file with everything that has been sent to the remote ...
1
vote
2answers
54 views

Supress 3Ware warnings in syslog

I'm trying to suppress the following warnings in my syslog: Oct 13 04:43:33 Winston kernel: 3w-sas: scsi1: ERROR: (0x03:0x0101): Invalid command opcode:opcode=0x85. Oct 13 04:43:33 Winston kernel: md:...
1
vote
1answer
158 views

rsyslog expression based filter - 'startswith' not working

I am trying to filter out some sshd logs like these into a separate file: sshd[14913]: Did not receive identification string from 10.16.0.2 I tried the following, and it worked: if $programname == ...
0
votes
0answers
27 views

ommail to get mailsubject dynamically

How is it possible to set mailsbubject dynamically using a variable module(load="ommail") template (name="MailBody" type="string" string="The following event triggered this email:\r\n\r\n%msg%") ...
0
votes
1answer
110 views

Rsyslog with custom TLS connection

I have configured Rsyslog to transmit through Tls everything works good but I want to force the Rsyslog client to send through Tls version 1.1 or above and customize the encryption algorithm that uses ...
3
votes
2answers
3k views

Journalctl and syslog: How does it actually work? [closed]

I'm having a hard time understanding how logging works on linux. Since the inclusion of systemd, it seems a bit easier, but I still have a couple of concepts that still can't fully understand. Given ...
0
votes
0answers
470 views

Rsyslog does not set read and write permission for group and everyone

Rsyslog ignores read and write permission set with fileCreateMode for group and everyone. I have set up a service to run my node application as such: ... [Service] WorkingDirectory=/opt/demo/app ...
0
votes
0answers
137 views

Syslog and modsecurity logging

I need to send syslog from e.g. /var/log/modsecurity.log. The main question is how to send logs from modsecurity as one item/event, e.g.: --id(2646as12)--A data --id(2646as12)--B data --id(2646as12)...
2
votes
0answers
166 views

Logstash to aggregate logs into ElasticSearch

I am trying to aggregate linux logs using rsyslog into Logstash/ElasticSearch running in EKS. filebeat is already running in EKS to aggregate Kubernetes container logs. I have configured rsyslog ...
0
votes
0answers
242 views

Rsyslog Not Recognizing Some Hostnames

I have an rsyslog server running on CentOS (CentOS Linux release 7.4.1708 (Core)). We use this mostly for network devices, mostly Cisco. I ship the hostname with all my logging events. My server ...
0
votes
0answers
50 views

how to configure rsyslog for elk-auditbeat logs are not to store in /var/log/messages

Recently i have installed audit-beat in my centos7 , here audit-beat logs are stored in /var/log/messages file . due that audit-beat logs my disk is going to full every time .so how to configure ...
1
vote
0answers
14 views

Extraction permitted peer cert details in ruleset

We are using imtcp with gtls and specifies the permitter cert subjects in PermittedPeer. This works well, but we would like to extract the cert subject and include in the log message we send further ...

1
2 3 4 5
12