Questions tagged [rsyslog]
rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.
684
questions
0
votes
0
answers
42
views
Add mac address in rsyslog template
I am trying to add system/device mac address in syslog. No solution is working for me. Following command gives me mac address, just wanted to use in rsyslog template.
mac_addr=$(ifconfig en0 | awk '/...
0
votes
1
answer
33
views
Write path for logging is problematic
My config for my template is as follows.
template (name="macfilter" type="string" string="/home/pi/nas/f/remotelogs/%programname:R,ERE,0,FIELD:(([0-9A-fa-f][0-9A-fa-f]: ?[0-9A-...
0
votes
0
answers
11
views
Getting this error while validating tls certificates x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs [migrated]
i am looking to implement TLS in rsyslog using golang . I also found library https://github.com/RackSec/ .
func main() {
w, err := syslog.DialWithTLSCertPath("tcp+tls", "127.0.0.1:...
1
vote
1
answer
24
views
Rsyslog prepend text to messages in certain facility
OS: Debian 11
Rsyslog version 8.2102
Squid version 4.13
I am attempted to remote log squid logs without going through a file.
I am using the following logging line for the store log in squid.conf:
...
- 87
0
votes
1
answer
16
views
For rsyslog - to what facility do ssh and scp belong to?
I am trying to send all the ssh and scp error messages to a pipe and to configure this in the rsyslog.conf I need to know the facility for these services. Does anybody know this or a resource where ...
- 3
0
votes
1
answer
17
views
Combine thousands of logger instances
We have Apache 2.4 setup with over 1000 vhosts, and multiple instances of logger in each :
CustomLog "|/usr/bin/logger -t apache-access -p local6.notice -n
x.x.x.x" access_log
Restarting ...
- 1,886
0
votes
1
answer
32
views
rSyslog stopped sending only SOME data
I have configured a remote logging from one of my servers to the central log server via rsyslog TCP/SSL
Everything worked fine until yesterday where most of the files just stop being transmitted while ...
- 109
0
votes
0
answers
26
views
Rsyslog high performance TLS logging
We have been using imptcp module for remote logging high amount of
logs (over 1M log lines per minute) received from >40 servers. Now we
would like to switch to TLS, but it looks like imptcp does ...
- 143
0
votes
0
answers
61
views
How do I send log data through a proxy using rsyslog
I have a few hosts in a private subnet. All connections, incoming and outgoing, for this private subnet must go through a proxy. I have rsyslog running on the hosts in the private subnet. I must send ...
- 101
0
votes
0
answers
21
views
How does rsyslog accept remote logs to be written to the specified file path?
I want to write remote logs to the /data directory
# cat /etc/rsyslog.d/default.conf
#### GLOBAL DIRECTIVES ####
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$template myFormat,"%...
0
votes
1
answer
167
views
Postfix logging to syslog even though it's excluded
Ubuntu 22.04 and postfix 3.6.4
Postfix config is set to use syslog_facility=mail, and I have modified /etc/rsyslog.d/50-default.conf to the following
*.*;mail,auth,authpriv.none -/var/log/syslog
...
- 156
0
votes
1
answer
348
views
In Rsyslog, how do you replace regex matches with custom text?
I'm trying to capture text via regular expression and replace the text with a custom string.
My current code successfully captures IP addresses, but I don't know how to replace the IP address with ...
- 3
0
votes
0
answers
86
views
nextjs/pino transport to aws linux2 syslog
I'm building my first NextJS project, and am using the recommended Pino for logging. This has worked great in development, but now I'm trying to figure out how to deploy it to production.
I think the ...
- 389
2
votes
0
answers
366
views
rsyslog is not forwarding logs to elasticsearch
I'm trying to configure rsyslog to send logs to logstash and then forward them to elasticsearch.
I have create a config file /etc/rsyslog.d/60-output.conf with the following content:
*.* @localhost:...
- 141
1
vote
2
answers
820
views
rsyslog won't start - pid already exist
I was trying to configure rsyslog to forward logs from a specific file to a syslogserver and I ended up purging the whole configuration (the rsyslog service was stuck - wouldn't start) ..
so I purged ...
- 109
0
votes
0
answers
64
views
Proper rsyslog configuration
I have Debian 8 (Jessie) and need to write messages to log. Suppose, I have a program which sends to syslog:
#include <syslog.h>
int main()
{
openlog("progname", LOG_CONS, LOG_USER);...
- 1
0
votes
0
answers
154
views
SFTP logs to different files
I'm configuring an SFTP server and having some issues with logs ending up in different places, depending on a group membership. This is on RHEL 8 but the same issue exists on an old RHEL 6 machine. ...
- 26
0
votes
1
answer
82
views
define custom fields for systemd-journald
The doc states, it may be possible to define new fields by applications.
What does it mean? Can one define arbitrary fields or are only those possible listed in the doc USER JOURNAL FIELDS?
If ...
- 136
0
votes
0
answers
39
views
rsyslog is not capturing logs from remote server post log rotation
I have configured the rsyslog on my CentOS-7 server to receive logs from a network device. And, it is receiving logs at the configured file path. But, when the logroatation is done, it creates a new ...
- 1
3
votes
1
answer
355
views
SELinux is preventing in:imjournal from unlink accesses on the file imjournal.state
I have a problem on Fedora 36 with rsyslog, selinux and /var/log/messages components.
As you can see:
AVC avc: denied { unlink } for pid=XXX comm="in:imjournal" name="imjournal.state&...
- 31
0
votes
0
answers
541
views
php-fpm access log to rsyslog
I am trying to find a solution for getting logs from php72 php-fpm yii2 application behind nginx on several numbers of servers:
at now application writes its logs to files on server disk, yii performs ...
0
votes
0
answers
190
views
RootDirectory in systemd ignored?
I am trying to execute service but result is "Failed to locate executable /usr/sbin/myservice: No such file or directory".
Service runs under chroot.
Service contains:
[Service]
...
- 36
0
votes
0
answers
321
views
Rsyslog over TLS
I'm now trying rsyslog, I'm trying to receive logs from an external system (barracuda: https://campus.barracuda.com/product/essentials/doc/85494328/syslog-integration/ but someone else manages this ...
0
votes
0
answers
130
views
Rsyslog and UDP
Quick question, as I just want to ensure -
For rsyslog, will below option work as intended if sending logs to remote syslog is configured through UDP? -
$ActionResumeRetryCount -1 # prevents rsyslog ...
- 11
0
votes
0
answers
29
views
log events are dumped in var/log/messages and var/log/mse/mediaquality.log file, but i want those events only in var/log/mse/mediaquality.log
to stop those events I used & ~ at the end of the script. This fixed my bug, but my functional tests are not able to capture these events. I am using Logstash for this.
So my fix is to stop the ...
0
votes
0
answers
118
views
Rsyslog server logging different subnets to different locations
I wonder if you can help me to configure rsyslog to write logs from different subnets to different locations, ie:
Log everything coming from subnet 192.168.1 to dir. /log/subnet1,
from subnet 192.168....
- 11
1
vote
0
answers
57
views
Syslog server redundancy
Gentlemen ,
There’s a requirement for syslog server redundancy.
Most of the syslog clients are network devices and appliances on which you can configure only one syslog server as destination.
I been ...
- 11
1
vote
0
answers
621
views
Rsyslog sends logs by batch to destination after restart
I have a fleet of ~70 servers sending logs to Papertrail using Rsyslog.
On September 20th Papertrail encountered an issue and most of our servers logged theses messages:
Sep 20 11:42:30 server-name ...
- 111
0
votes
0
answers
29
views
How can I translate my old rsyslog rules?
I had this rule in previous rsyslog versions:
if $fromhost-ip == 'xxx.yyy.zzz.www' then /var/log/name_of_the_server.log
& stop
And I translate it as:
template (name="dinamico" type=&...
0
votes
0
answers
33
views
Rsyslog logs not getting forwarded
rsyslog audit logs are not getting forwarded from Amazon Linux 2 (koji linux)
what are the known rsyslog issues related to this amazon linux 2 system?
Also, what is the significance of below two line
#...
- 1
0
votes
1
answer
14
views
syslog access beginning of log line
I would like to filter the content of my logs generated by Syslog, I'm applying a filter based on $msg but it is not containing the beggining of the line:
2022-09-29T16:39:39Z SYS_SERVER_2 - - - - - A ...
- 103
0
votes
0
answers
115
views
rsyslog include $msg variable while using omprog
I would like to include the variable $msg into a omprog while calling a shell script but I cannot retrieve the real value:
if ($msg contains 'dummy') then {action(type="omprog" binary="/...
- 103
0
votes
1
answer
441
views
Combining multiple Property-Based Filters for Rsyslog
I was trying to set up a specific Rsyslog configuration file to catch all incoming kernel messages of a few types. For example, I want to dump all logs containing "example message 1" and &...
- 1
0
votes
1
answer
1k
views
rsyslog: action suspended, next retry is
I'm trying to configure rsyslog to receive logs sent from other devices on port 3100 (my manager chose that port and I will get him to change it to 514 later), and save (append) those logs in local ...
0
votes
0
answers
204
views
Redirect systemd service logs to /dev/kmsg for all running services
Currently systemd service files will redirect the logs to journal buffer by default. But I need to get all the userspace services logs as part of /dev/kmsg buffer.
I was able to add StandardOutput=...
- 1
0
votes
1
answer
440
views
rsyslog forward with ;RSYSLOG_SyslogProtocol23Format
I am trying to forward rsyslog with ;RSYSLOG_SyslogProtocol23Format
It works fine for an all log forward: *.* @@syslogserver.com:6789;RSYSLOG_SyslogProtocol23Format
But does anyone know how it can be ...
3
votes
2
answers
268
views
Sending remaining network traffic with RSYSLOG to specific file
I'm trying to concentrate logs from multiple equipments from multiple clients on my RSYSLOG server.
My server runs on Debian 11 with RSYSLOG v8.2102
The configuration is quite simple at the moment: I'...
- 33
0
votes
1
answer
276
views
Rsyslog server - conditionally forward logs
The idea is to receive the logs on the Rsyslog server and then send them to a specific Kafka server depending on the log contents.
For example,
Logs are being received on a single port, 514
Forwarding ...
- 15
0
votes
1
answer
75
views
Reliable rsyslog logging to a remote server
Is there any way to configure rsyslog to send logs to a remote instance so that it does not loose several minutes of messages? I am finding this difficult in following scenario:
Yank the ethernet ...
- 101
0
votes
1
answer
360
views
rsyslog ruleset for encrypted logging
I've setup managed to setup rsyslog to accept TLS traffic from a clients server. When I configured the certificate and the port originally, it all worked fine. The problem is it is dumping the logs ...
0
votes
0
answers
72
views
rsyslog 5: forwarded log still writing locally
I am trying to upgrade a box that uses rsyslog 5.8.10, but I want it to forward some postgres logs first (coming in on local1). Atm, I can only get it to forward and write locally (which fills the ...
- 164
0
votes
0
answers
71
views
to send log from /opt/filename/logs/... to the syslog server which works on Windows (Kiwi app)
I am using linux redhat 8 which is connected to FND, I need to log my messages on syslog server which is working on Windows and I installed Kiwi to capture the logs. the logs are not in the /var/logs ...
1
vote
1
answer
421
views
Rsyslog template with RELP
I am trying to send logs to remote system with this configuration on client:
module(load="imjournal" StateFile="imjournal.state")
module(load="omrelp")
template(name=&...
- 23
0
votes
0
answers
21
views
How do I stop r/syslogd from writing Apache DEBUG messages to the terminal?
Several months back we deployed a new AWS EC2 instance running Ubuntu 20.04.2.
At some point, a configuration change was made and now, when logged in (via SSH to the instance), messages like this will ...
- 1
1
vote
1
answer
54
views
Configuring rsyslog to route messages to different log files based on content
Can rsyslog be configured to route log messages to different log files/locations based on the content of the log message? If so, how and could I see a simple example?
- 143
0
votes
1
answer
76
views
Sending rsyslog messages to remote file system
I have an Ubuntu server that will be running rsyslog and many "client" devices and applications sending logs to it (via various syslog clients).
I know that rsyslog logs everything to /var/...
- 143
2
votes
1
answer
43
views
How to skip a message matching a certain pattern if it repeats more often than a limit?
Is it possible to stop a matching message if it appears more frequently than a given limit? I'd like to achieve something like this:
if $programname == "foo" and
$msg contains "bar&...
- 581
0
votes
0
answers
228
views
rsyslog: suppress duplicate messages
Background
A stateless application starts, runs, and stops every 1 second. If the application encounters an error, that error is logged.
rsyslogd 8.1901.0 (aka 2019.01)
Problem
When the error occurs,...
- 235
0
votes
1
answer
177
views
Remote logs from rsyslog appear in general logfiles
I've set up rsyslog (according to guides like this) to ingest remote logs via the following general configuration:
module(load="imudp")
input(type="imudp" port="514")
...
- 315
0
votes
1
answer
5k
views
How to configure rsyslog to send multiple logs to a remote server and save them as individual files?
I have some log files inside a directory called log
ls -l /var/log/
org1_app.log org2_app.log org1_perf.log org2_perf.log ...
Now I set up an rsyslog client on the host server. Here is the ...
- 101