Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [rsyslog]

rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

Rsyslog - "Warning: CA certificate is not set" but TLS forwarding still works

I am configuring rsyslog to forward over TCP/TLS. I was curious why, unlike HTTPS, I had to add the certificate to my client, so I went against the README and commented out the cert config, leaving me ...
user avatar
0 votes
0 answers
12 views

configuring rsyslog to read from network interface, reformat it with template and output to redis

I have a interface log something like: Apr 19 16:47:37 2022-04-19 16: 48:59 TE-GI-FW-01 %%something:IPVer=4 pt=udp DPort=1701 SIP=2.2.2.2 SPort=41753 Now I what to ...
user avatar
0 votes
0 answers
16 views

systemd journal - delete logs belonging to a specified unit?

Like there is a way to show all logs belonging to a unit: journalctl -xu <unit>, Is there a way to clear the logs belonging to a specified unit with journalctl ? Actually, my problem is, one of ...
user avatar
  • 32
0 votes
1 answer
30 views

rsyslog - how to tag and apply ruleset by line contents?

I am cleaning up and standardizing our log handling, adding fluentd and ELK. This part is working fine, since nginx is logging to its own file: input(type="imfile" tag="app.nginx" ...
user avatar
0 votes
0 answers
43 views

rsyslog is running, but nothing is output

nice to meet you. Suddenly nothing is being output in /var/log/messages, cron, secure, etc... I have not restarted rsyslog or modified /etc/rsyslog.conf, so I do not know why. Even after rebooting, ...
user avatar
  • 1
0 votes
0 answers
43 views

secure rsyslog using tls

I followed along several methods, for using TLS with rsyslog. I end up with a anon error message among others. Is TLS with rsyslog possible on a Rocky Linux 8.5 latest kernel? Last method used: https:/...
user avatar
0 votes
0 answers
30 views

Unable to get kernel log messages written to a specific log file on syslog server

I have a working rsyslog setup with CentOS as my server and I am using Kali as the client. I am able to use logger on Kali to send test log messages and see the log messages appear in the CentOS ...
user avatar
0 votes
0 answers
21 views

How to change sending messages with Rsyslog?

i have following rsyslog messages which are going to rsyslog server and i would like to make hidden numbers eg from sip:023401412590 to sip:xxxxxxxxxxxx does someone have a hint how to do following? ...
user avatar
0 votes
1 answer
49 views

Why some companies like cisco follow different syslog messaging format rather than rfc 3164 (BSD syslog) and rfc 5424 (IETF syslog)?

According to my understanding the popular syslog formats are: RFC 3124 (BSD syslog): Format: < priority >timestamp hostname application: message Example: <133>Feb 25 14:09:07 webserver ...
user avatar
  • 5
0 votes
0 answers
53 views

my rsyslog not listening in the port

I have a librenms that is not collecting the syslogs, so it seems that it is not listening through the port. I copy the /etc/rsyslog.conf and the ports it listens to see if you see something wrong >...
user avatar
0 votes
1 answer
81 views

rsyslog change timestamp format for specifix filter

I wish to change my rsyslog timestamp format to RFC-3339 of specific log file (msg). I have the following file /etc/rsyslog.d/10-zn.conf with the following content: :msg, contains, "my_prefix&...
user avatar
0 votes
0 answers
44 views

rsyslog doesn't always insert hostname

%HOSTNAME% doesn't get injected inside of all logs that are received. They are coming from the same IP address and most of them get marked. However, some of them just don't get a host name in front of ...
user avatar
  • 3
1 vote
0 answers
13 views

How can I be assured that rsyslog complies with RFC5424 (I haven't found any direct mention on rsyslog documentation)?

I have a requirement for a system that specifies RFC5424 base for event logging services.
user avatar
  • 11
1 vote
1 answer
72 views

Format SFTP Logs to have Username on Each Entry

I'm running a production server (Debian 10, standard OpenSSH package) that has Pure-FTPD running for legacy connections and SFTP for all our current connections. The SFTP server is setup with a chroot ...
user avatar
0 votes
0 answers
19 views

Prevent ufw to log lines based on string/keyword?

Is it possible to prevent certain repeating lines to be logged in ufw log? I basically wants to stop all lines containing UFW BLOCK & SRC=192.168.0.202 Full line example: Feb 5 13:03:38 ddomain ...
user avatar
0 votes
1 answer
25 views

does remote logging stops local logging

I'm using a Graylog server to centralize logs from network equipment and servers and I'm wondering if the Syslog service on the switches, windows machines, and other equipment, that service still ...
user avatar
1 vote
0 answers
20 views

Rsyslog not sending to server when filesystem fails

I have on my servers an rsyslog client, that supposed to send logs to rsyslog server. Recently there was an issue on one of the servers where the filesystem went into read-only. This caused local logs ...
user avatar
0 votes
0 answers
27 views

How can I change/truncate/delete structured-data properties?

I have an rsyslog stream that accepts RFC-5424 messages from a wide range of applications and forwards them to a storage backend in RFC-5424 format. Since they originate from so many sources, I have ...
user avatar
1 vote
1 answer
119 views

IPTables log connection pid on OUTPUT chain

I'm trying to find pid of a socket using iptables OUTPUT chain log, or even better adding it into the log. My current iptable rule: sudo iptables -A OUTPUT -j LOG --log-prefix='[PID]' --log-level 7 --...
user avatar
0 votes
1 answer
169 views

rsyslog: regex extract between 2 strings

I want to extract a substring of msg field between 2 strings. Example of the log: Test local logging: db=testdb,message What I want is "testdb", so, the string between "db=" and &...
user avatar
  • 1
0 votes
0 answers
41 views

Rsyslog Not received logs from network devices

I recently provisioned a new rsyslog server, everything is good from network/Linux/security side but still not receiving logs from network devices. Can you please suggest me what could be the issue? ...
user avatar
  • 1
1 vote
1 answer
20 views

Will rsyslog recover from unavailable unix domain socket?

I am following the instructions for NXLog here: https://nxlog.co/documentation/nxlog-user-guide/linux-logs.html#linux_logs_forwarding_socket_example under 80.2 about forwarding syslog messages to ...
user avatar
  • 3,130
0 votes
2 answers
57 views

How to disable crontab list entries in cron log?

I have a script on server that runs every few min, and among other things checks if some malicious crontab entries have been injected. In order to do this I check crontabs of all users, which works ...
user avatar
  • 23
0 votes
0 answers
123 views

rsyslog - Lower throughput when using omfwd with TCP vs UDP

TLDR; I'm getting significantly lower throughput when forwarding syslog messages with rsyslog on a Redhat server with 32 cores and 128Gi RAM to a remote server using TCP instead of UDP syslog in the ...
user avatar
0 votes
0 answers
90 views

treatments of /var/log/messages with rsyslog

I having problems with my /var/log/messages file. Indeed, I collect logs from different network switches on my server and their logs go in a special file + the messages file. I would like the switch ...
user avatar
1 vote
0 answers
56 views

stop kernel audit messages logged in syslog without disabling auditing

OS: CentOS 7 I am trying to figure out how audit (kaudit) events are logged in /var/log/messages. I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
user avatar
  • 1,595
0 votes
0 answers
35 views

Iterating over all structured data in rsyslog templates

I've got a bunch of services that log to a remote rsyslog instance using RFC5424 structured data format. I then need to convert that into JSON to feed to logstash which then feeds it into ...
user avatar
  • 285
0 votes
0 answers
29 views

How do I convert these filtering statements to Rainer script with an if-then tied to a specific host in my rsyslogd.conf?

I have in my rsyslog.conf on my listener phenex.localnet for my home gateway aka hell.localnet: module( load="imudp" ) input( type="imudp" port="514&...
user avatar
0 votes
0 answers
85 views

rsyslog is not logging any messages

I am currently trying to test out a syslog server running on an RHEL AWS instance. The only edits I have made to the config file are uncommenting these sections for TCP/UDP port 514 as well as ...
user avatar
0 votes
0 answers
69 views

How do I, or is it possible to, in rsyslog map non-standard field names to standard variables?

I'm working on centralizing my logs to a syslog server and will have a fortigate and Windows servers (2016) sending syslogs to a single linux server running rsyslog and store them in mysql. I ...
user avatar
0 votes
1 answer
130 views

Rsyslog expression with $programname is not working

got this in my rsysconf: $template TemplateLog,"%msg%\n" $template DynamicLog,"%msg%\n" ...
user avatar
  • 101
0 votes
1 answer
426 views

logs are not going into log file even after having rsyslog config

I am facing problem. I have two different harpxoy linux servers (in diff network range). In one server, i can see logs are getting generated in log file but on other server, the logs are not getting ...
user avatar
  • 11
0 votes
1 answer
100 views

Issue with rsyslog creating mutliple log files from a remote cisco switch

So here is our setup Server: rsyslog server - CentOS 7 Client: Cisco Catalyst C6880-X-LE /etc/rsyslog.conf from the CentOS 7 server: $ModLoad imuxsock # provides support for local system logging (e.g....
user avatar
  • 238
0 votes
0 answers
35 views

rsyslog how can i compress all messages with templates

Aside from storing log messages to specific files, I am trying to also compress them for archiving purposes. Logrotate will just rotate plain files. The way I tried to solve this is by adding a ...
user avatar
  • 1,595
0 votes
0 answers
54 views

TripleO: How to configure containerized rsyslog to use graylog instead of elasticsearch

Overview Let me first give a short overview of what we want to accomplish. I am currently helping to deploy a TripleO Openstack Cloud, and we would like to use a different way of storing the logs ...
user avatar
  • 1
0 votes
0 answers
306 views

systemd messages in /var/log/messages

We are using rsyslog via the boost logging sinks, for logging messages from the application process into /var/log/messages on RHEL 7. The log messages are preceeded with "LogMsg". The ...
user avatar
0 votes
0 answers
36 views

Excluding an eMail address from Postfix logging with rsyslogd

I have configured my Postfix with multiple domains. The mail transportation works well, but i will like to disable logging of emails transported to one eMail address, for example: blackhole@mydomain....
user avatar
0 votes
1 answer
162 views

Can I have specify TLS configurations in a template?

I am trying to set this up for SIEM ingestion on RHEL 8. I have this configuration below, however, the normal non-tls TCP doesn't work. I know the problem is because I have gtls globally and in my ...
user avatar
  • 1
4 votes
5 answers
5k views

How can root start a process that only root can kill?

It is easy to start a process at background or make it as systemd service. However, if I want to start a process that monitors activities on the Linux machine, it fells to the target of attacks. If ...
user avatar
  • 328
2 votes
0 answers
127 views

Huge CPU usage when enable rsyslog TLS

We currently using rsyslog for gathering logs from ~1M IoT devices, we used to use plain-text UDP syslog and our server handling those just fine with minimal system load, but now because we need to ...
user avatar
  • 493
2 votes
1 answer
299 views

Getting Syslog to log to both syslog and custom log file

In syslog (Raspbian rsyslog swVersion="8.1901.0"), I am trying to match / filter a system msg containing a specific string BOTH to /var/log/syslog (default) AND to a custom separate log file,...
user avatar
1 vote
1 answer
39 views

Rotation not executing when file size reaches certain threshold

I have the following configurations in /etc/logrotate.d/rsyslog: /var/log/syslog { rotate 7 size 1G missingok notifempty delaycompress compress ...
user avatar
0 votes
1 answer
88 views

Limit number of available archives in syslog rotation

I have the following configuration for my /etc/logrotate.d/rsyslog file. In it, i explicitly declared the number of days it will rotate to 4 and the size of the rotation archive file as 100k for /var/...
user avatar
0 votes
0 answers
44 views

Rsyslog omfwd takes 30 to 45 minutes to begin forward messages

I am forwarding syslog messages from thousands of devices to 8 destinations. In and out traffic is UDP, and we use non traditional ports. I also balance the outgoing load by binding the omfwd actions ...
user avatar
  • 1
0 votes
0 answers
86 views

rsyslog seems to be triggering sdhci dumps when writing in external storage

Acording what I read, rsyslog is usually used to process logs and send them to another locations, either local (external storage, specific partition, etc.) or remote (logging server, for example). ...
user avatar
0 votes
0 answers
167 views

rsyslogd stores remote logs to duplicate location

i configured rsyslog to store remote logs coming in under a custom directory: /var/log/fleet. The Logs created in the hostname and programm derived directories are created where intended, but the ...
user avatar
0 votes
0 answers
82 views

RSyslogd is sending multiples CEF messages in the same Syslog message

There is a Python script sending multiple events to a remote host with Rsyslogd: CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=767000670128771115 CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=...
user avatar
0 votes
0 answers
37 views

How to reduce repeat log in debian 10?

In similar quesiton,I know echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created ...
user avatar
  • 835
4 votes
1 answer
1k views

What happens to logs generated by logger if there is no logging daemon installed or active

If you have a Linux distribution either without a logging daemon installed, or with the logging daemon disabled, what happens to the logs generated by the logger command? I have Ubuntu 20.04.2 with ...
user avatar
  • 448
0 votes
0 answers
244 views

how to send log file using rsyslog

I am using Centos 7.6 and have configured rsyslog server and able to send logs(syslog) from client to server, but I need to transfer the file /var/log/wtmp to rsyslog server and I have tried below ...
user avatar
  • 1

1
2 3 4 5
14