Questions tagged [rsyslog]

rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

rsyslog trigger different ruleset using a single port number

I would like to configure rsyslog to receive syslog with hostname header and IP header using TCP514. For example, craft a ruleset\template to separate the incoming syslog to /opt/log/%HOSTNAME%/...
1
vote
1answer
43 views

Rsyslog not able to read imfile from perforce directory

I am facing an issue in an Ubuntu server where Rsyslog is not able to read any file from the Perforce logs directory. I tested that Rsyslog configuration for the imfile module is working properly ...
0
votes
0answers
16 views

Facilty used by incoming syslog

I have been working with rsyslog over the past few weeks and familiarizing myself with it, but I am still a rookie on the subject. One of the use cases I have for it is to receive syslog messages from ...
-1
votes
1answer
59 views

(Linux) /var/log organisation using logrotate and rsyslog without breaking important systems [closed]

This is likely to elicit calls to close as it's asking for opinions, but I don't know how or where to ask in a more appropriate manner. Apologies in advance if this offends - it's not intended that ...
0
votes
0answers
21 views

Docker with syslog driver, duplicated but truncated / garbled lines

I'm trying to get my docker containers to write to syslog as my first step to managing logging of a handful of containers on a single box. Configuration is shown below: cat /etc/docker/daemon.json {...
0
votes
0answers
24 views

How to modify rsyslogd rate limiting parameters after module load

I am looking for a way to change parameters related to rate limiting after imuxsock module is loaded. Is it possible? The use case here is as follows. /etc/rsyslog.conf is provided by a separate team ...
0
votes
0answers
18 views

Remote server not using the client syslog template

I have following as a template to be used by the remote server: $template tpl1,"%timegenerated:::date-rfc3339% %HOSTNAME% %msg%\n" $ActionFileDefaultTemplate tpl1 When i look at my own machine's ...
1
vote
0answers
29 views

imtcp imtcp framing error in received tcp message from peer

I am trying to set datetime format for the remote server but I keep getting error whenever I set the following template: $template temp1,"%timegenerated:::date-rfc3339% %HOSTNAME% %msg%\n" and I set ...
1
vote
1answer
67 views

Writing MongoDB logs to a remote logging server

I am trying to forward MongoDB logs from several remote servers to a central logging server. To do this, I changed my mongod.conf files to use syslog like so: systemLog: destination: syslog ...
1
vote
0answers
100 views

RSYSLOG not creating tcp port

At a certain point this was working and I do not know what could have changed. No logs are going to the TFTP folder and instead I just see the error message posted below. I tried rebooting the server. ...
9
votes
1answer
260 views

Debian 9 server no sshd in auth.log

On one of my servers, Debian 9, there is no output from sshd in /var/log/auth.log. In fact, if I do ag sshd in /var/log, it just doesn't appear. The only thing in auth.log is systemd-logind. In fact, ...
1
vote
0answers
18 views

rsyslog ommail to localhost postfix

Is it possible to use the ommail module that comes with rsyslog to send email through a local postfix install. I use gmail as my smtp and ommail doesn't do authentication. Will using something like ...
2
votes
0answers
31 views

having trouble with rsyslog forward and include origin IP or iptables mirror while using ufw

How do i get rsyslog to mirror traffic unmodified (including origin IP) to another port? I have many devices sending data into port 514 but i need two different applications on the server to receive ...
2
votes
1answer
69 views

Does logrotate.conf override the config of the submodules?

I wonder which of the logs takes precedence over the other. Looking at rsyslog defined here, it defines daily rotation and keeping them for 30 days. vim /etc/logrotate.d/rsyslog /var/log/syslog { ...
1
vote
1answer
41 views

rsyslog property replacer regex requires double escape to use special characters?

Consider the following log line: 2019-04-20 21:17:57,505341,+0000 [Web,279,10.0.0.100] c4da4857-63b1-11a9-a00a-b0521699037b TCP RX ... I want to strip the timestamp 2019-04-20 21:17:57,505341,+0000 ...
0
votes
0answers
32 views

Unable to log machine's fqdn instead of “localhost” from java program

I am currently using log4j library in java to post logs onto syslog but those logs always show "localhost" for hostname instead of the device's actual name. This only happens when i send log from my ...
1
vote
1answer
29 views

Rsyslog - Logging locally with DynFile then sending to remote host

I have set up a centos7 box with rsyslog and am sending logs from multiple devices to it. What i would like to do is first have the logs be stored locally in a custom file/format with date, from-ip. ...
1
vote
1answer
51 views

rsyslog: parse nginx access log and send it via omhttp to backend

I need to read nginx access_log file and send data to http backend when line contents 'some expression'. It is a part of task to billing downloaded files via nginx access_log. Nginx stores log to /...
0
votes
0answers
40 views

Installation of Rsyslog on Centos 7

I need to install rsyslog on a CentOS 7 host. I have been trying to do so using the command "yum install rsyslog" but haven't been successful in doing so. The system does not even give a proper error ...
2
votes
1answer
29 views

can the log.file of rsyslog impstats module be limited by size?

I am using rsyslog 8.2.0, and logging rsyslog's own impstats output to a file. I could not find reference to it - is it possible to limit its size? It could get quite large in a system that runs for ...
1
vote
0answers
386 views

Logrotate: glob finding old rotated logs failed

I am having problems with logrotate. The configuration is the following /var/log/cron /var/log/maillog /var/log/messages /var/log/secure /var/log/spooler /var/log/unused.log /var/log/kern.log /var/...
1
vote
0answers
71 views

Using linux environment variable in rsyslog template

I'm trying to add an environment variable to my rsyslog template. I tried using 'getenv()' function without any luck, I always get an empty string in return. I'm attaching an example of my rsyslog ...
0
votes
1answer
58 views

Option to configure TLS version in rsyslog

Is it possible to configure the minimum TLS version supported by rsyslog? For eg., we would like an option to choose one of the following TLS 1.0 ( this should allow TLS connection over version 1.0, ...
0
votes
1answer
28 views

How can I categorise logs by port with rSyslog?

I've always used Syslog-NG for my logging situations, but my hands are tied and I have to use rsyslog, something I'm not overly familiar with. I largely understand how to configure it, however, one ...
1
vote
1answer
23 views

logrotate doesn't seems to work as expected

Below is my log rotation configuration for /var/log/messages. /var/log/messages { rotate 4 size 100M missingok notifempty compress delaycompress sharedscripts ...
0
votes
0answers
499 views

Syslog not logging

My syslog setup has been happily running for years, and suddenly I cannot log anything at all. With the default configuration I test logging by running a PHP script: php -r "syslog(LOG_NOTICE,'Test ...
0
votes
1answer
156 views

rsyslog 8.24 and multiple omfwd

I want to forward *.* to remote host via TCP/IP. Also, I have local0 facility where messages are plain JSON messages and they has to be forwarded to same host, but other port (and uses same ...
0
votes
1answer
125 views

Is rsyslog redundant on when using journald?

I have noticed log messages are duplicated in journald and /var/log/messages on my CentOS 7 system. At first I thought it was the journald option ForwardToSyslog (which defaults to 'yes' in the ...
0
votes
1answer
24 views

dyn_stats. how does it should work?

I have next config: module( load="impstats" interval="300" severity="7" log.syslog="off" log.file="/var/log/rsyslog-stats.log" ) dyn_stats(name="msg_per_host" ...
1
vote
0answers
216 views

docker Unix syslog delivery error

I faced at syslog related error when executing the program with the docker. docker run -d -e SERVER_ADDR=127.0.0.1 --name go-agent1 go-agent:1.0 Docker logs: 2019/03/15 01:59:08 Unix syslog ...
0
votes
0answers
38 views

rsyslog imfile to reread full file on timestamp change

I'm using rsyslog 8.36.0 version on CS6.0 . I have an application which writes to a file "/tmp/1". This file gets overwritten everytime the application runs (every 20mins/30mins). We want rsyslog to ...
0
votes
1answer
94 views

Filter docker messages from syslog

Looks like docker is writing duplicate messages to syslog. For instance Mar 6 23:53:45 ip-xx-xxx-xxx-xx docker[45287]: 2019/03/06 23:53:45 GET 200 xx.xxx.xxx.xxx /cas/...
0
votes
1answer
84 views

Setting source ip address of exporter in rsyslog.conf

An appliance has 2 interfaces. Would like to export syslog information using a particular interface ip address. How to configure this in /etc/rsyslog.conf?
2
votes
1answer
148 views

Rsyslog, exclude logs

i have a custom daemon that gives logs to rsyslog facility "local1" with two security levels - "info" and "debug". I need to write "info" logs to /var/log/info and "debug" logs to /var/log/debug. I ...
1
vote
1answer
206 views

rsyslog - separate local and remote logs

I want to use rsyslog to capture events from SANs, routers and such. (This will be forwarded to kafka and ultimately elasticsearch) So far - this is working fine. I have this configured in a config ...
0
votes
1answer
36 views

Forward messages encrypted

I have an rsyslog server at front and need to forward certain facilities to a remote server. I created a template for transport as HTTP body: template(name="syslogforward" type="list") { constant(...
0
votes
0answers
73 views

Support for extended ASCII characters in rsyslog

My rsyslog server is not able to correctly decode messages containing extended ASCII characters such as some french letters; e.g. é, ç. I have done a lot of search in google and tried many things but ...
0
votes
1answer
41 views

rsyslog: Forward different message types to same server with different templates

I have the following rsyslog config: template(name="logz.io" type="string" string="[TOKEN] <%pri%>%protocol-version% %timestamp:::date-rfc3339% [hostname] %app-name% %procid%...
2
votes
0answers
104 views

Rsyslog not logging after logrotate

I am using rsyslog and have a number of network devices sending their logs to this server. Rsyslog then splits each out device's logs into "devicename.log". Via this: $template FILENAME,"/data/logs/%...
1
vote
1answer
98 views

rsyslog/syslog-ng pattern to log ssh and related sftp session for an user

I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename: I have this: Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port ...
0
votes
2answers
69 views

Delete a log while is written using SED - /var/log/messages

I had a filesystem that was over 60%. I found that the file /var/log/messages had more than 4 million lines so I decided to delete 2 million lines in order to clear some space. I executed the command ...
1
vote
0answers
30 views

Log loadballancing using HAproxy

I'm trying to loadballance logs to a pool of rsyslog server using HAproxy but I'm failing to find a suitable solution when the source is a single client. HAproxy opens a session to one of the backend ...
-1
votes
1answer
28 views

Does rsyslog configuration support case statement?

Does rsyslog support case statement similar to C? switch ($programname) ​{ case "nginx": // code to be executed if n is equal to constant2; break; case "java": // code ...
1
vote
0answers
37 views

Rsyslog default action name not sequential?

I would like to ask question about rsyslog. I am using rsyslog v7 and gathering stats using impstats module. According to document, default naming of action queue is sequential based on occurrence of ...
1
vote
1answer
99 views

rsyslog writing to postgres. rsyslog process very high cpu, postgres very low cpu

I'm using rsyslog to write dns data to postgres. The messages are always quite short and similar to each other: <ip of host making dns request> <dns request> I use a regex to pull ip ...
1
vote
0answers
65 views

Rsyslog messages not making it to local logfile

I've been tasked with setting up longer/better log retention for our postgres servers, but after configuring postgres to ship logs to syslog via local0 I've found that they never actually hit the ...
0
votes
1answer
253 views

What is localhost.webcache in tcpdump

I'm trying to verify that a user is actually logging into my machine and I figured out that looking at tcpdump would be reasonable. I'm using the new omhttp module for Rsyslog to send logs via http ...
0
votes
0answers
46 views

tls session resumption in rsyslog

Background I have set up centralized rsyslog server that listens at some port for tls connections from rsyslog clients.The rsyslog clients establish tls connections with server and pushes their logs ...
0
votes
2answers
45 views

How to pass system stats to syslog

I want to pass system stats, especially CPU usage to rsyslog. Can somebody help me on this? Can we use logger tool to achieve this task? Thank you Luke
1
vote
1answer
223 views

What is the meaning of these HAProxy configuration lines?

I've seen several examples (see below) of HAProxy logging configuration that all look like this: /etc/haproxy/haproxy.cfg global log /dev/log local0 log /dev/log local1 notice ...