Questions tagged [rsyslog]

rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

Forwarded syslogs received on port 514 of local system doesn't shows up in /var/log/messages despite configured UDP/TCP input

Below the rsyslog.conf file is the "Out Of the Box" unmodified except UDP and TCP input have been uncommented . Using tcpdump I can see logs arriving on port 514 TCP but they are not copied ...
0
votes
1answer
20 views

duplicate packet to another local host(SIEM)

We have a Central Syslog server that we use to collect all logs from our hosts and recently got a SIEM that we also want to collect the logs. We would like the Central Syslog server to duplicate the ...
0
votes
0answers
31 views

how to forward log file or filtered message contents using rsyslog

I am trying to filter out logs from journalctl so that matched logs can be forwarded to remote rsys server. /var/log/custom log is getting constructed properly from the filer but not able to forward ...
1
vote
0answers
20 views

rsyslogd does not write all messages to file

Rsyslogd is configured to send remote logs to another port on the same server (network monitoring tool) and also write them to file and network monitoring tool gets more message than there are in file....
0
votes
0answers
22 views

How do I send multiple log files to graylog server?

Trying to figure out how to send local multiple logs files to remote server using syslog-ng. Following Local file logs: /var/log/2020/09/access/2020-09-01-access.log /var/log/2020/09/account/2020-09-...
0
votes
1answer
32 views

Rsyslog keeps writing to /var/log/messages and subfolders

I have a rsyslog on CentOS 8 where I configured several systems to subfolders with this part of config $template RemoteLogs,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/syslog.log" *.* ...
0
votes
0answers
24 views

rsyslog multiline not working for custom log

I am having my application custom log as below. I want to send each "<exclusive-start id" till next string as one message. Not able to get multiline as single message. Kindly let me know ...
0
votes
0answers
194 views

apache2 not sending logs to remote server via rsyslog

both apache access & apache error logs not arriving on central server. some logs are successfully arriving tho including: auth, authpriv, cron, daemon, kern, syslog logs. what else do i need to ...
0
votes
1answer
25 views

How to sort incoming log messages by their hostname & timestamp with Rsyslog?

I was curious if anyone has sorted incoming logs captured by Rsyslog by hostname and time stamp in the log. Right now I have Rsyslog sort messages by the hostname moving them to appropriate folders ...
0
votes
0answers
20 views

Rsyslog extract data

Am searching this for 3 days nothing worked, can somebody help to get this regex for rsyslog string expected is ***Aug 19 08:42:07 ip-10-5-1-18 sshd[12300]: Invalid user ubunt from 111.92.25.118 tried ...
0
votes
0answers
31 views

Setting up rsyslog with TLS support

Recently I've setting up rsyslog with TLS support to receive logs from different servers. I am using gnutls library and my configuration is like this. # Listen for TCP $ModLoad imtcp # Listen on port ...
0
votes
0answers
13 views

Always showing No match for Regular expression Rsyslog template

My need is to find the IP and port from the tcp streamed input. Here is the template file I defined to get the IP but am always getting No Match here is the expression. template(name="ip-json&...
0
votes
1answer
98 views

rsyslog, is there a way to see the facility codes of messages recieved?

I have a cisco ftd sending logs tagged with local3(19) however I am still seeing some messages ending up in my users.log instead of where i have them configured to be sent. Is that where they would ...
0
votes
0answers
15 views

Rsyslog creates filename with utf8 characters

I have the following configuration in my rsyslog server (version 8.16 on ubuntu 16.04): input( type="imrelp" port="514" ) template( name="path" type=&...
0
votes
0answers
17 views

Create custom logrotate for remote logs

Hi this is related to this question. I am running CentOS8 + SELinux set to enforcing. I need some info on how to properly create a logrotate for my remote logs that use the template of $template ...
0
votes
0answers
24 views

how to avoid logging to /var/log/syslog for a given application?

I have an application which successfully logs (via local0) to its own files, the problem is that it keeps logging to /var/log/syslog, which is what I want to avoid. rsyslog version: rsyslogd 8.1901.0 ...
0
votes
0answers
30 views

Local logs are not being written after remote logs- rsyslog

My remote logs are going to DB as well as written on server (they both are working fine) but the problem is local rsyslog server is not writing any logs to local files. /etc/rsyslog.d/00-mysql.conf ...
0
votes
0answers
7 views

localise settings for custom log files with custom configs

I'm trying to change the permissions of the log file I create. The configuration is in rsyslog.d/ directory, but whenever I change the file permissions with $Umask 0000 $FileCreateMode 0644 It's ...
0
votes
0answers
20 views

Prevent rsyslog remote logs to save in local /var/log after they have been written to mysql

I just want to sav remote logs to mysql database, which it is working but it also saving it in /var/log files, also I see remote logs in /var/log but not the local host logs, how can I enable that. /...
0
votes
0answers
14 views

rsyslog: How to get imuxsock to read kernel messages?

Does anyone have any idea how to get imuxsock to read kernel messages? We have been having trouble getting any rule in an imuxsock ruleset to read kernel messages, in particular those from iptables. ...
0
votes
0answers
46 views

How to compress log which is differed by name and date

Does anyone know how to compress log if the log contains date. For example: /var/log/example/examplelog-20202905.log /var/log/example/examplelog-20203005.log /var/log/example/examplelog-20203105.log ...
1
vote
1answer
246 views

rsyslog has no /var/lib/rsyslog directory, which results in: “Permission denied', path: '/imjournal.state.tmp”

Host details: kkahn@host:~$ cat /etc/redhat-release CentOS Linux release 7.6.1810 (Core) kkahn@host:~$ uname -a Linux host.example.com 3.10.0-693.el7.x86_64 #1 SMP Tue Aug 22 21:09:27 UTC 2017 ...
0
votes
1answer
30 views

Unable to log with HAProxy

I've been following the instructions found here, https://www.haproxy.com/blog/introduction-to-haproxy-logging/, to setup our logging. As documented, I made an rsyslog config file, haprorxy_log.conf, ...
0
votes
1answer
125 views

CentOS 8 remote logging logs on both custom log and /var/log/messages

I'm trying to configure a remote log host for my servers (all CentOS 8). I added this on my central server if $fromhost-ip == '123.123.123.123' then /var/log/{{hostname}}.log Also I changed my client ...
0
votes
0answers
45 views

Multiple SFTP Servers sharing common chroot path logging issue

I am setting up an SFTP service with multiple EC2 instances for High Availability on AWS with a common EFS Share (mounted at /efs/sftp). ,--------, | | | ...
0
votes
1answer
44 views

How to stream some logs over TCP from rsyslog in Docker?

I need a very simple thing (for an integration test of a larger system, orchestrated by docker-compose): to setup a Debian based Docker image with rsyslog inside, so that when it is run, rsyslog will ...
0
votes
0answers
18 views

Rsyslog - debugg error logs

I run rsyslog in the debugg mode (-dn) and I show this logs : 0153.213242514:main thread : nsd_ptcp.c: We could initialize 1 TCP listen sockets out of 2 we received - this may or may not be an ...
0
votes
0answers
16 views

Rsyslog queueing: configuration failed

I want to use queueing/disk buffer with rsyslog (8.37.0) for each rsyslog config. I've configure this rules : template(name="test_template" type="string" string="/data/%FROMHOST-IP%.log") ruleset(...
0
votes
0answers
31 views

Rsyslog tcp forward failed

I've this sub configuration : UDP configuration : Works template(name="template1" type="string" string="/var/log/rsyslog/%$YEAR%/%$MONTH%/%HOSTNAME%/%HOSTNAME%-%FROMHOST-IP%.log") ruleset(name="...
0
votes
1answer
102 views

Rsyslog / CentOS 8 / no write logs|no catch?

I use rsyslog (8.37.0-13) on CentOS 8 (CentOS Linux release 8.1.1911) and I've type error with my configuration. My rsyslog.conf is : module(load="imuxsock") module(load="imjournal") module(load="...
0
votes
1answer
30 views

Seperate PROCID from SYSLOGTAG using $template

Im setting up a centralized rsyslog server using a Raspberry Pi with LogAnalyzer web frontend to view the logs. Everything is setup and working except the parsing of fields into the MySQL database. As ...
0
votes
0answers
46 views

PHP binaries are deleted every hour for no apparent reason and other issues

Since yesterday I am fighting with very strange issues on one of our servers. Environment: We use proxmox to run few LXC containers based Debian virtual machines. Yesterday night something happened ...
0
votes
1answer
91 views

Rsyslog “typo error” CentOS 8

I use rsyslog (8.37.0-13) on CentOS 8 (CentOS Linux release 8.1.1911) and I've type error with my configuration. My configuration is : template(name="template1" type="string" string="/data/%HOSTNAME%...
1
vote
1answer
177 views

Rsyslog not sending buffered messages

My requirement is to log all messages on the remote machine. In order to achieve the goal I have two identical versions of rsyslog (rsyslogd 8.1901.0 (aka 2019.01)) on both machines (server: 192.168....
0
votes
0answers
24 views

/var/log/messages not sending to the rsyslog central logging server

Everything else is being logged to the central rsyslog server but not the /var/log/messages of the rsyslog client. server: learn -> 192.168.1.100 client: server101 -> 192.168.1.200 From the rsyslog ...
0
votes
0answers
248 views

How to restart rsyslog on alpine?

In my alpine 3.1..5 linux docker container, I installed rsyslog as: # apk add --no-cache rsyslog I am running rsyslogd as: # rm -f /var/run/rsyslogd.pid # rsyslogd How do I restart rsyslogd ...
0
votes
0answers
24 views

CentOS 6 rsyslog continuous stream of entries filling up /var/log/messages

After running yum update on one of my boxes, I am receiving a continuous stream of entries in /var/log/messages and fill up the disk. I could not make out where the events are coming from Linux host1 ...
0
votes
0answers
10 views

How to define custom time format and different file for each other in a single rsyslog template?

I am trying to define custom log format and separate log file for each host in a single template. I am getting my desired log-line though following template. template(name="servers" type="string" ...
0
votes
1answer
24 views

rsyslog logging asa data to multiple files

I setup rsyslog to log asa data to /var/log/asa/asa.log. That worked fine. But it's also logging asa details to /var/log/messages. I only want it to go to /var/log/asa/asa.log/. Here is the ...
0
votes
1answer
28 views

rsyslog with avro encoded log decoding fails

I am using rsyslog, I have my devices send custom logs to rsyslog encoded in avro. When i receive this log in rsyslog via udp port, I am able t decode. But when it get stored in rsyslog and I try to ...
0
votes
0answers
17 views

Rsyslog udp input on a port output via inputname to a file using the omfile plug-in?

Is it possible to write all logs received on a specific port (ie. udp 1514) to 1 log file using the omfile plug-in ? Like this or similar? $UDP514ServerRun 514 $UDP1514ServerRun 1514 if $...
0
votes
0answers
18 views

Logging chrooted users with different socket/hide “/dev” folder

I have a few chrooted users on my sftp-server. Logging works as intended, but I have one simple question: Is it possible to hide the "/dev" folder for the users? My configuration now: module(load="...
0
votes
0answers
32 views

ommail module; regex expression html format body

Rsyslog version: rsyslogd 8.24.0-41.el7_7.2 I am trying to format an email as html and extract some piece of msg for subject, and the rest for mail body. I am testing regex expressions on https://www....
0
votes
1answer
116 views

how to send log from post-auth with Freeradius?

I want to send message to remote syslog in post-auth section. Simple string with "'%{User-Name}', '%{reply:Packet-Type}', '%{Calling-Station-Id}'" How do it with FreeRADIUS 3 ? Or.. How to split ...
0
votes
1answer
123 views

rsyslog sending custom log to remote sever

I have found an answer on stackoverflow, but using same exact config, apart changing the mine to minecraft_server, returns: Mar 25 05:21:29 gameserver rsyslogd[7027]: invalid or yet-unknown config ...
0
votes
0answers
36 views

Display the custom token of a cloud based application on rsyslog with it's original syslog messages automatically just like in syslog-ng

I Was wondering whether there's a way to display the custom token of a cloud based application on rsyslog with it's original message automatically just like in syslog-ng without manually adding the ...
2
votes
1answer
457 views

pam_unix generates a lot of open/close sessions for my domain user

I setup a new VPS with ubuntu 18.04, including virtualmin/usermin. In auth.log I see a lot of su[12936]: Successful su for domain by root su[12936]: + ??? root:domain systemd-logind[148]: New ...
0
votes
1answer
49 views

Log a message from Windows to a Syslog server (Wireguard)

I would like to know when a Wireguard client set a tunnel up. So is it possible to do something like : PostUp=command_which_creates_a_syslog_event Because I don't see any other way to log when a ...
0
votes
1answer
434 views

Sending e-mails alerts with rsyslog

I was requested to enrich our current alerting system on rsyslog by adding mailing capabilities for some specific use cases. The plug-in ommail seems to be the one to use with rsyslog to do so. ...
0
votes
1answer
170 views

rsyslog over RELP fails on Ubuntu 18.04

On Ubuntu 18.04 and rsyslogd 8.32 logs are sent correctly over tcp without RELP with the next configuration: Server [192.168.1.201] (/etc/rsyslog.conf): module(load="imuxsock") # provides support ...

1
2 3 4 5
12