Questions tagged [rsyslog]
rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.
685
questions
1
vote
0
answers
140
views
Why can't rsyslogd find libgcc_s.so.1?
Scenario: Running a debootstrapped Ubuntu 11.4 lxc guest on a Ubuntu 12.4 lxc host.
Inside the lxc guest, rsyslogd is constantly crashing with SIGABRT stating:
libgcc_s.so.1 must be installed for ...
- 1,136
1
vote
1
answer
4k
views
Ubuntu 12.04 - Change rsyslog to use EDT|EST instead of UTC
Right now, I have rsyslog handling a log for a PHP app. Well...I have PHP using rsyslog to do the logging. Currently, it logs time in UTC. I want it to log in EST/EDT as appropriate. How do I make ...
- 119
1
vote
1
answer
556
views
Splitting rsyslog messages into files based on source (heroku drain)
I set up a heroku log drain, which sends messages to port 514 on my logging instance. The log server sends the messages /var/log/syslog, though, and I'd like it to send them to /var/log/appname.log or ...
- 121
6
votes
1
answer
26k
views
rsyslog not logging messages
i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check ...
- 309
5
votes
1
answer
1k
views
rsyslog update on Amazon Linux suddenly treats INFO level messages as EMERG
I'm having strange issue with rsyslog on some of my EC2 instances running Amazon Linux 2012.3.
Upon yum upgrading rsyslog 4.6 to 5.8.10, it seems like every INFO level log message is suddenly treated ...
- 53
1
vote
2
answers
3k
views
Remote logging - Nginx over Rsyslog or any other alternative
I need to setup centralized remote access logging of Auto Scaling Instances. Currently I have Rsyslog / Apache2 logging working just fine, but for the new project Nginx is used and I don't see any ...
- 642
0
votes
2
answers
283
views
Server unresponsive, messages shown on console but not in log files
I'm using Ubuntu Server 10.04.4, and once in a while the server hangs (once a month) and is totally unresponsive. The tty is flooded with messages like these. The problem is that these messages are ...
9
votes
2
answers
39k
views
syslog ip ranges to specific files using `rsyslog`
I have many Cisco / JunOS routers and switches that send logs to my Debian server, which uses rsyslogd.
How can I configure rsyslogd to send these router / switch logs to a specific file, based on ...
- 8,339
0
votes
1
answer
2k
views
Trouble with backslash characters and rsyslog writing to postgres
I have rsyslog 4.6.4 configured to write mail logs to a PostgreSQL database. It all works fine, until the log message contains a backslash, as in this example:
Jun 12 11:37:46 dc5 postfix/smtp[...
- 2,472
4
votes
1
answer
1k
views
Rsyslog Discarding Unwanted Messages
Once again, i found that Rsyslog is not as flexible as i expected...
My application logs to LOCAL5.* ( depending on the severity )
I would like to see on my centralized log server only LOCAL5....
- 3,610
1
vote
3
answers
1k
views
Why aren't Heroku syslog drains logging to rsyslogd?
I'm having a problem using syslog drains as described in https://devcenter.heroku.com/articles/logging.
To summarize, I have an Ubuntu 10.04 instance on EC2 that is running rsyslogd. I've also set ...
- 171
29
votes
2
answers
121k
views
How to forward specific log file outside of /var/log with rsyslog to remote server?
How can I forward message from a specific log file like /www/myapp/log/test.log with rsyslog client to remote rsyslog server? This log file is outside of the directory /var/log.
- 447
1
vote
1
answer
4k
views
rsyslog: large memory consumption
rsyslogd 4.6.4, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
FEATURE_NETZIP (message compression): Yes
GSSAPI Kerberos 5 support: Yes
...
- 183
17
votes
1
answer
49k
views
manually rotating logfile with rsyslogd
I want to force logfile rotation using logrotate -f /var/log/syslog, but it's only return tones of:
error: syslog:1 unknown option 'May' -- ignoring line
error: syslog:1 unexpected text
I know that ...
- 1,003
3
votes
2
answers
3k
views
Removing 'local7' log entries from /var/log/messages
Using rsyslog.conf on Ubuntu -
The default line for /var/log/messages in 50-default.conf is:
*.*;auth,authpriv.none -/var/log/syslog
I'm starting to log a lot of things at the local7 level - ...
- 155
5
votes
2
answers
23k
views
rsyslog: How do I direct messages from all remote machines to one file?
We have a syslog server and we have all our servers logging to it.
We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.
Anyone know how to ...
- 10.9k
1
vote
2
answers
571
views
haproxy rsyslog entries are without microsecond
I changed my (Debian 6.0) rsyslog configuration so that it uses high-precision timestamps. Indeed it does, and it gives me microseconds, both in kernel entries and in some other entries such as puppet'...
- 2,626
7
votes
2
answers
10k
views
rsyslogd: Any way to get around the number of local facilities?
We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
- 10.9k
1
vote
1
answer
1k
views
Haproxy log each frontend to different file with rsyslog
I have many frontends in haproxy, I plan to log each frontend to different file, for example, frontend a to /var/log/a.log, b to /var/log/b.log, but haproxy's log facility must be one of the 24 ...
- 719
5
votes
1
answer
4k
views
How to maintain the log source host using logstash
I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter.
In the ...
3
votes
1
answer
4k
views
syslog writing to general instead of specific file
I'm running Ubuntu and Postgresql 9.
I've enabled postgresql to log to syslog, and added the following directive to the config file:
syslog_facility = 'local0'".
I've tried to configure syslog to ...
- 155
4
votes
2
answers
1k
views
rsyslog appears to act on old configuration
I'm using a template to dynamically generate rsyslog filenames. I've made some changes from my original format, but rsyslog still appears to be using both the new template and the old after restarting....
- 171
0
votes
1
answer
667
views
rsyslog from Heroku drain creates empty log files
I'm sending logs from my Heroku app to an rsyslog server, but the resulting log files seem to come up empty. The rsyslog configuration for receiving remote messages is as follows:
$template ...
- 171
6
votes
3
answers
11k
views
Increase rsyslog/syslog precision to include fractional seconds?
I use syslog and rsyslog to handle logging on my Linux & FreeBSD systems.
The timestamp is currently in seconds but I would like to increase the precision of these timestamps to include ...
- 24k
1
vote
0
answers
135
views
Rsyslog Not Getting the Logs on Time
I have two central rsyslog server accepting UDP logs from multiple client machines.
Both are configured exactly the same.
For some reason, the 1st server doesn't get the logs from the client ...
- 817
3
votes
1
answer
666
views
rsyslog with heroku
I'm trying to capture logs from Heroku. I have setup as suggested http://devcenter.heroku.com/articles/logging#syslog_drains.
I'm completely new to the rsyslog, please bear with me.
Where do I see ...
- 131
19
votes
4
answers
49k
views
Configuring Rsyslog To Stop The Logging Of Certain Messages
I want to stop rsyslog logging these messages.
[168707.740364] TCP: Peer 192.168.100.1:46199/41503 unexpectedly shrunk window 2027330493:2027331431 (repaired)
I tried this in the /etc/rsyslog.conf ...
- 201
0
votes
1
answer
176
views
syslog - log line classifications [closed]
A very generic question; in the context of a programmer, with operational aspect of the process (program) in mind.
Is there any sort of best-practice / guide to classify messages, particularly in the ...
- 304
6
votes
3
answers
4k
views
Syslog severity levels when to use Alert vs Critical
Short overview: Is Alert more severe than Critical.
RFC 5424 briefly defines syslog severity levels and gives a short description. Each syslog level is given a code 0 - 7. It was my understanding that ...
- 751
0
votes
1
answer
2k
views
How to remote log with Nginx
Have anybody experience on remote access and error logging of Nginx?
We have such setup for Apache, but would like to migrate to Nginx.
- 642
3
votes
2
answers
5k
views
named stopped logging to rsyslog after logs rotate
CentOS 6.2, bind 9.7.3, rsyslog 4.6.2
I recently set up a server, and I noticed that named had stopped logging to /var/log/messages after the logs had rotated. I thought that was odd, since all ...
- 330
0
votes
1
answer
1k
views
rsyslog nested rules for snoopy
I currently have a rsyslog rule to split up all logging from snoopy into a file for each user
~$ cat /etc/rsyslog.d/10-snoopy.conf
$template DYNsnoopy,"/var/log/snoopy/uid.%msg:R,ERE,1,BLANK:uid:([0-...
- 917
4
votes
2
answers
2k
views
Centralized logging over intermittent connection
I'm using rsyslog to forward syslog entries from a pile of servers to Loggly
The configuration looks something like this:
# Config for loggly upload
*.* @@logs.loggly.com:12345
This works, but ...
- 259
3
votes
2
answers
15k
views
RSyslog does not work with a log file located outside of /var/log
I am unable to get rsyslog to write to a log file located in a directory other than /var/log.
The server is RHELS 5.6 and for the most part with a default configuration. Other than the rsyslog ...
2
votes
1
answer
5k
views
what's causing rsyslog to log $msg**INVALID PROPERTY NAME** instead of the message contents from sonicwall devices?
I have a pair of sonicwall devices pointed at an rsyslog (v4.6.2) instance that are apparently formatting their messages unagreeably for the mysql plugin.
The rsyslog instance logs other devices ...
- 31
1
vote
1
answer
2k
views
snoopy rsyslog output file rule
I'm just setting up snoopy logger on my personal machine to archive commands I've run.
I'm attempting to setup an rsyslog rule to move its messages from /var/log/auth.log to /var/log/snoopy.log
I've ...
- 917
0
votes
3
answers
6k
views
0
votes
2
answers
1k
views
log forwarding performance and OS bottleneck
How many logs/second can usually be handled by syslog servers? By syslog servers, I am referring to rsyslog, syslog-ng, splunk etc. The intent of the question is to find out at what logs/second rate ...
- 105
2
votes
0
answers
382
views
How to prevent rsyslog from relaying messages
How can I make rsyslog behave like the default of the old syslog, that it will not be relaying (not forward messages coming from remote hosts to another host)? I.e., that it will only forward locally ...
- 149
1
vote
1
answer
1k
views
Remote rsyslog on Debian
How does one enable remote listening with rsyslog (on Debian). Forgive what seems like a super basic question, but all the docs I'm finding about it seem to apply to older versions in which one would ...
- 163
2
votes
2
answers
5k
views
rsyslog - relaying only remotely received messages (edit: nxlog will be better)
I am looking at building a syslog relay in order to move from my clients'-enforced UDP stream to TCP. Specifically, I would like to move from
client --UDP_PORT_999--> server1
to
client --...
- 3,657
3
votes
2
answers
15k
views
pptpd on Debian doesn't write any logs
I'm trying to set up PPTP server with Debian Squeeze.
The problem is nothing is being written in the logs (neither in messages nor in debug nor in daemon.log) though debug and dump options are set. ...
- 6,830
-1
votes
1
answer
919
views
Remote logging from snort to rsyslog
As part of a school project, we are supposed to run snort on a Ubuntu server in IDS mode and log the packets to rsyslog on a remote Ubuntu server. I have been searching for manuals/tutorials for a ...
- 111
3
votes
1
answer
4k
views
Most functional log analysis tools? [closed]
I am curious as to what others find to be the most useful log analysis tools for *nix. Presently I am simply tailing output and grepping through things, however I'd like to use something that would ...
- 1,197
1
vote
2
answers
3k
views
How to set up mysql storage for certain rsyslog input matches?
I'm draining various logs from Heroku to an rsyslog linux (ubuntu) server and am starting to have a little more to bite off than I can chew in terms of working with my log histories.
I am needing to ...
- 1,197
2
votes
1
answer
2k
views
snort not logging full output to syslog
I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
- 21
0
votes
2
answers
3k
views
Redirecting Syslog events from RHEL 6 to RHEL 5: is it possible to provide with the same event format?
For some reasons, we redirect syslog events from RHEL 6 (with rsyslog) to RHEL 5 (with syslogd).
On RHEL 6 in rsyslog.conf:
*.* @10.30.46.211
On RHEL 5 in /etc/sysconfig/syslog:
...
- 379
0
votes
1
answer
2k
views
Logging MySQL events to file in addition to syslog on Debian
By default, Debian uses rsyslog to handle MySQL error logging. I like this behavior and do not want to change it. However, I would like rsyslog to write MySQL events to /var/log/mysqld.log in ...
- 215
0
votes
1
answer
2k
views
Sending multiple loglines (mysql-slow.log, php5-fpm.log.slow) to syslog
I'm trying to aggregate several sources of error messages into one place, to easier put things into context. I'm currently looking at rsyslog, but I can change this - if it's preventing me from doing ...
- 4,213
1
vote
1
answer
2k
views
rsyslog to external script
Using CentOS I have rsyslog configured to send data to a python script via a shell execute action(^). I have python 2.7 installed, but when my script is called, the shell environment is referencing ...
- 111