Hot answers tagged

48

Basically, they are all the same, in the way they all permit the logging of data from different types of systems in a central repository. But they are three different project, each project trying to improve the previous one with more reliability and functionalities. The Syslog project was the very first project. It started in 1980. It is the root project ...


40

Just setup an imfile rule in your /etc/rsyslog.conf #/etc/rsyslog.conf $ModLoad imfile $InputFileName /data/mysql/error.log $InputFileTag mysql-error $InputFileStateFile stat-mysql-error $InputFileSeverity error $InputFileFacility local3 $InputRunFileMonitor local3.* @@hostname:<portnumber> This watches a file and saves to the local3 facility in ...


38

I ran into this issue as well. Here is how I was able to fix it. On the clients modify the /etc/hosts file so the desired hostname comes before localhost. 127.0.0.1 hostnameforlogs localhost On the clients and server modify /etc/rsyslog.conf to include this statement: $PreserveFQDN on On the server I used the %HOSTNAME% variable for the templates in ...


31

these are 3 different kind of log managers : it enables your system to collect filter, and transmit/store logs. Syslog (daemon also named sysklogd) is the default LM in common Linux distributions. Light but not very flexible, you can redirect log flux sorted by facility and severity to files and over network (TCP, UDP). rsyslog is an "advanced" version of ...


26

To answer your question, you first need to understand the different trade-off of reload and copytruncate: reload: the old log file is renamed and the process writing into that log is notified (via Unix signal) to re-create its log file. This is the fastest / lower overhead method: rename/move operations are very fast and have a constant execution time. ...


21

You don't tell logrotate which file to rotate on the command line. You pass it a configuration file. So in your case, logrotate is reading /var/log/syslog and trying to parse it as a config file and failing (hence your errors). If you want to rotate /var/log/syslog it needs to be listed in a logrotate config file somewhere, and you just run logrotate. If ...


19

I've not used if like that (or syslogtag) but I have used :<blah>,<condition> ... (in particular :msg, contains,...) but try :syslogtag, isequal, "giomanager:" /var/log/giomanager.log & stop The & stop (Or, & ~ in rsyslog v6 and older (Such as on RHEL6)) causes the matched message to be discarded after logging otherwise it will be ...


19

Very tricky. :-) And here is the trick answer: Notice the file in /etc/rsyslog.d It says to log haproxy into /var/log/haproxy.log But this will not take effect without restarting rsyslog: service rsyslog restart


15

Apparently, this was a permission issue for some strange reason. I tried the answers from this post below that sorted the issue. Ubuntu 14.04 System Logging sudo chown syslog:adm /var/log sudo chmod 0775 /var/log sudo service rsyslog restart sudo service postfix restart Not sure why the /var/log was locked to root when I've always been on Ubuntu 14.04 ...


14

From Forwarding to More than One Server; What is important to know, however, is that the full set of directives make up an action. So you can not simply add (just) a second forwarding rule, but need to duplicate the rule configuration as well. Be careful that you use different queue file names for the second action, else you will mess up your system. ...


14

Speaking as rsyslog author, copytruncate is actually a very, very, very bad choice. It is inherently racy and using it is almost a guarantee that you will lose log data. The more frequently the file is written to, the more you will lose. And this is not just part of the last line, but can be several hundred ones, depending on the exact timing and state of ...


14

Is is a known bug. Bug#1531622 KLogPermitNonKernelFacility - it's legacy parameter which is no longer used. To remove the error, locate and comment out the following line $KLogPermitNonKernelFacility on in the file rsyslog.conf Bug#830046 If the device /dev/xconsole is not present on you system, you can locate it like this: daemon.*;mail.*;\ news.err;\ *....


13

The use of & ~ was deprecated in v7 of rsyslogd, and you're encouraged to use & stop instead. You can read more about it in this section of the v7compatibility page. omruleset and discard (~) action are deprecated Both continue to work, but have been replaced by better alternatives. The discard action (tilde character) has been replaced ...


13

rsyslogd Configuration In /etc/rsyslogd.conf # provides remote UDP syslog reception $ModLoad imudp $UDPServerRun 514 # If logging to an NFS mount, use these settings... # "OMFileFlushOnTXEnd off" avoids fsync on every write... # mount -o hard,rsize=32768,wsize=32768,noacl,noatime,nodiratime -t nfs $OMFileIOBufferSize 768k $OMFileAsyncWriting on $...


12

Log the application name in your messages. Filter on the application name instead of facility. If your applications aren't generating syslog messages directly, you can apply an output filter (e.g., sed) to massage things to look the way you want. Take a look at the Rsyslog documentation on filter conditions to see how you might configure this behavior. ...


12

Most probably it's a file ownership problem. rsyslog starts running as root but then drops privileges and runs as user syslog (configuration directive $PrivDropToUser). syslog files (auth.log, daemon.log, etc.) initially are owned by syslog:adm but if you change ownership to root (as it seems from your file list) then no matter if you HUP (i.e., reload) ...


11

You have to specify the log in the frontend if you really want every request to be logged. But usually this is overkill for the server and your disk will be full in no time. frontend webfront log /dev/log local0 debug


10

This is old, but I thought I would write this method which I use for low/medium traffic site (don't know if it will work well for heavy traffic site): In Apache, I define a CustomLog format called graylog2_access which formats the access log into a GELF format and then I send my log through Graylog2 by piping the log data through nc to send GELF messages to ...


10

According to the official documentation on Configuration, FileCreateMode may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next $FileCreateMode directive. Order of lines is vitally important.


10

rsyslog should re-create the file (with correct permissions)after restarting: # mv /var/log/syslog /tmp/ # /etc/init.d/rsyslog restart [ ok ] Restarting rsyslog (via systemctl): rsyslog.service. # dir /var/log/syslog -rw-r----- 1 root adm 327 Oct 27 13:28 /var/log/syslog Perhaps try forcing a log entry to make sure it's running: # /usr/bin/logger -p0 ...


9

I believe haproxy only have syslog logging via UDP. What is your log config line in haproxy.cfg? Is it? log 127.0.0.1 local2 If so, you'll need to enable the UDP server modules in the rsyslog configuration by uncommenting: $ModLoad imudp.so $UDPServerRun 514 Tip: I run the following command on all my haproxy servers: sudo sed -i 's/#$ModLoad imudp.so/...


9

The default haproxy.conf file provides clear instructions under the Global settings - global. Here i am copy pasting it for you - #--------------------------------------------------------------------- # Global settings #--------------------------------------------------------------------- global # to have these messages end up in /var/log/haproxy.log ...


9

From where can I get the source code for syslog() This is provided by glibc or the libc implementations on other Unix flavors. This call basically submits your message to the syslog unix domain socket /dev/log. This socket is normally created by the system logger (e.g. rsyslog, syslog-ng, nxlog, etc).


8

Configure /etc/rsyslog.conf to preserve the FQDN: $PreserveFQDN on


8

If you use a recent version of rsyslog (7 for example), you need to do & stop after your message. Failing to do so will give you warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]


8

The only thing you need in rsyslog.conf to forward to a remote IP address is *.* @@192.0.2.25:514; Regarding your other question... I tried executing logger -p cron.info TEST on the client machine and found nothing is added to /var/log/cron! Be sure you restart rsyslogd after changing the configuration; you also need to be sure that /var/log/cron ...


8

Well, the answer is rather simple (and probably unsatisfactory). The new syntax is not supported in this old version. You need at least v6, but to use all features v7 is required. So far, Red Hat does not ship these for RHEL. As an alternative, you can use the rsyslog rpm packages: http://www.rsyslog.com/rhelcentos-rpms/ Please also note that the doc on ...


8

The problem was actually coming from logrotate. Basically with my configuration, running unicorn, I don't need to use the copytruncate directive. (which is what causes problems here) USR1 - Reopen all logs owned by the worker process. See Unicorn::Util.reopen_logs for what is considered a log. Log files are not reopened until it is done processing ...


8

You need to find the line that defines what should be sent to /var/log/syslog and modify it so that cron messages are not included. For example on an Ubuntu system I have to hand the /etc/rsyslog.d/50-default.conf file has the following entry for syslog: *.*;auth,authpriv.none -/var/log/syslog changing it to: *.*;cron,auth,authpriv.none ...


8

This can be achieved by commenting out the following line in /etc/rsyslog.conf as the comment suggests: # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat Log format now looks like this: 2014-04-29T20:41:36.366613+01:00 hostname msg


Only top voted, non community-wiki answers of a minimum length are eligible