Hot answers tagged

55 votes
Accepted

What is the difference between syslog, rsyslog and syslog-ng?

Basically, they are all the same, in the way they all permit the logging of data from different types of systems in a central repository. But they are three different project, each project trying to ...
  • 13.1k
38 votes
Accepted

rsyslog with logrotate: reload rsyslog vs copytruncate

To answer your question, you first need to understand the different trade-off of reload and copytruncate: reload: the old log file is renamed and the process writing into that log is notified (via ...
  • 45.4k
33 votes

What is the difference between syslog, rsyslog and syslog-ng?

these are 3 different kind of log managers : it enables your system to collect filter, and transmit/store logs. Syslog (daemon also named sysklogd) is the default LM in common Linux distributions. ...
  • 498
31 votes

How can root start a process that only root can kill?

Having unrestricted sudo/wheel privileges anybody will be able to undo anything you done. Even if you manage to achieve this by removing the possibility to kill process directly, e.g. with sudo kill, ...
28 votes

rsyslog with logrotate: reload rsyslog vs copytruncate

Speaking as rsyslog author, copytruncate is actually a very, very, very bad choice. It is inherently racy and using it is almost a guarantee that you will lose log data. The more frequently the file ...
25 votes

HAProxy logging to syslog

Very tricky. :-) And here is the trick answer: Notice the file in /etc/rsyslog.d It says to log haproxy into /var/log/haproxy.log But this will not take effect without restarting rsyslog: service ...
  • 361
18 votes

How can root start a process that only root can kill?

You can't give someone a power and then prevent them from using it. You have to narrowly focus the power you give them to only include what you want them to have. In a comment, you said: I have to ...
  • 536
17 votes
Accepted

Ubuntu + Postfix: Mail Log Missing

Apparently, this was a permission issue for some strange reason. I tried the answers from this post below that sorted the issue. Ubuntu 14.04 System Logging sudo chown syslog:adm /var/log sudo chmod ...
  • 367
17 votes
Accepted

command KLogPermitNonKernelFacility is currently not permitted

Is is a known bug. Bug#1531622 KLogPermitNonKernelFacility - it's legacy parameter which is no longer used. To remove the error, locate and comment out the following line $...
  • 3,265
14 votes

How to keep haproxy log messages out of /var/log/syslog

The use of & ~ was deprecated in v7 of rsyslogd, and you're encouraged to use & stop instead. You can read more about it in this section of the v7compatibility page. omruleset and discard (~...
  • 7,515
14 votes
Accepted

I accidentally deleted /var/log/syslog, Now rsyslog Won't Log anything

rsyslog should re-create the file (with correct permissions)after restarting: # mv /var/log/syslog /tmp/ # /etc/init.d/rsyslog restart [ ok ] Restarting rsyslog (via systemctl): rsyslog.service. # ...
  • 3,584
13 votes

Configuring Rsyslog To Stop The Logging Of Certain Messages

If you use a recent version of rsyslog (7 for example), you need to do & stop after your message. Failing to do so will give you warning: ~ action is deprecated, consider using the 'stop' ...
  • 639
12 votes

HAProxy logging to syslog

The default haproxy.conf file provides clear instructions under the Global settings - global. Here i am copy pasting it for you - #---------------------------------------------------------------------...
  • 9,176
11 votes

How do I get rsyslogd to log a server's FQDN instead of it's short hostname?

To change the hostname rsyslog sends, add the following directive as the very first line in /etc/rsyslog.conf before any modules are loaded: $LocalHostName yourhostname Alternatively, to have ...
11 votes
Accepted

Interpreting DHCP related message from rsyslog

An XMT Solicit is basically a DHCPv6 (IPv6 DHCP) request. If you're not using IPv6 at all disable it because your instance is trying to request an IPv6-IP. The problem seems to be that your instance ...
  • 1,949
10 votes

How can root start a process that only root can kill?

Linux noob here. Could you consider writing programs or scripts that do only what these guys are meant to do, then make them root-owner and add them setuid bit? Of course, one big issue is you might ...
9 votes

Haproxy not logging requests?

the logging via unix socket log does not work for me on my rhel 6.7.you can have a try with this conf. haproxy (working on 81) forward http request to httpd (working on 80) /etc/haproxy/haproxy.cfg ...
  • 226
9 votes

Haproxy not logging requests?

This link explains it perfectly. If you look at the top of /etc/haproxy/haproxy.cfg, you will see something like: global log 127.0.0.1 local2 [...] This means that ...
  • 317
9 votes

What is the difference between syslog, rsyslog and syslog-ng?

From where can I get the source code for syslog() This is provided by glibc or the libc implementations on other Unix flavors. This call basically submits your message to the syslog unix domain ...
  • 986
9 votes
Accepted

Create separated syslog file for each host with rsyslog

It seems it is documented on rsyslog web site here : https://www.rsyslog.com/storing-and-forwarding-remote-messages To summarize : You should define a template for log files, something like e.g : #...
  • 13.1k
9 votes

Journalctl and syslog: How does it actually work?

The link(s) between journald and rsyslog is controlled on the rsyslog side through the use of its input and output modules; there is an imjournal and omjournal for reading from and writing to the ...
  • 4,721
8 votes

How to restart rsyslog daemon on ubuntu

If you are using systemctl, you can use: systemctl restart rsyslog.service Once restarted, check its status with the command: systemctl status rsyslog.service
8 votes
Accepted

Rsyslog: From a custom log file, Forward only the messages matching a pattern

As it is, your file /etc/rsyslog.d/05-forwarding.conf is forwarding all messages passing thought, and not only messages from your custom file /home/ubuntu/test.log. So, you can delete it, as you said ...
8 votes

Debian 9 server no sshd in auth.log

Apparently, /dev/log was missing, which is created by systemd-journald-dev-log.socket. I had to do systemctl restart systemd-journald.service to fix it. I can't reboot right now to test if this is ...
  • 8,046
7 votes

Errors using new rsyslog template syntax on RHEL6

As of September 2015 there are rsyslog7 packages available in RHEL6. The current version of rsyslog is 8.11, but this one is at least closer to current. To install, you first have to remove your ...
  • 3,201
7 votes

Haproxy not logging requests?

This can be caused by having it run in a chroot jail. You'll need to make sure that rsyslog is also creating a dgram socket inside the chroot jail (e.g. /var/lib/haproxy/dev/log). Point your log ...
  • 71
7 votes

Apache errorlog piping fail

The first pipe is code for Apache to fork a new command, but it's probably not forking a whole new shell, which would allow you to use a new pipe, but instead exec'ing the command, so everything is ...
  • 1,595
7 votes
Accepted

Does logrotate.conf override the config of the submodules?

The rules are simply evaluated as they are read, and the last setting encountered overrides previous settings. As the /etc/logrotate.conf file has the line include /etc/logrotate.d as last, the files ...
  • 3,836
6 votes

HAProxy logging to syslog

Comment out this line from /etc/rsyslog.d # Send HAProxy messages to a dedicated logfile if $programname startswith 'haproxy' then /var/log/haproxy.log
  • 161

Only top scored, non community-wiki answers of a minimum length are eligible