31 votes

How can root start a process that only root can kill?

Having unrestricted sudo/wheel privileges anybody will be able to undo anything you done. Even if you manage to achieve this by removing the possibility to kill process directly, e.g. with sudo kill, ...
Nikita Kipriyanov's user avatar
30 votes

rsyslog with logrotate: reload rsyslog vs copytruncate

Speaking as rsyslog author, copytruncate is actually a very, very, very bad choice. It is inherently racy and using it is almost a guarantee that you will lose log data. The more frequently the file ...
Rainer Gerhards's user avatar
18 votes

How can root start a process that only root can kill?

You can't give someone a power and then prevent them from using it. You have to narrowly focus the power you give them to only include what you want them to have. In a comment, you said: I have to ...
bta's user avatar
  • 536
17 votes
Accepted

command KLogPermitNonKernelFacility is currently not permitted

Is is a known bug. Bug#1531622 KLogPermitNonKernelFacility - it's legacy parameter which is no longer used. To remove the error, locate and comment out the following line $...
Slipeer's user avatar
  • 3,313
14 votes
Accepted

I accidentally deleted /var/log/syslog, Now rsyslog Won't Log anything

rsyslog should re-create the file (with correct permissions)after restarting: # mv /var/log/syslog /tmp/ # /etc/init.d/rsyslog restart [ ok ] Restarting rsyslog (via systemctl): rsyslog.service. # ...
Server Fault's user avatar
  • 3,784
13 votes
Accepted

Interpreting DHCP related message from rsyslog

An XMT Solicit is basically a DHCPv6 (IPv6 DHCP) request. If you're not using IPv6 at all disable it because your instance is trying to request an IPv6-IP. The problem seems to be that your instance ...
Broco's user avatar
  • 2,029
13 votes

Where is some os logs in Debian 12

In Debian 12, the traditional syslog system has been replaced with systemd-journald. This means that the old log files like syslog, messages, auth.log are no longer used. Instead, all system logs are ...
Omidreza Bagheri's user avatar
11 votes

Haproxy not logging requests?

This link explains it perfectly. If you look at the top of /etc/haproxy/haproxy.cfg, you will see something like: global log 127.0.0.1 local2 [...] This means that ...
carla's user avatar
  • 337
11 votes
Accepted

Create separated syslog file for each host with rsyslog

It seems it is documented on rsyslog web site here : https://www.rsyslog.com/storing-and-forwarding-remote-messages To summarize : You should define a template for log files, something like e.g : #...
krisFR's user avatar
  • 13.5k
11 votes

Can Journalctl and syslog be used in paralled?

The link(s) between journald and rsyslog is controlled on the rsyslog side through the use of its input and output modules; there is an imjournal and omjournal for reading from and writing to the ...
bodgit's user avatar
  • 4,771
10 votes

How to restart rsyslog daemon on ubuntu

If you are using systemctl, you can use: systemctl restart rsyslog.service Once restarted, check its status with the command: systemctl status rsyslog.service
Thomas B's user avatar
  • 101
10 votes

How can root start a process that only root can kill?

Linux noob here. Could you consider writing programs or scripts that do only what these guys are meant to do, then make them root-owner and add them setuid bit? Of course, one big issue is you might ...
user1532080's user avatar
9 votes

Haproxy not logging requests?

the logging via unix socket log does not work for me on my rhel 6.7.you can have a try with this conf. haproxy (working on 81) forward http request to httpd (working on 80) /etc/haproxy/haproxy.cfg ...
ncowboy's user avatar
  • 226
9 votes

Where is some os logs in Debian 12

You can also install rsyslog and then enable the logs again, by modifying the rsyslog configuration. When you install the rsyslog package using apt-get there is already default configuration in place ...
Turdie's user avatar
  • 2,594
8 votes
Accepted

Rsyslog: From a custom log file, Forward only the messages matching a pattern

As it is, your file /etc/rsyslog.d/05-forwarding.conf is forwarding all messages passing thought, and not only messages from your custom file /home/ubuntu/test.log. So, you can delete it, as you said ...
Luiz Guilherme Littig Berger's user avatar
8 votes

Debian 9 server no sshd in auth.log

Apparently, /dev/log was missing, which is created by systemd-journald-dev-log.socket. I had to do systemctl restart systemd-journald.service to fix it. I can't reboot right now to test if this is ...
Halfgaar's user avatar
  • 8,204
7 votes

Haproxy not logging requests?

This can be caused by having it run in a chroot jail. You'll need to make sure that rsyslog is also creating a dgram socket inside the chroot jail (e.g. /var/lib/haproxy/dev/log). Point your log ...
Thomas's user avatar
  • 71
7 votes
Accepted

System logs are empty (/var/log/messages; /var/log/secure; etc)

well... almost 2 years had gone by and finally found the solution for the issue. If anyone has the same issue please try the steps below. syslogd version rsyslogd 8.24.0-38.el7 The issue was ...
BANJOSA's user avatar
  • 398
7 votes
Accepted

Does logrotate.conf override the config of the submodules?

The rules are simply evaluated as they are read, and the last setting encountered overrides previous settings. As the /etc/logrotate.conf file has the line include /etc/logrotate.d as last, the files ...
wurtel's user avatar
  • 3,924
6 votes

kernel.log stays empty: “rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.”

I think the VPS is not a VM, but a container. Unpriviledged cotainers do not have access to kernel log for security reasons.
Mircea Vutcovici's user avatar
6 votes

rsyslog limit log size

First of all, according to the document you linked to, your syntax is wrong as the arguments to $outchannel should be given separated by commas, so something like $outchannel mail,/var/log/mail.log, ...
BeerSerc's user avatar
  • 499
6 votes

How do I handle messages from my custom application in rsyslog?

First, make a config file in /etc/rsyslog.d, such as 01-alpha.conf, to make things organized. This way, your 01-alpha.conf will be read first than 50-default.conf. 50-default.conf has a rule to log ...
Luiz Guilherme Littig Berger's user avatar
6 votes
Accepted

Is rsyslog redundant on when using journald?

From Red hat documentation, using the journal The Journal is a component of systemd that is responsible for viewing and management of log files. It can be used in parallel, or in place of a ...
joaerl's user avatar
  • 417
6 votes
Accepted

What happens to logs generated by logger if there is no logging daemon installed or active

'logger' sends data to the Unix socket /dev/log. (It's a socket despite being in /dev.) On most Linux distributions, this socket is not owned by a traditional syslog daemon anymore – its other end ...
u1686_grawity's user avatar
5 votes

Rsyslogd not listening on port

By default rsyslod listen on unix socket, not on TCP socket. Uncomment or add this two lines: module(load="imtcp") input(type="imtcp" port="514") That's all, have fun ! Arno
user486112's user avatar
5 votes

Rsyslog through TLS

Rsyslog 5.8 with Centos 6.9 works for me Here is a video tutorial: https://youtu.be/eb9GlhD8XnY Create the certificates on the CA (certificate authority) sudo mkidr /etc/ssl/rsyslog/ cd /etc/...
Alejandro T's user avatar
5 votes

I accidentally deleted /var/log/syslog, Now rsyslog Won't Log anything

Even though the file had been deleted, the file handle that the rsyslog was using was likely still open and being written to. lsof can be used to verify this, and can also tell you what files are open ...
K Richardson's user avatar
5 votes

Proper way to reload rsyslog with a config file for a custom application

Sending SIGHUP can't reload the rsyslog configure files, but only reopens the log files for rotating. Restart should reload the config files. see https://lists.gt.net/rsyslog/users/16151
faicker's user avatar
  • 151
5 votes
Accepted

how to transfer log file to another linux server for processing

My preferred method as suggested by ryekayo is to just send the syslog messages to local file AND to remote host: /etc/rsyslog.conf: authpriv.* /var/log/secure authpriv.* @remote_host.com (This ...
Chris Maxwell's user avatar
5 votes
Accepted

global configuration rsyslog using RainerScript how to?

First of all, there is no hard need to convert all of old style - some of it is still the best way to do simple things. Have a look at rsyslog configuration formats to understand that part. The core ...
Rainer Gerhards's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible