rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

1
vote
0answers
8 views

rsyslog is still sending messages to omusrmsg even after using `stop` command

I have the following lines in the 50-default.conf file (in /etc/rsyslog.d): local0.emerg stop *.emerg :omusrmsg:* But all local0 messages are still being sent to every user logged ...
0
votes
0answers
11 views

How to redirect kernel: lockd: messages to another file from syslog.conf

I do not understand the syntax in syslog.conf for redirecting the following kind of messages (kernel: lockd: ): Jun 13 11:53:43 myserver kernel: lockd: cannot monitor 192.254.223.233 I believe ...
3
votes
2answers
47 views

setgid sticky bit not working

I have yet another frustrating problem. I have a group of users belonging to the "testing" group. I have a folder located at /var/log/projects with the setgid bit set. This is so any new files or ...
0
votes
0answers
23 views

rsyslog remote logging capturing local messages

We have setup a RHEL 6 server to capture syslogs from remote hosts. Although its working and I am capturing the logs, all of the local system logs are being directed into the remote log directory ...
1
vote
1answer
37 views

fail to log through rsyslog on an archlinux system

Using release 2016.03.01 from Archlinux, with package rsyslogd 8.18.0, I started from the minimal configuration built from Very simple config : # cat rsyslog.conf $ModLoad immark $ModLoad imudp $...
0
votes
0answers
15 views

rsyslog: how to log to one of multiple log servers

I have a server that generates a lot of log content (single log file), and want to send it out to say 4 backends. I do not want all entries to be duplicated to every backend, but, say, rotate among ...
-3
votes
1answer
26 views

rsyslog versus rsyslog.d

I'm currently studying for my Red Hat Certification exam, and I've come across an example in my book dealing with system log architecture. I'm currently working a classroom RHEL7 environment. My ...
1
vote
0answers
37 views

fail to log from my app through rsyslogd in a linux container

Running an archlinux container on an archlinux host, both using rsyslog with the same configuration file: $ cat /etc/rsyslog.conf # Minimal config $ModLoad imuxsock # provides support for local ...
0
votes
0answers
12 views

How to force rsyslog ommysql use UTF8?

I'm using ommysql in rsyslog for transferring data into MySQL $ModLoad ommysql local6.* :ommysql:localhost,Syslog,rsyslog,1 but Cyrillic data goes like "·Ð¾Ð²Ð°Ð½Ð¸Ðµ иÑ�точнÐ" in ...
0
votes
0answers
7 views

How are rsyslog action numbered?

My log shows that one of my rsyslog actions was not handled: May 28 10:22:02 rpi1 rsyslogd-2007: action 'action 18' suspended, next retry is Sat May 28 10:23:32 2016 [try http://www.rsyslog.com/e/...
1
vote
0answers
22 views

Raspberry pi blocks completely after multiple reboots

I have a c++ program running on login on the raspberry pi, this program checks data for multiple devices attached on to it (Arduino Mega 2560 + Modbus RS485), gets inputted data from them and sends ...
0
votes
1answer
24 views

/var/log/messages reports non existent user

I'm trying to understand what is the third parameter in my /var/log/messages file. For example: $ logger test $ grep test /var/log/messages Output: May 20 15:32:57 hostname myusername: ...
1
vote
1answer
45 views

Strange lines in /var/log/message folder of Centos machine

Below are lines from my /var/log/messages. Can someone help me to understand what these lines mean? I am running a syslog server on this machine. I want to know if these messages would stop the ...
1
vote
1answer
69 views

File location for Syslogs in Centos machine

I am running syslog server (rsyslog 8) on my centos machine. I want to map other device in my network to send the logs to this syslog server. If mapping is done correctly where exactly the syslogs ...
0
votes
0answers
19 views

rsyslog doesn't collect logs

I have configured HP 5120 switch to send messages to syslog server: info-center loghost 10.10.84.111 facility local4 on my debian rsyslogd 5.8.11 modified/etc/syslog.conffile: uncommented$...
0
votes
1answer
88 views

rsyslog not forwarding messages to remote rsyslog server

I'm debugging a strange issue with a logging SaaS solution. We appear to be duplicating logs sent to the SaaS. Logs are sent via an rsyslog forwarder over TLS. I'm trying to see if I can reproduce the ...
1
vote
1answer
69 views

rsyslog - what host is sending these files?

I'm working on an pre-existing installation of rsyslog. I am not sure what remote hosts are sending log files to the server. Some of the folders have unhelpful names like 'last', 'Server', 'syslogd', ...
0
votes
1answer
47 views

Cron stopped logging to /var/log/cron.log

A month ago I set cron to log to /var/log/cron.log by modifying /etc/rsyslog.d/50-default.conf. Logging worked great until I changed permissions on /var/log (by easing permission restrictions), and ...
0
votes
3answers
43 views

Are symlinks in sync with the parent file all the time?

I have a log file which is having a ownership for only root. This file consists of active incoming logs & is continuously updated any time. I need to create a symlink for this file and change the ...
0
votes
3answers
108 views

Puppet doesn't ignore whitespace

I have an entry that may or may not appear in /etc/rsyslog.conf: # Added for Kiwi *.err;*.emerg;*.alert;*.warning;*.debug;*.notice;*.crit;*.info @10.19.24.50 Since some of these servers ...
2
votes
1answer
80 views

systemd, rsyslogd - where are the logs?

I got a Fedora 23 Server edition installation which I have done pretty much nothing with admin-wise besides setting up ssh, fail2ban, samba, and users. The other day I was completely locked out of my ...
0
votes
0answers
20 views

Testing OpenSSH Logging

I'm attempting to turn on logging inside OpenSSH running in an Alpine Docker container. I made sure to install rsyslog and start the daemon with /usr/sbin/rsyslogd. My sshd logging settings are as ...
1
vote
0answers
91 views

Rsyslog not creating log files

I'm hardening an Ubuntu 14.04 VM to CIS standards and am having a problems getting rsyslog to create the necessary files. Note: I'm getting better with Linux but I'm no master yet, please excuse any ...
1
vote
0answers
28 views

Rsyslog to use hostname instead of leftmost FQDN label

I have an Ubuntu 15.10 configuration in which /etc/hostname reads projectname-environmentname and /etc/hosts reads 127.0.0.1 localhost 127.0.1.1 environmentname.projectname.tld projectname-...
0
votes
0answers
56 views

Not receving tomcat logs on rsyslog sever

We have configured the rsyslogs server for tomcat8 the using the log4j. Here is our tomcat log4j.properties configuration file, but we are not receiving the logs on rsyslog server. Tomcat version 8....
1
vote
1answer
13 views

About redirect log in rsyslog.conf

what is the difference between this 2 lines: mail.warn -/var/log/mail.warn mail.err /var/log/mail.err (with and without the -) and who i redirect a syslog msg from a host to a ...
1
vote
1answer
50 views

Changing the Facility of outgoing syslog message using rsyslog configuration

I need to change the facility of the syslog message going out to a remote syslog server. I am using rsyslog in my system. I am using the following configuration to forward logs to another syslog ...
0
votes
0answers
52 views

/var/log/secure and other log files are empty even after restarting rsyslog.service

I am running a Centos7 server with rsyslog for logging. The service is on (sudo systemctl is-enabled rsyslog) outputs "enabled". I have also configured the service to start at boot-time. However, ...
0
votes
1answer
71 views

How can I use part of match in Regex to generate filename of action?

I am using CentOS6.5 that include rsyslogd v5.8.10 There are 20 process program in my server.I want to receive logs use rsyslogd and hope to store in different log file according identity of process ...
0
votes
0answers
19 views

Handling tab delimited records in rsyslogd

I want to receive tab delimited records via a specific syslog facility. What lines would I need to add to my rsyslogd.conf to log all local0.* messages to a file, while passing through the tab ...
2
votes
2answers
303 views

How to configure logging inside a Docker container?

I was trying to dockerize (into Debian 8.2) an OpenVPN server (yes, I do know, there already are such containers) but something went wrong inside the container and the server failed to start. I ...
1
vote
0answers
251 views

how to have syslog not log particular warnings?

Short Version: I want to stop the following message from appearing in my syslog. They pertain to a USB port on my keyboard that can be ignored: Feb 9 23:33:45 sunfire kernel: [ 8163.156041] usb 3-6....
0
votes
0answers
18 views

Rsyslog not creating dynamic directories

I have Red Hat Enterprise Linux Server release 6.5 running rsyslogd 5.8.10 I'm trying to collect logs from a remote client (VM1) and I have the following line configured if $inputname == 'imudp' ...
1
vote
0answers
37 views

Loggin apt history to syslog

I have a centralized log management server (graylog) and I want to be able to see the installed/updated/removed packages from a couple of ubuntu serveres there is running. But is there anyway to ...
1
vote
0answers
84 views

rsyslogd eating up 20+ GB (!) of RAM - what evidence to gather?

I have a Ubuntu 14.04.3 box running kernel 3.13.0-74 with 32GB RAM, which features a rsyslogd process gone mad: $ ps -auxww | grep rsyslog syslog 16212 0.7 64.0 27966168 21070336 ? Ssl Jan04 ...
0
votes
0answers
15 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
0
votes
0answers
29 views

extra rsyslog conf works if I restart rsyslog but not at boot

I'm on ubuntu and trying to get rid of a bunch of extra crap that Avahi puts in the system logs (/var/log/syslog). My understanding is that things in /etc/rsyslogd are loaded into the rsyslog config, ...
0
votes
0answers
94 views

Syslog stopped logging after using journalctl

Today I was configuring some things in my VPS running CentOS 7, and checked /var/log/secure several times without noticing any problems.Later I used journalctl to look for some cron logs, and now it ...
0
votes
0answers
67 views

rsyslog not working

I have been trying to start the rsyslog service on centos 7 but I wont work. Please see te configuration file- # rsyslog configuration file # For more information see /usr/share/doc/rsyslog-*/...
1
vote
2answers
62 views

Rsyslog receiving from multiple hosts and saving to different files

I want the router and AP I have in my home network to use my Raspberry Pi running Debian as a syslog server (rsyslogd 5.8.11).However, I can't find anywhere a simple guide on how to receive logs from ...
1
vote
2answers
167 views

Merging log files with different timestamp formats

I have two types of log files Standard Syslog format The timestamp looks as below 5:2015 Dec 21 07:35:06:ABC:foo1:1559: common.c:946:Enabling filter 6:2015 Dec 21 07:35:08:ABC:bar1:1461: api.c:...
0
votes
1answer
213 views

How to set the nofile limit on rsyslog with upstart?

I'm struggling to work out how to set the open file limit on rsyslog on Ubuntu 14.04. It uses Upstart, which ignores limits.conf, but I'd expect to be able to put limit nofile 16384 16384 in /etc/...
1
vote
0answers
15 views

rsyslog — devices have same hostname and pub ip

I'm working on a remote logging setup for some cellular devices that are on a carrier's private network. I have it set up to pass syslogs from the cellular devices to a publicly available server. My ...
0
votes
1answer
243 views

How to send Ossec alerts to Syslog server

I want ossec server to send alerts to Syslog server. Now in this case Ossec Server and RSyslog Server are on same server. I want Ossec Server to send all the alerts from client to location /var/log/...
1
vote
2answers
203 views

Why is syslogd not reporting messages to remote server during and just after the boot?

I configured rsyslog to send logs to a central logging server like this: *.* @@192.168.1.20 $ActionExecOnlyWhenPreviousIsSuspended on & @@192.168.1.21 & /var/log/failover $...
5
votes
2answers
73 views

Isolate SSH Authentication Failures into Own Log File on RHEL 6.6

This may be impossible, but I've got a case where we want to log SSH authentication failures separately from standard SSH logging on a RHEL 6.6 box. I am aware we can use SyslogFacility with ...
1
vote
1answer
192 views

rsyslogd HUPed repeatedly

Noticing that for a VM box, getting in the logs that rsyslogd process gets HUPed. Finding no ideas except a few post in some forums saying this is for logrorate. Any ideas how to fix/troubleshoot this....
1
vote
1answer
46 views

problem with rsyslog filters

I have to make a rule in rsyslog.conf file in order to get the mail logs which at least notice priority but with exception of err priority to a certain path. Here is the rule I tried to make for this:...
0
votes
0answers
46 views

rsyslog , change facility of sending host in remote logging

Is there a way to set a facility for sending host in rsyslog remote logging? All facilities in sending host as one facility in receiving host. like cisco when saying logging trap FACILITY_NUM. ...
0
votes
1answer
150 views

Dynamic file name doesn't work in rsyslog

The filename in rsyslog can be either static or dynamic. The later is useful if you would automatically split messages into different files based on some message criteria. I need split logs depend on ...