The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
0answers
19 views

Restart rsyslog after ntp time sync

I want to ensure that the logs written, have the correct timestamp. So, when ntpd completes the sync (ntpq -c rv displays sync_ntp), I want to restart rsyslogd. But I am not finding any hooks/config ...
1
vote
1answer
77 views

log files in CentOS 7 [closed]

In CentOS 7, how can I locate and view all the system logs that tell me who tried to enter the system, who got in, what processes they contacted, what they accomplished, etc. I want to be able to ...
0
votes
0answers
11 views

Can rsyslogd write to more than one named pipe

If I have the following two lines in the rsyslogd.conf *.* |/var/run/rsyslog/pipe1 *.* |/var/run/rsyslog/pipe2 Will all messages be sent to both pipes? I have two programs that want to inspect ...
0
votes
0answers
52 views

rsyslog does not stream data to flume

I have a problem with Flume as it is not recognizing the events on console. My configuration file is this: ### Name the components on this agent a1.sources = r1 a1.sinks = k1 a1.channels = c1 ### ...
0
votes
0answers
6 views

rsyslog does not stream data to flume [duplicate]

I have a problem with Flume as it is not recognizing the events on console. My configuration file is this: ### Name the components on this agent a1.sources = r1 a1.sinks = k1 a1.channels = c1 ### ...
1
vote
0answers
29 views

rsyslog and netsnmp support for Linux namespaces

I have configured different net namespaces (netns) on my linux machine (Ubuntu) with different routes in each. Now, if I want rsyslog and SNMP traps (netsnmp) to use one of the route from these ...
0
votes
1answer
19 views

Logging of what ended a process?

Due to the tight resources of the server, I suspect System will end processes from time to time. I want those events to be logged in a separate file for investigation. How do I set that in ...
0
votes
0answers
17 views

How do I get debug information from rsyslog?

I followed the directions from: http://www.rsyslog.com/doc/debug.html I put the following in /etc/rsyslog.conf: $DebugLevel 2 $DebugFile /root/RSYSLOG.txt then I try: kill -USR1 `cat ...
1
vote
1answer
63 views

rsyslog: how do I set up remote logging?

I am simply trying to set up a remote logging system. I think my setup is correct but it fails and I can't get any messages from rsyslog to show up in the logs, so I can't find out why. My iptables ...
2
votes
1answer
98 views

rsyslogd only logs from remote servers after enabling UDP:514 on Debian

I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance ...
1
vote
0answers
60 views

How to suppress input overrun messages

I have a Raspberry Pi running Raspbian (a Debian flavor: Linux version 3.12-1-rpi (debian-kernel@lists.debian.org) (gcc version 4.7.2 (Debian 4.7.2-5+rpi1) ) #1 Debian 3.12.9-1+rpi1 (2014-05-19) ). ...
1
vote
0answers
20 views

Generating Email alert for events in system log

How to generate email alert for every critical event logged in system log /var/log/messages. Suppose, for the following log message, I want an email alert to be generated. Oct 24 11:17:42 eforms ...
0
votes
0answers
56 views

Stopping syslogd also closes /dev/log UNIX domain socket

I am working on a project and from some testing I found out that stopping syslogd daemon also closes /dev/log socket. Is there some other way so that even if syslogd is down, /dev/log socket still ...
0
votes
1answer
47 views

rsyslog doesnt seem to write to log file, without restart after touch'ing the file

I have a separate file for logging local7 facility, and this file is touched and permissions set, from my installer. But sometimes I see that the logs are not being written to it (after I do a ...
2
votes
1answer
153 views

Installing rsyslog from source - No package 'liblogging-stdlog' found

I asked this over in AskUbuntu but have had no luck with an answer. I am doing experiments with different logging systems. At the moment I am trying to install rsyslog from source so I can make some ...
1
vote
2answers
96 views

Force rsyslogd to create new file before somebody will write to it

I'm using rsyslogd 7.4.4 on Ubuntu 14.04. I've updated the configuration file /etc/rsyslog.d/30-component.conf with the following content: # provides UDP syslog reception $ModLoad imudp $UDPServerRun ...
1
vote
0answers
70 views

Get KERN_DEBUG messages into syslog on rhel7/centos7?

I've been trying to get KERN_DEBUG messages logged to a file in centos7, but have had no luck. I can get them just fine from "dmesg," but not /var/log/messages or /var/log/dmesg Here's a MWE kernel ...
0
votes
1answer
26 views

filtering rsyslog log on the server side

Hi I'm trying to filter usb messages, specifically of new connections. all of my clients are configured to send to a central server their 'kern.*' log. problem is I'm getting to much "junk" logs and ...
2
votes
1answer
278 views

How to disable systemd's “Time has been changed” message spam in /var/log/syslog on Debian jessie?

Due to combined use of Debian jessie, that uses systemd by default, and sdwdate (that uses Slow Clock Adjuster ( gh )), my system clock is frequently changed. As a result /var/log/syslog gets ...
0
votes
0answers
82 views

Seeing SSH debug messages in Terminal/console

I am seeing "debug3: Received SSH2_MSG_IGNORE" appear in the terminal on a RHEL 6 Linux server. I thought maybe rsyslog had a console entry, but it doesn't. sshd_config has logging at AUTHPRIV, and ...
1
vote
0answers
72 views

Changing the date format of auth.log

I was looking to change the date format in which auth.log logs information. I could not find a way to do it. Is there a method to do this? My system uses rsyslog.
2
votes
1answer
708 views

How to change ssh log location from /var/log/secure to custom location in rhel 6?

By default in RHEL 6, SSH server logs are sent to /var/log/secure. I want to change this location to a custom one. Is it possible to do that? I have tried modifying the rsyslog.conf file, but it does ...
3
votes
1answer
115 views

Grep with spaces suddenly doesn't work

When performing a grep like: $ tail -f apilog_2014.07.09.log | grep "HELLO" | grep "99999" I get the desired output: 12:22:35 server apache2: HELLO FRIEND 99999 12:22:35 server apache2: HELLO ...
1
vote
1answer
83 views

learning to output custom rsyslogs [closed]

I've installed rsyslog. I want to log why my server is refusing to show my index page in the browser in /var/log/browser.log Should it be listening on a standard port? I can see netstat -tpan. To ...
0
votes
1answer
52 views

don't log cron events in auth.log

In my /etc/rsyslog.conf, I have following line to log auth facility into /var/log/auth.log: auth,authpriv.* /var/log/auth.log but the file is flooded with cron logs, sucgh as these: ...
1
vote
1answer
79 views

How to redirect logs to a fifo device?

I have the following line in the rsyslog config file: *.*;auth,daemon,kern,user -/dev/logi and it does what it should, but I wanted to send some iptables logs to a different file, so I added the ...
3
votes
0answers
481 views

Why does rsyslogd not honor the following lines in rsyslog.d

This is somewhat related to my previous question here. I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf: 00-iptables.conf 50-default.conf postfix.conf The first one ...
2
votes
1answer
344 views

How to check if the remote rsyslog client is running

At the moment I'm implementing the part of the monitoring system that is build around the rsyslog and auditd. I would like to include into the project a correct verification of the fact that remote ...
1
vote
1answer
711 views

Missing Messages and Secure logs files on CentOS

I'm having troubles with CentOS release 6.4 (Final). I'm looking for log files in /var/log/ and I'm obviously missing two files: /var/logs/messages /var/log/secure I was checking if rsyslog is ...
3
votes
3answers
651 views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
3
votes
1answer
2k views

rsyslog not logging

This is an odd issue. I was testing the chrony/ntp services on a RHEL7 VM and was resetting its time as well as the host's. Once I was satisfied with it I checked /var/log/messages and realized it ...
4
votes
2answers
129 views

rsyslog - action AND action

I want to create rule to send data from facility to file AND to MySQL database. How it can realized? Only by adding second line like: syslog.* /var/log/syslog.log syslog.* ...
1
vote
0answers
202 views

rsyslog && sending data to other host

Using CentOS 6.4. Problem is - that messages from kern.* facility doesn't appear on other server. Tring to send data: # logger -p kern.warning -t TEST "Test warning for remote host KERNEL" # logger ...
0
votes
0answers
72 views

Send data from file to rsyslog local0 facility

Is any possibility for logger to permanently get data from file - and send it to local0 facility? Why - I want to collect all data in database. For this - I'm use rsyslog-mysql. In it - I have ...
3
votes
0answers
136 views

Extract particular words from Rsyslog %msg% facility

After lot of search on Google and reading all manuals available on man page and internet, I finally ask here. In my scenario, I have one rsyslog server working with mysql and a custom template ...
0
votes
0answers
70 views

rsyslogd crashes while running from board.(rsyslogd -M /lib/rsyslog option is running well)

when i tried rsyslogd without any option from my board it will give following error. rsyslog runtime error(-2066): could not load module '/home/vipul_test/lib/rsyslog/lmnet.so', dlopen: ...
3
votes
1answer
746 views

rsyslog using short hostname

I'm using CentOS 6.5 and rsyslogd: Name : rsyslog Arch : x86_64 Version : 5.8.10 Release : 8.el6 In rsyslog.d's conf file I have: $PreserveFQDN on and ...
0
votes
0answers
213 views

Rsyslog Problem, Custom Template

I have a problem with rsyslog. bellow is my configuration ,partial. This is File Name Template: $template ...
2
votes
0answers
60 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
3
votes
1answer
259 views

rsyslog conf file problem

I'm running Fedora (F19) and my /var/log/messages is filled with info coming from avahi-daemon: stuff like: Jan 21 14:13:42 localhost avahi-daemon[554]: Invalid response packet from host 10.10.22.3. ...
1
vote
1answer
187 views

logrotate custom “rotate” action equivalent for upstart?

In lots of online posts regarding how to rotate your iptables log files, for example here rsyslog config files get reloaded by the postrotate option of logrotate, presumably in order to stop rsyslog ...
2
votes
1answer
3k views

What does the *.*;auth,authpriv.none -/var/log/syslog line mean in rsyslog config file?

I'm trying to understand the /etc/rsyslog.conf file, but I'm missing something. For example, this is a part of the file: auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none ...
2
votes
2answers
414 views

rsyslog: make %syslogtag% equal length

I have rsyslog configured to log in the following format: $template long-iso,"%$NOW% %timereported:8:15% %syslogtag% %msg%\n" which produces logs like this one: 2013-12-14 15:59:39 ...
0
votes
1answer
792 views

Add year to entries generated by rsyslogd

The default configuration of rsyslogd writes log entries in the traditional format, which looks like this: Nov 30 10:40:01 localhost CRON[30786]: pam_unix(cron:session): session closed for user list ...
1
vote
1answer
685 views

if statement apparently not working in rsyslog

I'm trying to use the RainerScript syntax in my Debian /etc/rsyslog.conf file. I want to log daemon stuff to a particular file, but only from pppd. Here's what I added: if $programname == 'pppd' ...
2
votes
1answer
296 views

Syslog TLS Compression and Message Buffering

Where I work, we have a site-to-site VPN tunnel set up between our main data center and a third party data center that does some Oracle PaaS for us. Since they charge per-VM, we're monitoring the ...
6
votes
2answers
5k views

How to tell rsyslog to create log file if not there?

Default behaviour by rsyslog is to append traces to an existing log file. Now, I've seen (CentOs, Scientific Linux) that when rsyslog is already running, you delete the log file (e.g. the one ...
5
votes
4answers
5k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit ...
4
votes
1answer
99 views

Is it possible to change the priority of a message in rsyslog?

I have a very dramatic and hypocondriac program, and it likes to spew alarming messages to syslog in cases when nothing really important happens. Besides, it sends them with priority "alert", so they ...
3
votes
2answers
335 views

rsyslog: execute script on matching log event

I have the following line in my /etc/rsyslog.conf :programname, contains, "suhosin" /var/log/suhosin.log which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I ...