rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

1
vote
0answers
20 views

how to have syslog not log particular warnings?

Short Version: I want to stop the following message from appearing in my syslog. They pertain to a USB port on my keyboard that can be ignored: Feb 9 23:33:45 sunfire kernel: [ 8163.156041] usb ...
0
votes
0answers
8 views

Rsyslog not creating dynamic directories

I have Red Hat Enterprise Linux Server release 6.5 running rsyslogd 5.8.10 I'm trying to collect logs from a remote client (VM1) and I have the following line configured if $inputname == 'imudp' ...
1
vote
0answers
11 views

Loggin apt history to syslog

I have a centralized log management server (graylog) and I want to be able to see the installed/updated/removed packages from a couple of ubuntu serveres there is running. But is there anyway to ...
1
vote
0answers
27 views

rsyslogd eating up 20+ GB (!) of RAM - what evidence to gather?

I have a Ubuntu 14.04.3 box running kernel 3.13.0-74 with 32GB RAM, which features a rsyslogd process gone mad: $ ps -auxww | grep rsyslog syslog 16212 0.7 64.0 27966168 21070336 ? Ssl Jan04 ...
0
votes
0answers
6 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
0
votes
0answers
9 views

extra rsyslog conf works if I restart rsyslog but not at boot

I'm on ubuntu and trying to get rid of a bunch of extra crap that Avahi puts in the system logs (/var/log/syslog). My understanding is that things in /etc/rsyslogd are loaded into the rsyslog config, ...
0
votes
0answers
33 views

Syslog stopped logging after using journalctl

Today I was configuring some things in my VPS running CentOS 7, and checked /var/log/secure several times without noticing any problems.Later I used journalctl to look for some cron logs, and now it ...
0
votes
0answers
30 views

rsyslog not working

I have been trying to start the rsyslog service on centos 7 but I wont work. Please see te configuration file- # rsyslog configuration file # For more information see ...
1
vote
2answers
35 views

Rsyslog receiving from multiple hosts and saving to different files

I want the router and AP I have in my home network to use my Raspberry Pi running Debian as a syslog server (rsyslogd 5.8.11).However, I can't find anywhere a simple guide on how to receive logs from ...
1
vote
2answers
56 views

Merging log files with different timestamp formats

I have two types of log files Standard Syslog format The timestamp looks as below 5:2015 Dec 21 07:35:06:ABC:foo1:1559: common.c:946:Enabling filter 6:2015 Dec 21 07:35:08:ABC:bar1:1461: ...
0
votes
1answer
62 views

How to set the nofile limit on rsyslog with upstart?

I'm struggling to work out how to set the open file limit on rsyslog on Ubuntu 14.04. It uses Upstart, which ignores limits.conf, but I'd expect to be able to put limit nofile 16384 16384 in ...
1
vote
0answers
15 views

rsyslog — devices have same hostname and pub ip

I'm working on a remote logging setup for some cellular devices that are on a carrier's private network. I have it set up to pass syslogs from the cellular devices to a publicly available server. My ...
0
votes
1answer
61 views

How to send Ossec alerts to Syslog server

I want ossec server to send alerts to Syslog server. Now in this case Ossec Server and RSyslog Server are on same server. I want Ossec Server to send all the alerts from client to location ...
1
vote
2answers
59 views

Why is syslogd not reporting messages to remote server during and just after the boot?

I configured rsyslog to send logs to a central logging server like this: *.* @@192.168.1.20 $ActionExecOnlyWhenPreviousIsSuspended on & @@192.168.1.21 & /var/log/failover ...
6
votes
2answers
63 views

Isolate SSH Authentication Failures into Own Log File on RHEL 6.6

This may be impossible, but I've got a case where we want to log SSH authentication failures separately from standard SSH logging on a RHEL 6.6 box. I am aware we can use SyslogFacility with ...
2
votes
1answer
42 views

rsyslogd HUPed repeatedly

Noticing that for a VM box, getting in the logs that rsyslogd process gets HUPed. Finding no ideas except a few post in some forums saying this is for logrorate. Any ideas how to fix/troubleshoot ...
1
vote
1answer
39 views

problem with rsyslog filters

I have to make a rule in rsyslog.conf file in order to get the mail logs which at least notice priority but with exception of err priority to a certain path. Here is the rule I tried to make for ...
0
votes
0answers
26 views

rsyslog , change facility of sending host in remote logging

Is there a way to set a facility for sending host in rsyslog remote logging? All facilities in sending host as one facility in receiving host. like cisco when saying logging trap FACILITY_NUM. ...
0
votes
2answers
56 views

Dynamic file name doesn't work in rsyslog

The filename in rsyslog can be either static or dynamic. The later is useful if you would automatically split messages into different files based on some message criteria. I need split logs depend on ...
0
votes
1answer
17 views

How to customize Shorewall firewall logs

I am using Fedora 13 machine with shorewall installed. shorewall 4.6.6-RC1 iptables v1.4.7 Below is log format by shorewall: Oct 23 05:28:17 localhost kernel: shorewall:LAN-LAN:ACCEPT:IN= OUT=lo ...
0
votes
1answer
92 views

rsyslog sending data to remote slows down when $AddUnixListenSocket is used?

I'm running a busy DNS server which logs queries to a remote server via rsyslog. Due to the amount of traffic we're processing I've had to increase the rate limits in rsyslog.conf. This server is ...
1
vote
1answer
36 views

rsyslog use different templates to store logs

I am using rsyslog to handle the logs that my program creates. I have used a template to customize the logs format. My doubts are: If I create a template, every program that use that rsyslog.conf ...
0
votes
0answers
39 views

Execute command to get value in rsyslog.conf template parameter

I want to get value of template parameter via command.like below:- $template precise,",%syslogpriority%,host_ip=%fromhost-ip%,|%syslogfacility% ...
0
votes
2answers
105 views

Where do the logs directed to /dev/console go?

I'm studying RHEL 7. If I add this line to rsyslog.conf: kern.notice /dev/console Where will the messages with facility "kernel" and priority "notice" be logged? If I run this command: ...
1
vote
0answers
19 views

Suppress Rsyslog to terminal

When I use Rsyslog (in bash using logger and in Node using winston-syslog), all log levels are also shown on the terminal window. I only want to log these events, and silent the output unless they ...
0
votes
1answer
22 views

rsyslogd used with any application or only Linux system logging?

Is the purpose of rsyslogd to handle logging of applications in userspace? For example i have 5 Jboss instances running on a server with custum applications running inside them. They all produce there ...
8
votes
4answers
244 views

decrease kernel boot log verbosity level

When my kernel boots, apart from the useful important information, it prints lots of debugging info, such as .... kernel: [0.00000] BIOS-e820: [mem 0x0000000000000000-0x000000000009d3ff] usable ...
5
votes
1answer
128 views

logging to /dev/xconsole does not work properly

I am using rsyslog, and I want to send logs to /dev/xconsole. I have following relevant line in /etc/rsyslog.conf *.*;cron.!=info;mail.!=info |/dev/xconsole This works only partially. It looks ...
1
vote
0answers
64 views

How to save logs from remote clients to a different file?

I have the below changes in the rsyslog.conf ################# #### MODULES #### ################# $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel ...
0
votes
1answer
35 views

rsyslogd running but cannot connect on port?

These are my configuration lines on rsyslog.conf $ModLoad imudp $UDPServerAddress 127.0.0.1 $UDPServerRun 1029 After restarting I run sudo netstat -taupn | grep syslog and it's running on port ...
0
votes
1answer
115 views

How can I forward only errors from the audit log to rsyslog server?

rsyslog documentation is very unclear. I want to forward only errors from auditlog to the remote rsyslog server. The examples show: # auditd audit.log $InputFileName /var/log/audit/audit.log ...
0
votes
0answers
38 views

rsyslog treats message string as the source hostname

Sample device kernel logs sent across the wire to rsyslog server- 2015-08-27T09:43:53.141273+00:00 console [netcon0] enabled 2015-08-27T11:26:39.658558+00:00 console [netcon0] enabled ...
0
votes
0answers
1k views

Tomcat 7 not producing log output to catalina.out on RHEL7

I have a RHEL7 server with Apache Tomcat 7.0 installed and after a recent update to RHEL7.1 all of the logging to ${catalina.base}/logs/catalina.out was stopped. However i am receiving the logs inside ...
0
votes
0answers
110 views

RSyslog Log Rotation using rsyslog.conf

I'm using the rsyslog to rotate logs and it stopped working. Not sure where it went wrong. This was working and now it stopped... rsyslog.conf $outchannel ...
0
votes
0answers
52 views

rsyslog problem

I'm trying to execute this 3 commands into rsyslog: IFS=':' read -a trap <<< "${msg}" IFS='#' read -a trap2 <<< "${trap[11]}" if $trap2 > 300 then ^/pruebas/script.sh But when ...
1
vote
0answers
76 views

Where do these boot log entries come from and who creates them?

I'm wondering what kind of code writes these first two lines into /var/log/syslog while booting my machine: Aug 4 10:13:48 HOSTNAME kernel: imklog 5.8.11, log source = /proc/kmsg started. Aug 4 ...
1
vote
2answers
340 views

Figure out Rsyslog listening port number

On my ubuntu 14.04 machine, rsyslog service is running healthily... service rsyslog status returns, rsyslog start/running, process 794 cat /proc/794/cmdline shows, rsyslog #meaning rsyslog is ...
0
votes
2answers
54 views

rsyslog seems to have vanished from my system

I'm debugging an issue where I think my server is spamming other servers because it is infected but all my logs stop in august last year, and rsyslog is missing from the system /etc/rsyslog.d still ...
0
votes
0answers
14 views

rsyslogd taking up all my drive space, only when the service is started

I have configured rsyslogd to write log files to an external drive. When the service is not started, but the drive is mounted, my disk utilization (by df) is low. As soon as I start rsyslogd, the ...
0
votes
0answers
46 views

Why rsyslog leaves the last file in spool directory

Suppose I am using a rsyslog remote server (R1) & have a client box (C1). C1 is configured to sync up and use R1 for logging (over port 514; TCP) The spool directory is '/var/log/rsyslog'. Now, ...
0
votes
1answer
54 views

rsyslog adding unwanted text to outbound log data

I'm using rsyslog to send access & error log data to a remote server. The interface is in place, but I'm getting an extra bit of text in the outbound log data that isn't included in ...
0
votes
0answers
31 views

Lightdm and rsyslogd intermittenly consuming 50% of CPU

I'm running Cubieboard3 (CubieTruck) mini pc thats runs Cubian (a derivative of Debian). Sometimes after booting up the CPU got consumed by almost 50%. When I ran top these two processes are ...
2
votes
1answer
650 views

How do I disable local syslog, and is it a good idea?

I use centralized logging with rsyslog, which means that there are dedicated logging servers which collect syslog messages from all servers. All inspections of logs are done from those logging ...
2
votes
0answers
181 views

How to explain strange kernel messages?

I have a server running on Debian Wheezy 3.2.68-1+deb7u1 x86_64. Lately strange records in /var/log/messages appeared. First messages of this log starts just after server reboot. 6.222.18 LEN=44 ...
1
vote
1answer
555 views

rsyslog Filtering Based on IP Address with Wildcards

I have some syslog traffic being processed by rsyslog and I'd like to set up filters to store the logs based on the IP addresses of the source devices. I have a large number of devices and would ...
13
votes
1answer
2k views

Understand logging in Linux

As I understand, Linux kernel logs to /proc/kmsg file(mostly hardware-related messages) and /dev/log socket? Anywhere else? Are other applications also able to send messages to /proc/kmsg or /dev/log? ...
1
vote
2answers
1k views

Rsyslog is losing messages

I am using rsyslog v5.8.11. I found this version number from what rsyslog logs on restart. I am trying to apply rate-limiting in rsyslog but it is of no use. I am still losing messages. In the ...
3
votes
1answer
385 views

Rsyslog `logger` message duplicated

I just had a problem with rsyslog's imjournal module, possibly the issue described here, whereby complications with systemd's journal cause the journal to return the same data endlessly in a ...
1
vote
1answer
320 views

how to show colors in syslog

I have a node.js server logging output to syslog. I am starting the server like this: node app.js 2>&1 | logger -t app I am using some node libraries to colorize the output (within the app ...
0
votes
1answer
455 views

unknown facility name “local8”

I'm setting up remote logging for the first time and am able to output all httpd messages to local6. I'm getting an error, and have a general question about rsyslog. First: I tried splitting ...