rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

0
votes
1answer
7 views

rsyslogd running but cannot connect on port?

These are my configuration lines on rsyslog.conf $ModLoad imudp $UDPServerAddress 127.0.0.1 $UDPServerRun 1029 After restarting I run sudo netstat -taupn | grep syslog and it's running on port ...
0
votes
1answer
12 views

How can I forward only errors from the audit log to rsyslog server?

rsyslog documentation is very unclear. I want to forward only errors from auditlog to the remote rsyslog server. The examples show: # auditd audit.log $InputFileName /var/log/audit/audit.log ...
0
votes
0answers
8 views

rsyslog treats message string as the source hostname

Sample device kernel logs sent across the wire to rsyslog server- 2015-08-27T09:43:53.141273+00:00 console [netcon0] enabled 2015-08-27T11:26:39.658558+00:00 console [netcon0] enabled ...
0
votes
0answers
45 views

Tomcat 7 not producing log output to catalina.out on RHEL7

I have a RHEL7 server with Apache Tomcat 7.0 installed and after a recent update to RHEL7.1 all of the logging to ${catalina.base}/logs/catalina.out was stopped. However i am receiving the logs inside ...
0
votes
0answers
21 views

RSyslog Log Rotation using rsyslog.conf

I'm using the rsyslog to rotate logs and it stopped working. Not sure where it went wrong. This was working and now it stopped... rsyslog.conf $outchannel ...
0
votes
0answers
17 views

rsyslog problem

I'm trying to execute this 3 commands into rsyslog: IFS=':' read -a trap <<< "${msg}" IFS='#' read -a trap2 <<< "${trap[11]}" if $trap2 > 300 then ^/pruebas/script.sh But when ...
1
vote
0answers
37 views

Where do these boot log entries come from and who creates them?

I'm wondering what kind of code writes these first two lines into /var/log/syslog while booting my machine: Aug 4 10:13:48 HOSTNAME kernel: imklog 5.8.11, log source = /proc/kmsg started. Aug 4 ...
0
votes
2answers
42 views

Figure out Rsyslog listening port number

On my ubuntu 14.04 machine, rsyslog service is running healthily... service rsyslog status returns, rsyslog start/running, process 794 cat /proc/794/cmdline shows, rsyslog #meaning rsyslog is ...
0
votes
2answers
43 views

rsyslog seems to have vanished from my system

I'm debugging an issue where I think my server is spamming other servers because it is infected but all my logs stop in august last year, and rsyslog is missing from the system /etc/rsyslog.d still ...
0
votes
0answers
12 views

rsyslogd taking up all my drive space, only when the service is started

I have configured rsyslogd to write log files to an external drive. When the service is not started, but the drive is mounted, my disk utilization (by df) is low. As soon as I start rsyslogd, the ...
0
votes
0answers
33 views

Why rsyslog leaves the last file in spool directory

Suppose I am using a rsyslog remote server (R1) & have a client box (C1). C1 is configured to sync up and use R1 for logging (over port 514; TCP) The spool directory is '/var/log/rsyslog'. Now, ...
0
votes
1answer
33 views

rsyslog adding unwanted text to outbound log data

I'm using rsyslog to send access & error log data to a remote server. The interface is in place, but I'm getting an extra bit of text in the outbound log data that isn't included in ...
0
votes
0answers
22 views

Lightdm and rsyslogd intermittenly consuming 50% of CPU

I'm running Cubieboard3 (CubieTruck) mini pc thats runs Cubian (a derivative of Debian). Sometimes after booting up the CPU got consumed by almost 50%. When I ran top these two processes are ...
2
votes
1answer
131 views

How do I disable local syslog, and is it a good idea?

I use centralized logging with rsyslog, which means that there are dedicated logging servers which collect syslog messages from all servers. All inspections of logs are done from those logging ...
2
votes
0answers
83 views

How to explain strange kernel messages?

I have a server running on Debian Wheezy 3.2.68-1+deb7u1 x86_64. Lately strange records in /var/log/messages appeared. First messages of this log starts just after server reboot. 6.222.18 LEN=44 ...
1
vote
1answer
215 views

rsyslog Filtering Based on IP Address with Wildcards

I have some syslog traffic being processed by rsyslog and I'd like to set up filters to store the logs based on the IP addresses of the source devices. I have a large number of devices and would ...
9
votes
1answer
413 views

Understand logging in Linux

As I understand, Linux kernel logs to /proc/kmsg file(mostly hardware-related messages) and /dev/log socket? Anywhere else? Are other applications also able to send messages to /proc/kmsg or /dev/log? ...
0
votes
1answer
207 views

Rsyslog is losing messages

I am using rsyslog v5.8.11. I found this version number from what rsyslog logs on restart. I am trying to apply rate-limiting in rsyslog but it is of no use. I am still losing messages. In the ...
2
votes
1answer
114 views

Rsyslog `logger` message duplicated

I just had a problem with rsyslog's imjournal module, possibly the issue described here, whereby complications with systemd's journal cause the journal to return the same data endlessly in a ...
0
votes
1answer
116 views

how to show colors in syslog

I have a node.js server logging output to syslog. I am starting the server like this: node app.js 2>&1 | logger -t app I am using some node libraries to colorize the output (within the app ...
0
votes
1answer
212 views

unknown facility name “local8”

I'm setting up remote logging for the first time and am able to output all httpd messages to local6. I'm getting an error, and have a general question about rsyslog. First: I tried splitting ...
2
votes
1answer
53 views

What defines the type of log data that goes into local1, local2, ect?

I'm new to remote logging with rsyslog and having looked through this page, I am unclear what each of the "locals" are used for. (EDIT - this SF question revealed a little more info) I initially set ...
0
votes
1answer
38 views

What can cause auth.log to start over again?

In my Raspberry Pi running Debian, I have a simple script to output the IPs which have successfully logged into the system via SSH. It's like this: #!/bin/bash egrep 'Accepted password|Accepted ...
0
votes
0answers
71 views

Rsyslog logs retransmitted after log rotation

I have config setup on all my CentOS servers to forward all syslog messages to a Graylog server via rsyslog. In Graylog I have then configured streams to alert on the occurrence of certain message ...
3
votes
0answers
83 views

Logging apt/dpkg activity to syslog

My goal is to log apt/dpkg activity using syslog (rsyslog), so that log entries are sent to central syslog server. dpkg writes to /var/log/dpkg.log, apt writes to /var/log/apt directory. I did some ...
1
vote
1answer
69 views

What' the difference between /var/log and -/var/log in rsyslog.conf on RPi B?

I've noticed in my /etc/rsyslog.conf file that some destination got that symbol "-" in front of it. For example: mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err ...
1
vote
1answer
42 views

syslog set tag from api?

I can pump messages into rsyslog with a syslogtag using the following from the command line using the -t option: myprogram | logger -t MYTAG And later filter based on that tag: :syslogtag, ...
0
votes
2answers
49 views

Save syslog from honeypot to a host virtual machine

So im making a research honeypot. The host is ubuntu 14.04. I want to store all of the logs from the honeypot ssh to the ubuntu host so the data is not lost. Does anyone know anything about this? I ...
0
votes
0answers
57 views

Equivalent to syslog-ng program-override option for rsyslog

I would like to know what is the rsyslog equivalent to the program-override option in syslog-ng?
3
votes
0answers
282 views

Prevent rsyslog from logging remote hosts messages to local /var/log/syslog

I use rsyslog to save logs from remote hosts to a server this way: Server: # Logfile for each host $template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log" *.* -?DynaFile Clients: *.* @servername ...
0
votes
1answer
766 views

How to redirect logs to syslog for an application which doesn't support syslog yet?

Nginx adds logging to syslog feature in version 1.7.1. I can only get the version 1.6.2 from ppa:nginx/stable, or the version 1.4.6 from the default Ubuntu package sources. I have a common log ...
2
votes
0answers
83 views

Restart rsyslog after ntp time sync

I want to ensure that the logs written, have the correct timestamp. So, when ntpd completes the sync (ntpq -c rv displays sync_ntp), I want to restart rsyslogd. But I am not finding any hooks/config ...
1
vote
1answer
4k views

log files in CentOS 7 [closed]

In CentOS 7, how can I locate and view all the system logs that tell me who tried to enter the system, who got in, what processes they contacted, what they accomplished, etc. I want to be able to ...
0
votes
0answers
103 views

Can rsyslogd write to more than one named pipe

If I have the following two lines in the rsyslogd.conf *.* |/var/run/rsyslog/pipe1 *.* |/var/run/rsyslog/pipe2 Will all messages be sent to both pipes? I have two programs that want to inspect ...
0
votes
0answers
261 views

rsyslog does not stream data to flume

I have a problem with Flume as it is not recognizing the events on console. My configuration file is this: ### Name the components on this agent a1.sources = r1 a1.sinks = k1 a1.channels = c1 ### ...
0
votes
0answers
7 views

rsyslog does not stream data to flume [duplicate]

I have a problem with Flume as it is not recognizing the events on console. My configuration file is this: ### Name the components on this agent a1.sources = r1 a1.sinks = k1 a1.channels = c1 ### ...
1
vote
0answers
97 views

rsyslog and netsnmp support for Linux namespaces

I have configured different net namespaces (netns) on my linux machine (Ubuntu) with different routes in each. Now, if I want rsyslog and SNMP traps (netsnmp) to use one of the route from these ...
0
votes
1answer
68 views

Logging of what ended a process?

Due to the tight resources of the server, I suspect System will end processes from time to time. I want those events to be logged in a separate file for investigation. How do I set that in ...
0
votes
1answer
414 views

How do I get debug information from rsyslog?

I followed the directions from: http://www.rsyslog.com/doc/debug.html I put the following in /etc/rsyslog.conf: $DebugLevel 2 $DebugFile /root/RSYSLOG.txt then I try: kill -USR1 `cat ...
1
vote
1answer
428 views

rsyslog: how do I set up remote logging?

I am simply trying to set up a remote logging system. I think my setup is correct but it fails and I can't get any messages from rsyslog to show up in the logs, so I can't find out why. My iptables ...
2
votes
1answer
363 views

rsyslogd only logs from remote servers after enabling UDP:514 on Debian

I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance ...
2
votes
0answers
325 views

How to suppress input overrun messages

I have a Raspberry Pi running Raspbian (a Debian flavor: Linux version 3.12-1-rpi (debian-kernel@lists.debian.org) (gcc version 4.7.2 (Debian 4.7.2-5+rpi1) ) #1 Debian 3.12.9-1+rpi1 (2014-05-19) ). ...
1
vote
0answers
88 views

Generating Email alert for events in system log

How to generate email alert for every critical event logged in system log /var/log/messages. Suppose, for the following log message, I want an email alert to be generated. Oct 24 11:17:42 eforms ...
0
votes
0answers
132 views

Stopping syslogd also closes /dev/log UNIX domain socket

I am working on a project and from some testing I found out that stopping syslogd daemon also closes /dev/log socket. Is there some other way so that even if syslogd is down, /dev/log socket still ...
0
votes
1answer
210 views

rsyslog doesnt seem to write to log file, without restart after touch'ing the file

I have a separate file for logging local7 facility, and this file is touched and permissions set, from my installer. But sometimes I see that the logs are not being written to it (after I do a ...
2
votes
1answer
512 views

Installing rsyslog from source - No package 'liblogging-stdlog' found

I asked this over in AskUbuntu but have had no luck with an answer. I am doing experiments with different logging systems. At the moment I am trying to install rsyslog from source so I can make some ...
1
vote
2answers
467 views

Force rsyslogd to create new file before somebody will write to it

I'm using rsyslogd 7.4.4 on Ubuntu 14.04. I've updated the configuration file /etc/rsyslog.d/30-component.conf with the following content: # provides UDP syslog reception $ModLoad imudp $UDPServerRun ...
1
vote
0answers
163 views

Get KERN_DEBUG messages into syslog on rhel7/centos7?

I've been trying to get KERN_DEBUG messages logged to a file in centos7, but have had no luck. I can get them just fine from "dmesg," but not /var/log/messages or /var/log/dmesg Here's a MWE kernel ...
0
votes
1answer
38 views

filtering rsyslog log on the server side

Hi I'm trying to filter usb messages, specifically of new connections. all of my clients are configured to send to a central server their 'kern.*' log. problem is I'm getting to much "junk" logs and ...
3
votes
1answer
617 views

How to disable systemd's “Time has been changed” message spam in /var/log/syslog on Debian jessie?

Due to combined use of Debian jessie, that uses systemd by default, and sdwdate (that uses Slow Clock Adjuster ( gh )), my system clock is frequently changed. As a result /var/log/syslog gets ...