rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

4
votes
4answers
823 views

rsyslog: execute script on matching log event

I have the following line in my /etc/rsyslog.conf :programname, contains, "suhosin" /var/log/suhosin.log which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I ...
0
votes
0answers
8 views

Rsyslog not creating dynamic directories

I have Red Hat Enterprise Linux Server release 6.5 running rsyslogd 5.8.10 I'm trying to collect logs from a remote client (VM1) and I have the following line configured if $inputname == 'imudp' ...
1
vote
0answers
9 views

Loggin apt history to syslog

I have a centralized log management server (graylog) and I want to be able to see the installed/updated/removed packages from a couple of ubuntu serveres there is running. But is there anyway to ...
1
vote
0answers
25 views

rsyslogd eating up 20+ GB (!) of RAM - what evidence to gather?

I have a Ubuntu 14.04.3 box running kernel 3.13.0-74 with 32GB RAM, which features a rsyslogd process gone mad: $ ps -auxww | grep rsyslog syslog 16212 0.7 64.0 27966168 21070336 ? Ssl Jan04 ...
0
votes
1answer
1k views

How do I get debug information from rsyslog?

I followed the directions from: http://www.rsyslog.com/doc/debug.html I put the following in /etc/rsyslog.conf: $DebugLevel 2 $DebugFile /root/RSYSLOG.txt then I try: kill -USR1 `cat ...
0
votes
0answers
6 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
0
votes
0answers
9 views

extra rsyslog conf works if I restart rsyslog but not at boot

I'm on ubuntu and trying to get rid of a bunch of extra crap that Avahi puts in the system logs (/var/log/syslog). My understanding is that things in /etc/rsyslogd are loaded into the rsyslog config, ...
0
votes
0answers
29 views

Syslog stopped logging after using journalctl

Today I was configuring some things in my VPS running CentOS 7, and checked /var/log/secure several times without noticing any problems.Later I used journalctl to look for some cron logs, and now it ...
0
votes
0answers
27 views

rsyslog not working

I have been trying to start the rsyslog service on centos 7 but I wont work. Please see te configuration file- # rsyslog configuration file # For more information see ...
1
vote
2answers
34 views

Rsyslog receiving from multiple hosts and saving to different files

I want the router and AP I have in my home network to use my Raspberry Pi running Debian as a syslog server (rsyslogd 5.8.11).However, I can't find anywhere a simple guide on how to receive logs from ...
1
vote
2answers
53 views

Merging log files with different timestamp formats

I have two types of log files Standard Syslog format The timestamp looks as below 5:2015 Dec 21 07:35:06:ABC:foo1:1559: common.c:946:Enabling filter 6:2015 Dec 21 07:35:08:ABC:bar1:1461: ...
0
votes
1answer
60 views

How to set the nofile limit on rsyslog with upstart?

I'm struggling to work out how to set the open file limit on rsyslog on Ubuntu 14.04. It uses Upstart, which ignores limits.conf, but I'd expect to be able to put limit nofile 16384 16384 in ...
1
vote
0answers
14 views

rsyslog — devices have same hostname and pub ip

I'm working on a remote logging setup for some cellular devices that are on a carrier's private network. I have it set up to pass syslogs from the cellular devices to a publicly available server. My ...
6
votes
2answers
62 views

Isolate SSH Authentication Failures into Own Log File on RHEL 6.6

This may be impossible, but I've got a case where we want to log SSH authentication failures separately from standard SSH logging on a RHEL 6.6 box. I am aware we can use SyslogFacility with ...
0
votes
1answer
55 views

How to send Ossec alerts to Syslog server

I want ossec server to send alerts to Syslog server. Now in this case Ossec Server and RSyslog Server are on same server. I want Ossec Server to send all the alerts from client to location ...
1
vote
2answers
54 views

Why is syslogd not reporting messages to remote server during and just after the boot?

I configured rsyslog to send logs to a central logging server like this: *.* @@192.168.1.20 $ActionExecOnlyWhenPreviousIsSuspended on & @@192.168.1.21 & /var/log/failover ...
2
votes
1answer
41 views

rsyslogd HUPed repeatedly

Noticing that for a VM box, getting in the logs that rsyslogd process gets HUPed. Finding no ideas except a few post in some forums saying this is for logrorate. Any ideas how to fix/troubleshoot ...
1
vote
1answer
39 views

problem with rsyslog filters

I have to make a rule in rsyslog.conf file in order to get the mail logs which at least notice priority but with exception of err priority to a certain path. Here is the rule I tried to make for ...
0
votes
0answers
26 views

rsyslog , change facility of sending host in remote logging

Is there a way to set a facility for sending host in rsyslog remote logging? All facilities in sending host as one facility in receiving host. like cisco when saying logging trap FACILITY_NUM. ...
0
votes
2answers
51 views

Dynamic file name doesn't work in rsyslog

The filename in rsyslog can be either static or dynamic. The later is useful if you would automatically split messages into different files based on some message criteria. I need split logs depend on ...
0
votes
1answer
17 views

How to customize Shorewall firewall logs

I am using Fedora 13 machine with shorewall installed. shorewall 4.6.6-RC1 iptables v1.4.7 Below is log format by shorewall: Oct 23 05:28:17 localhost kernel: shorewall:LAN-LAN:ACCEPT:IN= OUT=lo ...
0
votes
0answers
133 views

Rsyslog logs retransmitted after log rotation

I have config setup on all my CentOS servers to forward all syslog messages to a Graylog server via rsyslog. In Graylog I have then configured streams to alert on the occurrence of certain message ...
0
votes
1answer
458 views

don't log cron events in auth.log

In my /etc/rsyslog.conf, I have the following line to log the auth facility into /var/log/auth.log: auth,authpriv.* /var/log/auth.log but the file is flooded with cron logs, such as ...
1
vote
2answers
1k views

Rsyslog is losing messages

I am using rsyslog v5.8.11. I found this version number from what rsyslog logs on restart. I am trying to apply rate-limiting in rsyslog but it is of no use. I am still losing messages. In the ...
0
votes
1answer
85 views

rsyslog sending data to remote slows down when $AddUnixListenSocket is used?

I'm running a busy DNS server which logs queries to a remote server via rsyslog. Due to the amount of traffic we're processing I've had to increase the rate limits in rsyslog.conf. This server is ...
1
vote
1answer
33 views

rsyslog use different templates to store logs

I am using rsyslog to handle the logs that my program creates. I have used a template to customize the logs format. My doubts are: If I create a template, every program that use that rsyslog.conf ...
1
vote
1answer
231 views

Get KERN_DEBUG messages into syslog on rhel7/centos7?

I've been trying to get KERN_DEBUG messages logged to a file in centos7, but have had no luck. I can get them just fine from "dmesg," but not /var/log/messages or /var/log/dmesg Here's a MWE kernel ...
0
votes
0answers
39 views

Execute command to get value in rsyslog.conf template parameter

I want to get value of template parameter via command.like below:- $template precise,",%syslogpriority%,host_ip=%fromhost-ip%,|%syslogfacility% ...
8
votes
4answers
241 views

decrease kernel boot log verbosity level

When my kernel boots, apart from the useful important information, it prints lots of debugging info, such as .... kernel: [0.00000] BIOS-e820: [mem 0x0000000000000000-0x000000000009d3ff] usable ...
0
votes
2answers
102 views

Where do the logs directed to /dev/console go?

I'm studying RHEL 7. If I add this line to rsyslog.conf: kern.notice /dev/console Where will the messages with facility "kernel" and priority "notice" be logged? If I run this command: ...
1
vote
1answer
2k views

Pimp rsyslogd to have less i/o (cron, pam,…) and less logging

On my raspberry I really don't need crons and pam logging and I want to have less i/o to make the SD card life a little longer.. I have already removed cron with the second line cron.none, I'm ...
2
votes
1answer
467 views

How to suppress input overrun messages

I have a Raspberry Pi running Raspbian (a Debian flavor: Linux version 3.12-1-rpi (debian-kernel@lists.debian.org) (gcc version 4.7.2 (Debian 4.7.2-5+rpi1) ) #1 Debian 3.12.9-1+rpi1 (2014-05-19) ). ...
1
vote
0answers
19 views

Suppress Rsyslog to terminal

When I use Rsyslog (in bash using logger and in Node using winston-syslog), all log levels are also shown on the terminal window. I only want to log these events, and silent the output unless they ...
0
votes
1answer
22 views

rsyslogd used with any application or only Linux system logging?

Is the purpose of rsyslogd to handle logging of applications in userspace? For example i have 5 Jboss instances running on a server with custum applications running inside them. They all produce there ...
5
votes
1answer
127 views

logging to /dev/xconsole does not work properly

I am using rsyslog, and I want to send logs to /dev/xconsole. I have following relevant line in /etc/rsyslog.conf *.*;cron.!=info;mail.!=info |/dev/xconsole This works only partially. It looks ...
1
vote
0answers
61 views

How to save logs from remote clients to a different file?

I have the below changes in the rsyslog.conf ################# #### MODULES #### ################# $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel ...
0
votes
1answer
33 views

rsyslogd running but cannot connect on port?

These are my configuration lines on rsyslog.conf $ModLoad imudp $UDPServerAddress 127.0.0.1 $UDPServerRun 1029 After restarting I run sudo netstat -taupn | grep syslog and it's running on port ...
0
votes
1answer
109 views

How can I forward only errors from the audit log to rsyslog server?

rsyslog documentation is very unclear. I want to forward only errors from auditlog to the remote rsyslog server. The examples show: # auditd audit.log $InputFileName /var/log/audit/audit.log ...
0
votes
0answers
36 views

rsyslog treats message string as the source hostname

Sample device kernel logs sent across the wire to rsyslog server- 2015-08-27T09:43:53.141273+00:00 console [netcon0] enabled 2015-08-27T11:26:39.658558+00:00 console [netcon0] enabled ...
0
votes
0answers
1k views

Tomcat 7 not producing log output to catalina.out on RHEL7

I have a RHEL7 server with Apache Tomcat 7.0 installed and after a recent update to RHEL7.1 all of the logging to ${catalina.base}/logs/catalina.out was stopped. However i am receiving the logs inside ...
0
votes
0answers
107 views

RSyslog Log Rotation using rsyslog.conf

I'm using the rsyslog to rotate logs and it stopped working. Not sure where it went wrong. This was working and now it stopped... rsyslog.conf $outchannel ...
0
votes
0answers
52 views

rsyslog problem

I'm trying to execute this 3 commands into rsyslog: IFS=':' read -a trap <<< "${msg}" IFS='#' read -a trap2 <<< "${trap[11]}" if $trap2 > 300 then ^/pruebas/script.sh But when ...
1
vote
0answers
75 views

Where do these boot log entries come from and who creates them?

I'm wondering what kind of code writes these first two lines into /var/log/syslog while booting my machine: Aug 4 10:13:48 HOSTNAME kernel: imklog 5.8.11, log source = /proc/kmsg started. Aug 4 ...
0
votes
2answers
54 views

rsyslog seems to have vanished from my system

I'm debugging an issue where I think my server is spamming other servers because it is infected but all my logs stop in august last year, and rsyslog is missing from the system /etc/rsyslog.d still ...
1
vote
2answers
324 views

Figure out Rsyslog listening port number

On my ubuntu 14.04 machine, rsyslog service is running healthily... service rsyslog status returns, rsyslog start/running, process 794 cat /proc/794/cmdline shows, rsyslog #meaning rsyslog is ...
0
votes
0answers
14 views

rsyslogd taking up all my drive space, only when the service is started

I have configured rsyslogd to write log files to an external drive. When the service is not started, but the drive is mounted, my disk utilization (by df) is low. As soon as I start rsyslogd, the ...
0
votes
0answers
46 views

Why rsyslog leaves the last file in spool directory

Suppose I am using a rsyslog remote server (R1) & have a client box (C1). C1 is configured to sync up and use R1 for logging (over port 514; TCP) The spool directory is '/var/log/rsyslog'. Now, ...
0
votes
3answers
4k views

Add year to entries generated by rsyslogd

The default configuration of rsyslogd writes log entries in the traditional format, which looks like this: Nov 30 10:40:01 localhost CRON[30786]: pam_unix(cron:session): session closed for user list ...
0
votes
1answer
54 views

rsyslog adding unwanted text to outbound log data

I'm using rsyslog to send access & error log data to a remote server. The interface is in place, but I'm getting an extra bit of text in the outbound log data that isn't included in ...
2
votes
0answers
181 views

How to explain strange kernel messages?

I have a server running on Debian Wheezy 3.2.68-1+deb7u1 x86_64. Lately strange records in /var/log/messages appeared. First messages of this log starts just after server reboot. 6.222.18 LEN=44 ...