rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

0
votes
0answers
6 views

How are rsyslog action numbered?

My log shows that one of my rsyslog actions was not handled: May 28 10:22:02 rpi1 rsyslogd-2007: action 'action 18' suspended, next retry is Sat May 28 10:23:32 2016 [try ...
0
votes
1answer
2k views

How do I get debug information from rsyslog?

I followed the directions from: http://www.rsyslog.com/doc/debug.html I put the following in /etc/rsyslog.conf: $DebugLevel 2 $DebugFile /root/RSYSLOG.txt then I try: kill -USR1 `cat ...
4
votes
1answer
584 views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
1
vote
0answers
22 views

Raspberry pi blocks completely after multiple reboots

I have a c++ program running on login on the raspberry pi, this program checks data for multiple devices attached on to it (Arduino Mega 2560 + Modbus RS485), gets inputted data from them and sends ...
0
votes
1answer
19 views

/var/log/messages reports non existent user

I'm trying to understand what is the third parameter in my /var/log/messages file. For example: $ logger test $ grep test /var/log/messages Output: May 20 15:32:57 hostname myusername: ...
1
vote
1answer
41 views

Strange lines in /var/log/message folder of Centos machine

Below are lines from my /var/log/messages. Can someone help me to understand what these lines mean? I am running a syslog server on this machine. I want to know if these messages would stop the ...
1
vote
1answer
56 views

File location for Syslogs in Centos machine

I am running syslog server (rsyslog 8) on my centos machine. I want to map other device in my network to send the logs to this syslog server. If mapping is done correctly where exactly the syslogs ...
0
votes
0answers
15 views

rsyslog doesn't collect logs

I have configured HP 5120 switch to send messages to syslog server: info-center loghost 10.10.84.111 facility local4 on my debian rsyslogd 5.8.11 modified/etc/syslog.conffile: ...
0
votes
1answer
666 views

unknown facility name “local8”

I'm setting up remote logging for the first time and am able to output all httpd messages to local6. I'm getting an error, and have a general question about rsyslog. First: I tried splitting ...
1
vote
1answer
54 views

rsyslog - what host is sending these files?

I'm working on an pre-existing installation of rsyslog. I am not sure what remote hosts are sending log files to the server. Some of the folders have unhelpful names like 'last', 'Server', 'syslogd', ...
0
votes
1answer
48 views

rsyslog not forwarding messages to remote rsyslog server

I'm debugging a strange issue with a logging SaaS solution. We appear to be duplicating logs sent to the SaaS. Logs are sent via an rsyslog forwarder over TLS. I'm trying to see if I can reproduce the ...
0
votes
1answer
33 views

Cron stopped logging to /var/log/cron.log

A month ago I set cron to log to /var/log/cron.log by modifying /etc/rsyslog.d/50-default.conf. Logging worked great until I changed permissions on /var/log (by easing permission restrictions), and ...
0
votes
2answers
3k views

Tomcat 7 not producing log output to catalina.out on RHEL7

I have a RHEL7 server with Apache Tomcat 7.0 installed and after a recent update to RHEL7.1 all of the logging to ${catalina.base}/logs/catalina.out was stopped. However i am receiving the logs inside ...
7
votes
2answers
15k views

rsyslog not logging

This is an odd issue. I was testing the chrony/ntp services on a RHEL7 VM and was resetting its time as well as the host's. Once I was satisfied with it I checked /var/log/messages and realized it ...
0
votes
3answers
95 views

Puppet doesn't ignore whitespace

I have an entry that may or may not appear in /etc/rsyslog.conf: # Added for Kiwi *.err;*.emerg;*.alert;*.warning;*.debug;*.notice;*.crit;*.info @10.19.24.50 Since some of these servers ...
0
votes
3answers
40 views

Are symlinks in sync with the parent file all the time?

I have a log file which is having a ownership for only root. This file consists of active incoming logs & is continuously updated any time. I need to create a symlink for this file and change the ...
1
vote
1answer
62 views

systemd, rsyslogd - where are the logs?

I got a Fedora 23 Server edition installation which I have done pretty much nothing with admin-wise besides setting up ssh, fail2ban, samba, and users. The other day I was completely locked out of my ...
0
votes
0answers
15 views

Testing OpenSSH Logging

I'm attempting to turn on logging inside OpenSSH running in an Alpine Docker container. I made sure to install rsyslog and start the daemon with /usr/sbin/rsyslogd. My sshd logging settings are as ...
1
vote
0answers
70 views

Rsyslog not creating log files

I'm hardening an Ubuntu 14.04 VM to CIS standards and am having a problems getting rsyslog to create the necessary files. Note: I'm getting better with Linux but I'm no master yet, please excuse any ...
0
votes
0answers
19 views

Sending log files from FreeBSD client running syslogd to Linux server running rsyslog

Has anyone successfully attempted writing syslog log files directly from a FreeBSD client machine running syslogd to a Linux (RHEL) server running rsyslog over the wire? I see different information ...
2
votes
2answers
874 views

rsyslog: how to bind rulesets to unix sockets (imuxsock)

I'm using the imuxsock module to listen to additional local log sockets (i.e., with the $AddUnixListenSocket directive). After reading the awesome http://www.rsyslog.com/doc/multi_ruleset.html page, ...
1
vote
0answers
24 views

Rsyslog to use hostname instead of leftmost FQDN label

I have an Ubuntu 15.10 configuration in which /etc/hostname reads projectname-environmentname and /etc/hosts reads 127.0.0.1 localhost 127.0.1.1 environmentname.projectname.tld ...
3
votes
1answer
689 views

Prevent rsyslog from logging remote hosts messages to local /var/log/syslog

I use rsyslog to save logs from remote hosts to a server this way: Server: # Logfile for each host $template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log" *.* -?DynaFile Clients: *.* @servername ...
0
votes
0answers
44 views

Not receving tomcat logs on rsyslog sever

We have configured the rsyslogs server for tomcat8 the using the log4j. Here is our tomcat log4j.properties configuration file, but we are not receiving the logs on rsyslog server. Tomcat version ...
1
vote
1answer
11 views

About redirect log in rsyslog.conf

what is the difference between this 2 lines: mail.warn -/var/log/mail.warn mail.err /var/log/mail.err (with and without the -) and who i redirect a syslog msg from a host to a ...
1
vote
1answer
42 views

Changing the Facility of outgoing syslog message using rsyslog configuration

I need to change the facility of the syslog message going out to a remote syslog server. I am using rsyslog in my system. I am using the following configuration to forward logs to another syslog ...
0
votes
0answers
44 views

/var/log/secure and other log files are empty even after restarting rsyslog.service

I am running a Centos7 server with rsyslog for logging. The service is on (sudo systemctl is-enabled rsyslog) outputs "enabled". I have also configured the service to start at boot-time. However, ...
0
votes
1answer
54 views

How can I use part of match in Regex to generate filename of action?

I am using CentOS6.5 that include rsyslogd v5.8.10 There are 20 process program in my server.I want to receive logs use rsyslogd and hope to store in different log file according identity of process ...
0
votes
0answers
18 views

Handling tab delimited records in rsyslogd

I want to receive tab delimited records via a specific syslog facility. What lines would I need to add to my rsyslogd.conf to log all local0.* messages to a file, while passing through the tab ...
2
votes
1answer
240 views

How to explain strange kernel messages?

I have a server running on Debian Wheezy 3.2.68-1+deb7u1 x86_64. Lately strange records in /var/log/messages appeared. First messages of this log starts just after server reboot. 6.222.18 LEN=44 ...
2
votes
2answers
231 views

How to configure logging inside a Docker container?

I was trying to dockerize (into Debian 8.2) an OpenVPN server (yes, I do know, there already are such containers) but something went wrong inside the container and the server failed to start. I ...
0
votes
3answers
5k views

Add year to entries generated by rsyslogd

The default configuration of rsyslogd writes log entries in the traditional format, which looks like this: Nov 30 10:40:01 localhost CRON[30786]: pam_unix(cron:session): session closed for user list ...
1
vote
0answers
183 views

how to have syslog not log particular warnings?

Short Version: I want to stop the following message from appearing in my syslog. They pertain to a USB port on my keyboard that can be ignored: Feb 9 23:33:45 sunfire kernel: [ 8163.156041] usb ...
4
votes
4answers
1k views

rsyslog: execute script on matching log event

I have the following line in my /etc/rsyslog.conf :programname, contains, "suhosin" /var/log/suhosin.log which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I ...
0
votes
0answers
15 views

Rsyslog not creating dynamic directories

I have Red Hat Enterprise Linux Server release 6.5 running rsyslogd 5.8.10 I'm trying to collect logs from a remote client (VM1) and I have the following line configured if $inputname == 'imudp' ...
1
vote
0answers
32 views

Loggin apt history to syslog

I have a centralized log management server (graylog) and I want to be able to see the installed/updated/removed packages from a couple of ubuntu serveres there is running. But is there anyway to ...
1
vote
0answers
67 views

rsyslogd eating up 20+ GB (!) of RAM - what evidence to gather?

I have a Ubuntu 14.04.3 box running kernel 3.13.0-74 with 32GB RAM, which features a rsyslogd process gone mad: $ ps -auxww | grep rsyslog syslog 16212 0.7 64.0 27966168 21070336 ? Ssl Jan04 ...
0
votes
0answers
15 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
0
votes
0answers
25 views

extra rsyslog conf works if I restart rsyslog but not at boot

I'm on ubuntu and trying to get rid of a bunch of extra crap that Avahi puts in the system logs (/var/log/syslog). My understanding is that things in /etc/rsyslogd are loaded into the rsyslog config, ...
0
votes
0answers
84 views

Syslog stopped logging after using journalctl

Today I was configuring some things in my VPS running CentOS 7, and checked /var/log/secure several times without noticing any problems.Later I used journalctl to look for some cron logs, and now it ...
0
votes
0answers
57 views

rsyslog not working

I have been trying to start the rsyslog service on centos 7 but I wont work. Please see te configuration file- # rsyslog configuration file # For more information see ...
1
vote
2answers
57 views

Rsyslog receiving from multiple hosts and saving to different files

I want the router and AP I have in my home network to use my Raspberry Pi running Debian as a syslog server (rsyslogd 5.8.11).However, I can't find anywhere a simple guide on how to receive logs from ...
1
vote
2answers
129 views

Merging log files with different timestamp formats

I have two types of log files Standard Syslog format The timestamp looks as below 5:2015 Dec 21 07:35:06:ABC:foo1:1559: common.c:946:Enabling filter 6:2015 Dec 21 07:35:08:ABC:bar1:1461: ...
0
votes
1answer
179 views

How to set the nofile limit on rsyslog with upstart?

I'm struggling to work out how to set the open file limit on rsyslog on Ubuntu 14.04. It uses Upstart, which ignores limits.conf, but I'd expect to be able to put limit nofile 16384 16384 in ...
1
vote
0answers
15 views

rsyslog — devices have same hostname and pub ip

I'm working on a remote logging setup for some cellular devices that are on a carrier's private network. I have it set up to pass syslogs from the cellular devices to a publicly available server. My ...
5
votes
2answers
72 views

Isolate SSH Authentication Failures into Own Log File on RHEL 6.6

This may be impossible, but I've got a case where we want to log SSH authentication failures separately from standard SSH logging on a RHEL 6.6 box. I am aware we can use SyslogFacility with ...
0
votes
1answer
179 views

How to send Ossec alerts to Syslog server

I want ossec server to send alerts to Syslog server. Now in this case Ossec Server and RSyslog Server are on same server. I want Ossec Server to send all the alerts from client to location ...
1
vote
2answers
137 views

Why is syslogd not reporting messages to remote server during and just after the boot?

I configured rsyslog to send logs to a central logging server like this: *.* @@192.168.1.20 $ActionExecOnlyWhenPreviousIsSuspended on & @@192.168.1.21 & /var/log/failover ...
1
vote
1answer
127 views

rsyslogd HUPed repeatedly

Noticing that for a VM box, getting in the logs that rsyslogd process gets HUPed. Finding no ideas except a few post in some forums saying this is for logrorate. Any ideas how to fix/troubleshoot ...
1
vote
1answer
43 views

problem with rsyslog filters

I have to make a rule in rsyslog.conf file in order to get the mail logs which at least notice priority but with exception of err priority to a certain path. Here is the rule I tried to make for ...