rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

2
votes
2answers
722 views

don't log cron events in auth.log

In my /etc/rsyslog.conf, I have the following line to log the auth facility into /var/log/auth.log: auth,authpriv.* /var/log/auth.log but the file is flooded with cron logs, such as these:...
0
votes
0answers
16 views

How to forward a log file in Kali linux which is in /var/log/MyLog.log using RSYSLOG?

I have setup 2 Kali Linux machines. "Machine 1" is forwarding all the logs to "Machine 2", in /var/log/MyLog.log file. For this I have used, File: Machine 1 /etc/rsyslog.conf: \*.* @192.168.30.140:...
0
votes
1answer
18 views

rsyslog listen ip address

I am trying to configure rsyslog to listen on port 514 and want to make sure that it is only listening on 127.0.0.1. It is accepting logs on 514 but it is listening on all ip address. I have tried ...
13
votes
2answers
6k views

Understand logging in Linux

As I understand, Linux kernel logs to /proc/kmsg file(mostly hardware-related messages) and /dev/log socket? Anywhere else? Are other applications also able to send messages to /proc/kmsg or /dev/log? ...
0
votes
2answers
3k views

Tomcat 7 not producing log output to catalina.out on RHEL7

I have a RHEL7 server with Apache Tomcat 7.0 installed and after a recent update to RHEL7.1 all of the logging to ${catalina.base}/logs/catalina.out was stopped. However I am receiving the logs inside ...
4
votes
2answers
246 views

Logging apt/dpkg activity to syslog

My goal is to log apt/dpkg activity using syslog (rsyslog), so that log entries are sent to central syslog server. dpkg writes to /var/log/dpkg.log, apt writes to /var/log/apt directory. I did some ...
0
votes
0answers
17 views

rsyslog forward all facilities but one

I have a rsyslog client, version 5.8 on centos 6 successfully forwarding log messages to a remote host. Now I have added some local files to the local3 facility, and I want to exclude this facility ...
1
vote
0answers
29 views

rsyslog is still sending messages to omusrmsg even after using `stop` command

I have the following lines in the 50-default.conf file (in /etc/rsyslog.d): local0.emerg stop *.emerg :omusrmsg:* But all local0 messages are still being sent to every user logged ...
1
vote
1answer
2k views

How do I get debug information from rsyslog?

I followed the directions from: http://www.rsyslog.com/doc/debug.html I put the following in /etc/rsyslog.conf: $DebugLevel 2 $DebugFile /root/RSYSLOG.txt then I try: kill -USR1 `cat /var/run/...
2
votes
1answer
46 views

fail to log through rsyslog on an archlinux system

Using release 2016.03.01 from Archlinux, with package rsyslogd 8.18.0, I started from the minimal configuration built from Very simple config : # cat rsyslog.conf $ModLoad immark $ModLoad imudp $...
0
votes
0answers
17 views

How to redirect kernel: lockd: messages to another file from syslog.conf

I do not understand the syntax in syslog.conf for redirecting the following kind of messages (kernel: lockd: ): Jun 13 11:53:43 myserver kernel: lockd: cannot monitor 192.254.223.233 I believe ...
3
votes
2answers
64 views

setgid sticky bit not working

I have yet another frustrating problem. I have a group of users belonging to the "testing" group. I have a folder located at /var/log/projects with the setgid bit set. This is so any new files or ...
0
votes
0answers
39 views

rsyslog remote logging capturing local messages

We have setup a RHEL 6 server to capture syslogs from remote hosts. Although its working and I am capturing the logs, all of the local system logs are being directed into the remote log directory ...
0
votes
0answers
17 views

rsyslog: how to log to one of multiple log servers

I have a server that generates a lot of log content (single log file), and want to send it out to say 4 backends. I do not want all entries to be duplicated to every backend, but, say, rotate among ...
-3
votes
1answer
39 views

rsyslog versus rsyslog.d

I'm currently studying for my Red Hat Certification exam, and I've come across an example in my book dealing with system log architecture. I'm currently working a classroom RHEL7 environment. My ...
0
votes
4answers
6k views

Add year to entries generated by rsyslogd

The default configuration of rsyslogd writes log entries in the traditional format, which looks like this: Nov 30 10:40:01 localhost CRON[30786]: pam_unix(cron:session): session closed for user list ...
1
vote
0answers
47 views

fail to log from my app through rsyslogd in a linux container

Running an archlinux container on an archlinux host, both using rsyslog with the same configuration file: $ cat /etc/rsyslog.conf # Minimal config $ModLoad imuxsock # provides support for local ...
0
votes
0answers
17 views

How to force rsyslog ommysql use UTF8?

I'm using ommysql in rsyslog for transferring data into MySQL $ModLoad ommysql local6.* :ommysql:localhost,Syslog,rsyslog,1 but Cyrillic data goes like "·Ð¾Ð²Ð°Ð½Ð¸Ðµ иÑ�точнÐ" in ...
0
votes
0answers
9 views

How are rsyslog action numbered?

My log shows that one of my rsyslog actions was not handled: May 28 10:22:02 rpi1 rsyslogd-2007: action 'action 18' suspended, next retry is Sat May 28 10:23:32 2016 [try http://www.rsyslog.com/e/...
4
votes
1answer
678 views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
1
vote
0answers
22 views

Raspberry pi blocks completely after multiple reboots

I have a c++ program running on login on the raspberry pi, this program checks data for multiple devices attached on to it (Arduino Mega 2560 + Modbus RS485), gets inputted data from them and sends ...
0
votes
1answer
25 views

/var/log/messages reports non existent user

I'm trying to understand what is the third parameter in my /var/log/messages file. For example: $ logger test $ grep test /var/log/messages Output: May 20 15:32:57 hostname myusername: ...
1
vote
1answer
49 views

Strange lines in /var/log/message folder of Centos machine

Below are lines from my /var/log/messages. Can someone help me to understand what these lines mean? I am running a syslog server on this machine. I want to know if these messages would stop the ...
1
vote
1answer
75 views

File location for Syslogs in Centos machine

I am running syslog server (rsyslog 8) on my centos machine. I want to map other device in my network to send the logs to this syslog server. If mapping is done correctly where exactly the syslogs ...
0
votes
0answers
23 views

rsyslog doesn't collect logs

I have configured HP 5120 switch to send messages to syslog server: info-center loghost 10.10.84.111 facility local4 on my debian rsyslogd 5.8.11 modified/etc/syslog.conffile: uncommented$...
0
votes
1answer
774 views

unknown facility name “local8”

I'm setting up remote logging for the first time and am able to output all httpd messages to local6. I'm getting an error, and have a general question about rsyslog. First: I tried splitting ...
1
vote
1answer
88 views

rsyslog - what host is sending these files?

I'm working on an pre-existing installation of rsyslog. I am not sure what remote hosts are sending log files to the server. Some of the folders have unhelpful names like 'last', 'Server', 'syslogd', ...
0
votes
1answer
161 views

rsyslog not forwarding messages to remote rsyslog server

I'm debugging a strange issue with a logging SaaS solution. We appear to be duplicating logs sent to the SaaS. Logs are sent via an rsyslog forwarder over TLS. I'm trying to see if I can reproduce the ...
0
votes
1answer
61 views

Cron stopped logging to /var/log/cron.log

A month ago I set cron to log to /var/log/cron.log by modifying /etc/rsyslog.d/50-default.conf. Logging worked great until I changed permissions on /var/log (by easing permission restrictions), and ...
10
votes
2answers
17k views

rsyslog not logging

This is an odd issue. I was testing the chrony/ntp services on a RHEL7 VM and was resetting its time as well as the host's. Once I was satisfied with it I checked /var/log/messages and realized it ...
0
votes
3answers
117 views

Puppet doesn't ignore whitespace

I have an entry that may or may not appear in /etc/rsyslog.conf: # Added for Kiwi *.err;*.emerg;*.alert;*.warning;*.debug;*.notice;*.crit;*.info @10.19.24.50 Since some of these servers ...
0
votes
3answers
44 views

Are symlinks in sync with the parent file all the time?

I have a log file which is having a ownership for only root. This file consists of active incoming logs & is continuously updated any time. I need to create a symlink for this file and change the ...
2
votes
1answer
98 views

systemd, rsyslogd - where are the logs?

I got a Fedora 23 Server edition installation which I have done pretty much nothing with admin-wise besides setting up ssh, fail2ban, samba, and users. The other day I was completely locked out of my ...
0
votes
0answers
22 views

Testing OpenSSH Logging

I'm attempting to turn on logging inside OpenSSH running in an Alpine Docker container. I made sure to install rsyslog and start the daemon with /usr/sbin/rsyslogd. My sshd logging settings are as ...
1
vote
0answers
108 views

Rsyslog not creating log files

I'm hardening an Ubuntu 14.04 VM to CIS standards and am having a problems getting rsyslog to create the necessary files. Note: I'm getting better with Linux but I'm no master yet, please excuse any ...
2
votes
2answers
914 views

rsyslog: how to bind rulesets to unix sockets (imuxsock)

I'm using the imuxsock module to listen to additional local log sockets (i.e., with the $AddUnixListenSocket directive). After reading the awesome http://www.rsyslog.com/doc/multi_ruleset.html page, ...
1
vote
0answers
30 views

Rsyslog to use hostname instead of leftmost FQDN label

I have an Ubuntu 15.10 configuration in which /etc/hostname reads projectname-environmentname and /etc/hosts reads 127.0.0.1 localhost 127.0.1.1 environmentname.projectname.tld projectname-...
3
votes
1answer
760 views

Prevent rsyslog from logging remote hosts messages to local /var/log/syslog

I use rsyslog to save logs from remote hosts to a server this way: Server: # Logfile for each host $template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log" *.* -?DynaFile Clients: *.* @servername ...
0
votes
0answers
64 views

Not receving tomcat logs on rsyslog sever

We have configured the rsyslogs server for tomcat8 the using the log4j. Here is our tomcat log4j.properties configuration file, but we are not receiving the logs on rsyslog server. Tomcat version 8....
1
vote
1answer
13 views

About redirect log in rsyslog.conf

what is the difference between this 2 lines: mail.warn -/var/log/mail.warn mail.err /var/log/mail.err (with and without the -) and who i redirect a syslog msg from a host to a ...
1
vote
1answer
60 views

Changing the Facility of outgoing syslog message using rsyslog configuration

I need to change the facility of the syslog message going out to a remote syslog server. I am using rsyslog in my system. I am using the following configuration to forward logs to another syslog ...
0
votes
0answers
68 views

/var/log/secure and other log files are empty even after restarting rsyslog.service

I am running a Centos7 server with rsyslog for logging. The service is on (sudo systemctl is-enabled rsyslog) outputs "enabled". I have also configured the service to start at boot-time. However, ...
0
votes
1answer
89 views

How can I use part of match in Regex to generate filename of action?

I am using CentOS6.5 that include rsyslogd v5.8.10 There are 20 process program in my server.I want to receive logs use rsyslogd and hope to store in different log file according identity of process ...
0
votes
0answers
20 views

Handling tab delimited records in rsyslogd

I want to receive tab delimited records via a specific syslog facility. What lines would I need to add to my rsyslogd.conf to log all local0.* messages to a file, while passing through the tab ...
2
votes
1answer
275 views

How to explain strange kernel messages?

I have a server running on Debian Wheezy 3.2.68-1+deb7u1 x86_64. Lately strange records in /var/log/messages appeared. First messages of this log starts just after server reboot. 6.222.18 LEN=44 TOS=...
2
votes
2answers
395 views

How to configure logging inside a Docker container?

I was trying to dockerize (into Debian 8.2) an OpenVPN server (yes, I do know, there already are such containers) but something went wrong inside the container and the server failed to start. I ...
1
vote
0answers
306 views

how to have syslog not log particular warnings?

Short Version: I want to stop the following message from appearing in my syslog. They pertain to a USB port on my keyboard that can be ignored: Feb 9 23:33:45 sunfire kernel: [ 8163.156041] usb 3-6....
4
votes
4answers
1k views

rsyslog: execute script on matching log event

I have the following line in my /etc/rsyslog.conf :programname, contains, "suhosin" /var/log/suhosin.log which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I ...
0
votes
0answers
19 views

Rsyslog not creating dynamic directories

I have Red Hat Enterprise Linux Server release 6.5 running rsyslogd 5.8.10 I'm trying to collect logs from a remote client (VM1) and I have the following line configured if $inputname == 'imudp' ...
1
vote
0answers
39 views

Loggin apt history to syslog

I have a centralized log management server (graylog) and I want to be able to see the installed/updated/removed packages from a couple of ubuntu serveres there is running. But is there anyway to ...