rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

0
votes
1answer
19 views

Cron stopped logging to /var/log/cron.log

A month ago I set cron to log to /var/log/cron.log by modifying /etc/rsyslog.d/50-default.conf. Logging worked great until I changed permissions on /var/log (by easing permission restrictions), and ...
0
votes
2answers
2k views

Tomcat 7 not producing log output to catalina.out on RHEL7

I have a RHEL7 server with Apache Tomcat 7.0 installed and after a recent update to RHEL7.1 all of the logging to ${catalina.base}/logs/catalina.out was stopped. However i am receiving the logs inside ...
6
votes
2answers
14k views

rsyslog not logging

This is an odd issue. I was testing the chrony/ntp services on a RHEL7 VM and was resetting its time as well as the host's. Once I was satisfied with it I checked /var/log/messages and realized it ...
0
votes
1answer
1k views

How do I get debug information from rsyslog?

I followed the directions from: http://www.rsyslog.com/doc/debug.html I put the following in /etc/rsyslog.conf: $DebugLevel 2 $DebugFile /root/RSYSLOG.txt then I try: kill -USR1 `cat ...
0
votes
3answers
89 views

Puppet doesn't ignore whitespace

I have an entry that may or may not appear in /etc/rsyslog.conf: # Added for Kiwi *.err;*.emerg;*.alert;*.warning;*.debug;*.notice;*.crit;*.info @10.19.24.50 Since some of these servers ...
0
votes
3answers
38 views

Are symlinks in sync with the parent file all the time?

I have a log file which is having a ownership for only root. This file consists of active incoming logs & is continuously updated any time. I need to create a symlink for this file and change the ...
1
vote
1answer
40 views

systemd, rsyslogd - where are the logs?

I got a Fedora 23 Server edition installation which I have done pretty much nothing with admin-wise besides setting up ssh, fail2ban, samba, and users. The other day I was completely locked out of my ...
0
votes
0answers
14 views

Testing OpenSSH Logging

I'm attempting to turn on logging inside OpenSSH running in an Alpine Docker container. I made sure to install rsyslog and start the daemon with /usr/sbin/rsyslogd. My sshd logging settings are as ...
1
vote
0answers
41 views

Rsyslog not creating log files

I'm hardening an Ubuntu 14.04 VM to CIS standards and am having a problems getting rsyslog to create the necessary files. Note: I'm getting better with Linux but I'm no master yet, please excuse any ...
0
votes
0answers
14 views

Sending log files from FreeBSD client running syslogd to Linux server running rsyslog

Has anyone successfully attempted writing syslog log files directly from a FreeBSD client machine running syslogd to a Linux (RHEL) server running rsyslog over the wire? I see different information ...
2
votes
2answers
854 views

rsyslog: how to bind rulesets to unix sockets (imuxsock)

I'm using the imuxsock module to listen to additional local log sockets (i.e., with the $AddUnixListenSocket directive). After reading the awesome http://www.rsyslog.com/doc/multi_ruleset.html page, ...
1
vote
0answers
22 views

Rsyslog to use hostname instead of leftmost FQDN label

I have an Ubuntu 15.10 configuration in which /etc/hostname reads projectname-environmentname and /etc/hosts reads 127.0.0.1 localhost 127.0.1.1 environmentname.projectname.tld ...
3
votes
1answer
657 views

Prevent rsyslog from logging remote hosts messages to local /var/log/syslog

I use rsyslog to save logs from remote hosts to a server this way: Server: # Logfile for each host $template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log" *.* -?DynaFile Clients: *.* @servername ...
0
votes
0answers
32 views

Not receving tomcat logs on rsyslog sever

We have configured the rsyslogs server for tomcat8 the using the log4j. Here is our tomcat log4j.properties configuration file, but we are not receiving the logs on rsyslog server. Tomcat version ...
1
vote
1answer
11 views

About redirect log in rsyslog.conf

what is the difference between this 2 lines: mail.warn -/var/log/mail.warn mail.err /var/log/mail.err (with and without the -) and who i redirect a syslog msg from a host to a ...
1
vote
1answer
31 views

Changing the Facility of outgoing syslog message using rsyslog configuration

I need to change the facility of the syslog message going out to a remote syslog server. I am using rsyslog in my system. I am using the following configuration to forward logs to another syslog ...
0
votes
0answers
36 views

/var/log/secure and other log files are empty even after restarting rsyslog.service

I am running a Centos7 server with rsyslog for logging. The service is on (sudo systemctl is-enabled rsyslog) outputs "enabled". I have also configured the service to start at boot-time. However, ...
0
votes
1answer
43 views

How can I use part of match in Regex to generate filename of action?

I am using CentOS6.5 that include rsyslogd v5.8.10 There are 20 process program in my server.I want to receive logs use rsyslogd and hope to store in different log file according identity of process ...
0
votes
0answers
17 views

Handling tab delimited records in rsyslogd

I want to receive tab delimited records via a specific syslog facility. What lines would I need to add to my rsyslogd.conf to log all local0.* messages to a file, while passing through the tab ...
2
votes
1answer
230 views

How to explain strange kernel messages?

I have a server running on Debian Wheezy 3.2.68-1+deb7u1 x86_64. Lately strange records in /var/log/messages appeared. First messages of this log starts just after server reboot. 6.222.18 LEN=44 ...
2
votes
2answers
173 views

How to configure logging inside a Docker container?

I was trying to dockerize (into Debian 8.2) an OpenVPN server (yes, I do know, there already are such containers) but something went wrong inside the container and the server failed to start. I ...
0
votes
3answers
5k views

Add year to entries generated by rsyslogd

The default configuration of rsyslogd writes log entries in the traditional format, which looks like this: Nov 30 10:40:01 localhost CRON[30786]: pam_unix(cron:session): session closed for user list ...
1
vote
0answers
116 views

how to have syslog not log particular warnings?

Short Version: I want to stop the following message from appearing in my syslog. They pertain to a USB port on my keyboard that can be ignored: Feb 9 23:33:45 sunfire kernel: [ 8163.156041] usb ...
4
votes
4answers
963 views

rsyslog: execute script on matching log event

I have the following line in my /etc/rsyslog.conf :programname, contains, "suhosin" /var/log/suhosin.log which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I ...
0
votes
0answers
13 views

Rsyslog not creating dynamic directories

I have Red Hat Enterprise Linux Server release 6.5 running rsyslogd 5.8.10 I'm trying to collect logs from a remote client (VM1) and I have the following line configured if $inputname == 'imudp' ...
1
vote
0answers
24 views

Loggin apt history to syslog

I have a centralized log management server (graylog) and I want to be able to see the installed/updated/removed packages from a couple of ubuntu serveres there is running. But is there anyway to ...
1
vote
0answers
53 views

rsyslogd eating up 20+ GB (!) of RAM - what evidence to gather?

I have a Ubuntu 14.04.3 box running kernel 3.13.0-74 with 32GB RAM, which features a rsyslogd process gone mad: $ ps -auxww | grep rsyslog syslog 16212 0.7 64.0 27966168 21070336 ? Ssl Jan04 ...
0
votes
0answers
14 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
0
votes
0answers
21 views

extra rsyslog conf works if I restart rsyslog but not at boot

I'm on ubuntu and trying to get rid of a bunch of extra crap that Avahi puts in the system logs (/var/log/syslog). My understanding is that things in /etc/rsyslogd are loaded into the rsyslog config, ...
0
votes
0answers
70 views

Syslog stopped logging after using journalctl

Today I was configuring some things in my VPS running CentOS 7, and checked /var/log/secure several times without noticing any problems.Later I used journalctl to look for some cron logs, and now it ...
0
votes
0answers
54 views

rsyslog not working

I have been trying to start the rsyslog service on centos 7 but I wont work. Please see te configuration file- # rsyslog configuration file # For more information see ...
1
vote
2answers
48 views

Rsyslog receiving from multiple hosts and saving to different files

I want the router and AP I have in my home network to use my Raspberry Pi running Debian as a syslog server (rsyslogd 5.8.11).However, I can't find anywhere a simple guide on how to receive logs from ...
1
vote
2answers
101 views

Merging log files with different timestamp formats

I have two types of log files Standard Syslog format The timestamp looks as below 5:2015 Dec 21 07:35:06:ABC:foo1:1559: common.c:946:Enabling filter 6:2015 Dec 21 07:35:08:ABC:bar1:1461: ...
0
votes
1answer
139 views

How to set the nofile limit on rsyslog with upstart?

I'm struggling to work out how to set the open file limit on rsyslog on Ubuntu 14.04. It uses Upstart, which ignores limits.conf, but I'd expect to be able to put limit nofile 16384 16384 in ...
1
vote
0answers
15 views

rsyslog — devices have same hostname and pub ip

I'm working on a remote logging setup for some cellular devices that are on a carrier's private network. I have it set up to pass syslogs from the cellular devices to a publicly available server. My ...
5
votes
2answers
69 views

Isolate SSH Authentication Failures into Own Log File on RHEL 6.6

This may be impossible, but I've got a case where we want to log SSH authentication failures separately from standard SSH logging on a RHEL 6.6 box. I am aware we can use SyslogFacility with ...
0
votes
1answer
131 views

How to send Ossec alerts to Syslog server

I want ossec server to send alerts to Syslog server. Now in this case Ossec Server and RSyslog Server are on same server. I want Ossec Server to send all the alerts from client to location ...
1
vote
2answers
110 views

Why is syslogd not reporting messages to remote server during and just after the boot?

I configured rsyslog to send logs to a central logging server like this: *.* @@192.168.1.20 $ActionExecOnlyWhenPreviousIsSuspended on & @@192.168.1.21 & /var/log/failover ...
1
vote
1answer
97 views

rsyslogd HUPed repeatedly

Noticing that for a VM box, getting in the logs that rsyslogd process gets HUPed. Finding no ideas except a few post in some forums saying this is for logrorate. Any ideas how to fix/troubleshoot ...
1
vote
1answer
43 views

problem with rsyslog filters

I have to make a rule in rsyslog.conf file in order to get the mail logs which at least notice priority but with exception of err priority to a certain path. Here is the rule I tried to make for ...
0
votes
0answers
36 views

rsyslog , change facility of sending host in remote logging

Is there a way to set a facility for sending host in rsyslog remote logging? All facilities in sending host as one facility in receiving host. like cisco when saying logging trap FACILITY_NUM. ...
0
votes
1answer
104 views

Dynamic file name doesn't work in rsyslog

The filename in rsyslog can be either static or dynamic. The later is useful if you would automatically split messages into different files based on some message criteria. I need split logs depend on ...
0
votes
1answer
28 views

How to customize Shorewall firewall logs

I am using Fedora 13 machine with shorewall installed. shorewall 4.6.6-RC1 iptables v1.4.7 Below is log format by shorewall: Oct 23 05:28:17 localhost kernel: shorewall:LAN-LAN:ACCEPT:IN= OUT=lo ...
0
votes
1answer
596 views

don't log cron events in auth.log

In my /etc/rsyslog.conf, I have the following line to log the auth facility into /var/log/auth.log: auth,authpriv.* /var/log/auth.log but the file is flooded with cron logs, such as ...
1
vote
2answers
3k views

Rsyslog is losing messages

I am using rsyslog v5.8.11. I found this version number from what rsyslog logs on restart. I am trying to apply rate-limiting in rsyslog but it is of no use. I am still losing messages. In the ...
0
votes
1answer
160 views

rsyslog sending data to remote slows down when $AddUnixListenSocket is used?

I'm running a busy DNS server which logs queries to a remote server via rsyslog. Due to the amount of traffic we're processing I've had to increase the rate limits in rsyslog.conf. This server is ...
1
vote
1answer
55 views

rsyslog use different templates to store logs

I am using rsyslog to handle the logs that my program creates. I have used a template to customize the logs format. My doubts are: If I create a template, every program that use that rsyslog.conf ...
1
vote
1answer
264 views

Get KERN_DEBUG messages into syslog on rhel7/centos7?

I've been trying to get KERN_DEBUG messages logged to a file in centos7, but have had no luck. I can get them just fine from "dmesg," but not /var/log/messages or /var/log/dmesg Here's a MWE kernel ...
0
votes
0answers
59 views

Execute command to get value in rsyslog.conf template parameter

I want to get value of template parameter via command.like below:- $template precise,",%syslogpriority%,host_ip=%fromhost-ip%,|%syslogfacility% ...
8
votes
3answers
344 views

decrease kernel boot log verbosity level

When my kernel boots, apart from the useful important information, it prints lots of debugging info, such as .... kernel: [0.00000] BIOS-e820: [mem 0x0000000000000000-0x000000000009d3ff] usable ...