rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

1
vote
1answer
11 views

Rsyslog `logger` message duplicated

I just had a problem with rsyslog's imjournal module, possibly the issue described here, whereby complications with systemd's journal cause the journal to return the same data endlessly in a ...
0
votes
1answer
36 views

how to show colors in syslog

I have a node.js server logging output to syslog. I am starting the server like this: node app.js 2>&1 | logger -t app I am using some node libraries to colorize the output (within the app ...
3
votes
1answer
2k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
0
votes
1answer
25 views

unknown facility name “local8”

I'm setting up remote logging for the first time and am able to output all httpd messages to local6. I'm getting an error, and have a general question about rsyslog. First: I tried splitting ...
2
votes
1answer
18 views

What defines the type of log data that goes into local1, local2, ect?

I'm new to remote logging with rsyslog and having looked through this page, I am unclear what each of the "locals" are used for. (EDIT - this SF question revealed a little more info) I initially set ...
0
votes
1answer
33 views

What can cause auth.log to start over again?

In my Raspberry Pi running Debian, I have a simple script to output the IPs which have successfully logged into the system via SSH. It's like this: #!/bin/bash egrep 'Accepted password|Accepted ...
0
votes
0answers
15 views

Rsyslog logs retransmitted after log rotation

I have config setup on all my CentOS servers to forward all syslog messages to a Graylog server via rsyslog. In Graylog I have then configured streams to alert on the occurrence of certain message ...
3
votes
0answers
31 views

Logging apt/dpkg activity to syslog

My goal is to log apt/dpkg activity using syslog (rsyslog), so that log entries are sent to central syslog server. dpkg writes to /var/log/dpkg.log, apt writes to /var/log/apt directory. I did some ...
2
votes
1answer
2k views

How to change ssh log location from /var/log/secure to custom location in rhel 6?

By default in RHEL 6, SSH server logs are sent to /var/log/secure. I want to change this location to a custom one. Is it possible to do that? I have tried modifying the rsyslog.conf file, but it does ...
1
vote
1answer
20 views

What' the difference between /var/log and -/var/log in rsyslog.conf on RPi B?

I've noticed in my /etc/rsyslog.conf file that some destination got that symbol "-" in front of it. For example: mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err ...
1
vote
1answer
14 views

syslog set tag from api?

I can pump messages into rsyslog with a syslogtag using the following from the command line using the -t option: myprogram | logger -t MYTAG And later filter based on that tag: :syslogtag, ...
0
votes
2answers
27 views

Save syslog from honeypot to a host virtual machine

So im making a research honeypot. The host is ubuntu 14.04. I want to store all of the logs from the honeypot ssh to the ubuntu host so the data is not lost. Does anyone know anything about this? I ...
1
vote
1answer
246 views

rsyslog && sending data to other host

Using CentOS 6.4. Problem is - that messages from kern.* facility doesn't appear on other server. Tring to send data: # logger -p kern.warning -t TEST "Test warning for remote host KERNEL" # logger ...
0
votes
0answers
19 views

rsyslog is possible to append remote messages to system logs

I'm using Debian's rsyslog=8.4.2-1 on pc and a router that sends log messages to the pc. Currently I'm using the conf below to add the incoming messages to a daily file /etc/rsyslog.d/router.conf: ...
0
votes
0answers
24 views

Equivalent to syslog-ng program-override option for rsyslog

I would like to know what is the rsyslog equivalent to the program-override option in syslog-ng?
3
votes
0answers
107 views

Prevent rsyslog from logging remote hosts messages to local /var/log/syslog

I use rsyslog to save logs from remote hosts to a server this way: Server: # Logfile for each host $template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log" *.* -?DynaFile Clients: *.* @servername ...
0
votes
1answer
93 views

How do I get debug information from rsyslog?

I followed the directions from: http://www.rsyslog.com/doc/debug.html I put the following in /etc/rsyslog.conf: $DebugLevel 2 $DebugFile /root/RSYSLOG.txt then I try: kill -USR1 `cat ...
0
votes
1answer
242 views

How to redirect logs to syslog for an application which doesn't support syslog yet?

Nginx adds logging to syslog feature in version 1.7.1. I can only get the version 1.6.2 from ppa:nginx/stable, or the version 1.4.6 from the default Ubuntu package sources. I have a common log ...
0
votes
2answers
1k views

Add year to entries generated by rsyslogd

The default configuration of rsyslogd writes log entries in the traditional format, which looks like this: Nov 30 10:40:01 localhost CRON[30786]: pam_unix(cron:session): session closed for user list ...
1
vote
0answers
52 views

Restart rsyslog after ntp time sync

I want to ensure that the logs written, have the correct timestamp. So, when ntpd completes the sync (ntpq -c rv displays sync_ntp), I want to restart rsyslogd. But I am not finding any hooks/config ...
1
vote
0answers
56 views

rsyslog and netsnmp support for Linux namespaces

I have configured different net namespaces (netns) on my linux machine (Ubuntu) with different routes in each. Now, if I want rsyslog and SNMP traps (netsnmp) to use one of the route from these ...
1
vote
1answer
1k views

log files in CentOS 7 [closed]

In CentOS 7, how can I locate and view all the system logs that tell me who tried to enter the system, who got in, what processes they contacted, what they accomplished, etc. I want to be able to ...
0
votes
0answers
45 views

Can rsyslogd write to more than one named pipe

If I have the following two lines in the rsyslogd.conf *.* |/var/run/rsyslog/pipe1 *.* |/var/run/rsyslog/pipe2 Will all messages be sent to both pipes? I have two programs that want to inspect ...
0
votes
0answers
7 views

rsyslog does not stream data to flume [duplicate]

I have a problem with Flume as it is not recognizing the events on console. My configuration file is this: ### Name the components on this agent a1.sources = r1 a1.sinks = k1 a1.channels = c1 ### ...
0
votes
0answers
162 views

rsyslog does not stream data to flume

I have a problem with Flume as it is not recognizing the events on console. My configuration file is this: ### Name the components on this agent a1.sources = r1 a1.sinks = k1 a1.channels = c1 ### ...
0
votes
1answer
37 views

Logging of what ended a process?

Due to the tight resources of the server, I suspect System will end processes from time to time. I want those events to be logged in a separate file for investigation. How do I set that in ...
1
vote
1answer
278 views

rsyslog: how do I set up remote logging?

I am simply trying to set up a remote logging system. I think my setup is correct but it fails and I can't get any messages from rsyslog to show up in the logs, so I can't find out why. My iptables ...
2
votes
1answer
285 views

rsyslogd only logs from remote servers after enabling UDP:514 on Debian

I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance ...
2
votes
1answer
403 views

How to disable systemd's “Time has been changed” message spam in /var/log/syslog on Debian jessie?

Due to combined use of Debian jessie, that uses systemd by default, and sdwdate (that uses Slow Clock Adjuster ( gh )), my system clock is frequently changed. As a result /var/log/syslog gets ...
1
vote
0answers
176 views

How to suppress input overrun messages

I have a Raspberry Pi running Raspbian (a Debian flavor: Linux version 3.12-1-rpi (debian-kernel@lists.debian.org) (gcc version 4.7.2 (Debian 4.7.2-5+rpi1) ) #1 Debian 3.12.9-1+rpi1 (2014-05-19) ). ...
1
vote
0answers
47 views

Generating Email alert for events in system log

How to generate email alert for every critical event logged in system log /var/log/messages. Suppose, for the following log message, I want an email alert to be generated. Oct 24 11:17:42 eforms ...
37
votes
1answer
6k views

How to do a `tail -f` of log rotated files?

On a long running system I usually have a terminal with $ tail -f /var/log/kern.log or something like this open. But from time to time I have to restart such command because no new messages are ...
0
votes
0answers
107 views

Stopping syslogd also closes /dev/log UNIX domain socket

I am working on a project and from some testing I found out that stopping syslogd daemon also closes /dev/log socket. Is there some other way so that even if syslogd is down, /dev/log socket still ...
1
vote
1answer
121 views

How to redirect logs to a fifo device?

I have the following line in the rsyslog config file: *.*;auth,daemon,kern,user -/dev/logi and it does what it should, but I wanted to send some iptables logs to a different file, so I added the ...
0
votes
1answer
119 views

rsyslog doesnt seem to write to log file, without restart after touch'ing the file

I have a separate file for logging local7 facility, and this file is touched and permissions set, from my installer. But sometimes I see that the logs are not being written to it (after I do a ...
1
vote
2answers
264 views

Force rsyslogd to create new file before somebody will write to it

I'm using rsyslogd 7.4.4 on Ubuntu 14.04. I've updated the configuration file /etc/rsyslog.d/30-component.conf with the following content: # provides UDP syslog reception $ModLoad imudp $UDPServerRun ...
2
votes
1answer
333 views

Installing rsyslog from source - No package 'liblogging-stdlog' found

I asked this over in AskUbuntu but have had no luck with an answer. I am doing experiments with different logging systems. At the moment I am trying to install rsyslog from source so I can make some ...
6
votes
4answers
6k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit ...
2
votes
2answers
582 views

rsyslog: make %syslogtag% equal length

I have rsyslog configured to log in the following format: $template long-iso,"%$NOW% %timereported:8:15% %syslogtag% %msg%\n" which produces logs like this one: 2013-12-14 15:59:39 ...
1
vote
0answers
124 views

Get KERN_DEBUG messages into syslog on rhel7/centos7?

I've been trying to get KERN_DEBUG messages logged to a file in centos7, but have had no luck. I can get them just fine from "dmesg," but not /var/log/messages or /var/log/dmesg Here's a MWE kernel ...
0
votes
1answer
36 views

filtering rsyslog log on the server side

Hi I'm trying to filter usb messages, specifically of new connections. all of my clients are configured to send to a central server their 'kern.*' log. problem is I'm getting to much "junk" logs and ...
0
votes
0answers
171 views

Seeing SSH debug messages in Terminal/console

I am seeing "debug3: Received SSH2_MSG_IGNORE" appear in the terminal on a RHEL 6 Linux server. I thought maybe rsyslog had a console entry, but it doesn't. sshd_config has logging at AUTHPRIV, and ...
3
votes
2answers
460 views

rsyslog: execute script on matching log event

I have the following line in my /etc/rsyslog.conf :programname, contains, "suhosin" /var/log/suhosin.log which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I ...
4
votes
3answers
1k views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
1
vote
0answers
113 views

Changing the date format of auth.log

I was looking to change the date format in which auth.log logs information. I could not find a way to do it. Is there a method to do this? My system uses rsyslog.
2
votes
2answers
2k views

rsyslog is not discarding message as it should

I have setup rsyslog to write messages from local0.* to a seperate logfile, and then discard the messages. For some reason, the logs are going to both /var/log/syslog, and the new logfile. I have ...
3
votes
1answer
155 views

Grep with spaces suddenly doesn't work

When performing a grep like: $ tail -f apilog_2014.07.09.log | grep "HELLO" | grep "99999" I get the desired output: 12:22:35 server apache2: HELLO FRIEND 99999 12:22:35 server apache2: HELLO ...
1
vote
1answer
98 views

learning to output custom rsyslogs [closed]

I've installed rsyslog. I want to log why my server is refusing to show my index page in the browser in /var/log/browser.log Should it be listening on a standard port? I can see netstat -tpan. To ...
0
votes
1answer
120 views

don't log cron events in auth.log

In my /etc/rsyslog.conf, I have following line to log auth facility into /var/log/auth.log: auth,authpriv.* /var/log/auth.log but the file is flooded with cron logs, sucgh as these: ...
1
vote
1answer
239 views

logrotate custom “rotate” action equivalent for upstart?

In lots of online posts regarding how to rotate your iptables log files, for example here rsyslog config files get reloaded by the postrotate option of logrotate, presumably in order to stop rsyslog ...