rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

3
votes
1answer
657 views

Prevent rsyslog from logging remote hosts messages to local /var/log/syslog

I use rsyslog to save logs from remote hosts to a server this way: Server: # Logfile for each host $template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log" *.* -?DynaFile Clients: *.* @servername ...
3
votes
1answer
3k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
2
votes
1answer
230 views

How to explain strange kernel messages?

I have a server running on Debian Wheezy 3.2.68-1+deb7u1 x86_64. Lately strange records in /var/log/messages appeared. First messages of this log starts just after server reboot. 6.222.18 LEN=44 ...
2
votes
1answer
519 views

rsyslogd only logs from remote servers after enabling UDP:514 on Debian

I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance ...
1
vote
1answer
40 views

systemd, rsyslogd - where are the logs?

I got a Fedora 23 Server edition installation which I have done pretty much nothing with admin-wise besides setting up ssh, fail2ban, samba, and users. The other day I was completely locked out of my ...
1
vote
1answer
43 views

problem with rsyslog filters

I have to make a rule in rsyslog.conf file in order to get the mail logs which at least notice priority but with exception of err priority to a certain path. Here is the rule I tried to make for ...
1
vote
1answer
55 views

rsyslog use different templates to store logs

I am using rsyslog to handle the logs that my program creates. I have used a template to customize the logs format. My doubts are: If I create a template, every program that use that rsyslog.conf ...
1
vote
1answer
122 views

What' the difference between /var/log and -/var/log in rsyslog.conf on RPi B?

I've noticed in my /etc/rsyslog.conf file that some destination got that symbol "-" in front of it. For example: mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err ...
4
votes
0answers
189 views

Logging apt/dpkg activity to syslog

My goal is to log apt/dpkg activity using syslog (rsyslog), so that log entries are sent to central syslog server. dpkg writes to /var/log/dpkg.log, apt writes to /var/log/apt directory. I did some ...
3
votes
0answers
2k views

Why does rsyslogd not honor the following lines in rsyslog.d

This is somewhat related to my previous question here. I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf: 00-iptables.conf 50-default.conf postfix.conf The first one ...
3
votes
0answers
1k views

Seagate external hard disk creating problems

I've bought a new hard disk, a Seagate (Backup Plus), but I'm having problems with it. Firstly, it doesn't mounts every time I plug it in. In such cases, I've got to restart the machine to work with ...
2
votes
0answers
131 views

Restart rsyslog after ntp time sync

I want to ensure that the logs written, have the correct timestamp. So, when ntpd completes the sync (ntpq -c rv displays sync_ntp), I want to restart rsyslogd. But I am not finding any hooks/config ...
2
votes
0answers
308 views

Extract particular words from Rsyslog %msg% facility

After lot of search on Google and reading all manuals available on man page and internet, I finally ask here. In my scenario, I have one rsyslog server working with mysql and a custom template ...
2
votes
0answers
101 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
0answers
344 views

Logwatch ignores self-defined service, but explicit setting --service $service works

I am using SSLH on my server to accept both SSL and SSH connections on Port 443. As the logs of sshd and apache2 show each incoming connection via SSLH originating from 127.0.0.1, I want to add the ...
2
votes
0answers
142 views

Nested filtering in rsyslogd

I'm using rsyslogd and trying to figure out why things like if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/bla2app work just fine, but if $hostname startswith ...
1
vote
0answers
41 views

Rsyslog not creating log files

I'm hardening an Ubuntu 14.04 VM to CIS standards and am having a problems getting rsyslog to create the necessary files. Note: I'm getting better with Linux but I'm no master yet, please excuse any ...
1
vote
0answers
22 views

Rsyslog to use hostname instead of leftmost FQDN label

I have an Ubuntu 15.10 configuration in which /etc/hostname reads projectname-environmentname and /etc/hosts reads 127.0.0.1 localhost 127.0.1.1 environmentname.projectname.tld ...
1
vote
0answers
112 views

how to have syslog not log particular warnings?

Short Version: I want to stop the following message from appearing in my syslog. They pertain to a USB port on my keyboard that can be ignored: Feb 9 23:33:45 sunfire kernel: [ 8163.156041] usb ...
1
vote
0answers
24 views

Loggin apt history to syslog

I have a centralized log management server (graylog) and I want to be able to see the installed/updated/removed packages from a couple of ubuntu serveres there is running. But is there anyway to ...
1
vote
0answers
53 views

rsyslogd eating up 20+ GB (!) of RAM - what evidence to gather?

I have a Ubuntu 14.04.3 box running kernel 3.13.0-74 with 32GB RAM, which features a rsyslogd process gone mad: $ ps -auxww | grep rsyslog syslog 16212 0.7 64.0 27966168 21070336 ? Ssl Jan04 ...
1
vote
0answers
15 views

rsyslog — devices have same hostname and pub ip

I'm working on a remote logging setup for some cellular devices that are on a carrier's private network. I have it set up to pass syslogs from the cellular devices to a publicly available server. My ...
1
vote
0answers
21 views

Suppress Rsyslog to terminal

When I use Rsyslog (in bash using logger and in Node using winston-syslog), all log levels are also shown on the terminal window. I only want to log these events, and silent the output unless they ...
1
vote
0answers
89 views

How to save logs from remote clients to a different file?

I have the below changes in the rsyslog.conf ################# #### MODULES #### ################# $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel ...
1
vote
0answers
142 views

Where do these boot log entries come from and who creates them?

I'm wondering what kind of code writes these first two lines into /var/log/syslog while booting my machine: Aug 4 10:13:48 HOSTNAME kernel: imklog 5.8.11, log source = /proc/kmsg started. Aug 4 ...
1
vote
0answers
170 views

Can rsyslogd write to more than one named pipe

If I have the following two lines in the rsyslogd.conf *.* |/var/run/rsyslog/pipe1 *.* |/var/run/rsyslog/pipe2 Will all messages be sent to both pipes? I have two programs that want to inspect ...
1
vote
0answers
149 views

rsyslog and netsnmp support for Linux namespaces

I have configured different net namespaces (netns) on my linux machine (Ubuntu) with different routes in each. Now, if I want rsyslog and SNMP traps (netsnmp) to use one of the route from these ...
1
vote
0answers
138 views

Generating Email alert for events in system log

How to generate email alert for every critical event logged in system log /var/log/messages. Suppose, for the following log message, I want an email alert to be generated. Oct 24 11:17:42 eforms ...
1
vote
0answers
281 views

Changing the date format of auth.log

I was looking to change the date format in which auth.log logs information. I could not find a way to do it. Is there a method to do this? My system uses rsyslog.
1
vote
0answers
335 views

really basic bootstrap logger - (preferably syslog, cascade to http/raw)

I have a bootstrap shell script that is run as the very first thing when a fresh Linux server is booted up to multi-user mode with networking. Once it is complete, I would like to report the error ...
0
votes
0answers
14 views

Testing OpenSSH Logging

I'm attempting to turn on logging inside OpenSSH running in an Alpine Docker container. I made sure to install rsyslog and start the daemon with /usr/sbin/rsyslogd. My sshd logging settings are as ...
0
votes
0answers
14 views

Sending log files from FreeBSD client running syslogd to Linux server running rsyslog

Has anyone successfully attempted writing syslog log files directly from a FreeBSD client machine running syslogd to a Linux (RHEL) server running rsyslog over the wire? I see different information ...
0
votes
0answers
32 views

Not receving tomcat logs on rsyslog sever

We have configured the rsyslogs server for tomcat8 the using the log4j. Here is our tomcat log4j.properties configuration file, but we are not receiving the logs on rsyslog server. Tomcat version ...
0
votes
0answers
36 views

/var/log/secure and other log files are empty even after restarting rsyslog.service

I am running a Centos7 server with rsyslog for logging. The service is on (sudo systemctl is-enabled rsyslog) outputs "enabled". I have also configured the service to start at boot-time. However, ...
0
votes
0answers
17 views

Handling tab delimited records in rsyslogd

I want to receive tab delimited records via a specific syslog facility. What lines would I need to add to my rsyslogd.conf to log all local0.* messages to a file, while passing through the tab ...
0
votes
0answers
13 views

Rsyslog not creating dynamic directories

I have Red Hat Enterprise Linux Server release 6.5 running rsyslogd 5.8.10 I'm trying to collect logs from a remote client (VM1) and I have the following line configured if $inputname == 'imudp' ...
0
votes
0answers
14 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
0
votes
0answers
21 views

extra rsyslog conf works if I restart rsyslog but not at boot

I'm on ubuntu and trying to get rid of a bunch of extra crap that Avahi puts in the system logs (/var/log/syslog). My understanding is that things in /etc/rsyslogd are loaded into the rsyslog config, ...
0
votes
0answers
70 views

Syslog stopped logging after using journalctl

Today I was configuring some things in my VPS running CentOS 7, and checked /var/log/secure several times without noticing any problems.Later I used journalctl to look for some cron logs, and now it ...
0
votes
0answers
54 views

rsyslog not working

I have been trying to start the rsyslog service on centos 7 but I wont work. Please see te configuration file- # rsyslog configuration file # For more information see ...
0
votes
0answers
36 views

rsyslog , change facility of sending host in remote logging

Is there a way to set a facility for sending host in rsyslog remote logging? All facilities in sending host as one facility in receiving host. like cisco when saying logging trap FACILITY_NUM. ...
0
votes
0answers
59 views

Execute command to get value in rsyslog.conf template parameter

I want to get value of template parameter via command.like below:- $template precise,",%syslogpriority%,host_ip=%fromhost-ip%,|%syslogfacility% ...
0
votes
0answers
47 views

rsyslog treats message string as the source hostname

Sample device kernel logs sent across the wire to rsyslog server- 2015-08-27T09:43:53.141273+00:00 console [netcon0] enabled 2015-08-27T11:26:39.658558+00:00 console [netcon0] enabled ...
0
votes
0answers
138 views

RSyslog Log Rotation using rsyslog.conf

I'm using the rsyslog to rotate logs and it stopped working. Not sure where it went wrong. This was working and now it stopped... rsyslog.conf $outchannel ...
0
votes
0answers
69 views

rsyslog problem

I'm trying to execute this 3 commands into rsyslog: IFS=':' read -a trap <<< "${msg}" IFS='#' read -a trap2 <<< "${trap[11]}" if $trap2 > 300 then ^/pruebas/script.sh But when ...
0
votes
0answers
14 views

rsyslogd taking up all my drive space, only when the service is started

I have configured rsyslogd to write log files to an external drive. When the service is not started, but the drive is mounted, my disk utilization (by df) is low. As soon as I start rsyslogd, the ...
0
votes
0answers
47 views

Why rsyslog leaves the last file in spool directory

Suppose I am using a rsyslog remote server (R1) & have a client box (C1). C1 is configured to sync up and use R1 for logging (over port 514; TCP) The spool directory is '/var/log/rsyslog'. Now, ...
0
votes
0answers
33 views

Lightdm and rsyslogd intermittenly consuming 50% of CPU

I'm running Cubieboard3 (CubieTruck) mini pc thats runs Cubian (a derivative of Debian). Sometimes after booting up the CPU got consumed by almost 50%. When I ran top these two processes are ...
0
votes
0answers
194 views

Stopping syslogd also closes /dev/log UNIX domain socket

I am working on a project and from some testing I found out that stopping syslogd daemon also closes /dev/log socket. Is there some other way so that even if syslogd is down, /dev/log socket still ...
0
votes
0answers
514 views

Seeing SSH debug messages in Terminal/console

I am seeing "debug3: Received SSH2_MSG_IGNORE" appear in the terminal on a RHEL 6 Linux server. I thought maybe rsyslog had a console entry, but it doesn't. sshd_config has logging at AUTHPRIV, and ...