rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

3
votes
1answer
3k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
2
votes
1answer
449 views

rsyslogd only logs from remote servers after enabling UDP:514 on Debian

I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance ...
1
vote
1answer
39 views

problem with rsyslog filters

I have to make a rule in rsyslog.conf file in order to get the mail logs which at least notice priority but with exception of err priority to a certain path. Here is the rule I tried to make for ...
1
vote
1answer
32 views

rsyslog use different templates to store logs

I am using rsyslog to handle the logs that my program creates. I have used a template to customize the logs format. My doubts are: If I create a template, every program that use that rsyslog.conf ...
1
vote
1answer
112 views

What' the difference between /var/log and -/var/log in rsyslog.conf on RPi B?

I've noticed in my /etc/rsyslog.conf file that some destination got that symbol "-" in front of it. For example: mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err ...
1
vote
1answer
393 views

logrotate custom “rotate” action equivalent for upstart?

In lots of online posts regarding how to rotate your iptables log files, for example here rsyslog config files get reloaded by the postrotate option of logrotate, presumably in order to stop rsyslog ...
0
votes
1answer
54 views

How to send Ossec alerts to Syslog server

I want ossec server to send alerts to Syslog server. Now in this case Ossec Server and RSyslog Server are on same server. I want Ossec Server to send all the alerts from client to location ...
0
votes
1answer
17 views

How to customize Shorewall firewall logs

I am using Fedora 13 machine with shorewall installed. shorewall 4.6.6-RC1 iptables v1.4.7 Below is log format by shorewall: Oct 23 05:28:17 localhost kernel: shorewall:LAN-LAN:ACCEPT:IN= OUT=lo ...
0
votes
1answer
22 views

rsyslogd used with any application or only Linux system logging?

Is the purpose of rsyslogd to handle logging of applications in userspace? For example i have 5 Jboss instances running on a server with custum applications running inside them. They all produce there ...
0
votes
1answer
54 views

rsyslog adding unwanted text to outbound log data

I'm using rsyslog to send access & error log data to a remote server. The interface is in place, but I'm getting an extra bit of text in the outbound log data that isn't included in ...
0
votes
1answer
51 views

What can cause auth.log to start over again?

In my Raspberry Pi running Debian, I have a simple script to output the IPs which have successfully logged into the system via SSH. It's like this: #!/bin/bash egrep 'Accepted password|Accepted ...
4
votes
0answers
142 views

Logging apt/dpkg activity to syslog

My goal is to log apt/dpkg activity using syslog (rsyslog), so that log entries are sent to central syslog server. dpkg writes to /var/log/dpkg.log, apt writes to /var/log/apt directory. I did some ...
3
votes
0answers
548 views

Prevent rsyslog from logging remote hosts messages to local /var/log/syslog

I use rsyslog to save logs from remote hosts to a server this way: Server: # Logfile for each host $template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log" *.* -?DynaFile Clients: *.* @servername ...
3
votes
0answers
2k views

Why does rsyslogd not honor the following lines in rsyslog.d

This is somewhat related to my previous question here. I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf: 00-iptables.conf 50-default.conf postfix.conf The first one ...
3
votes
0answers
1k views

Seagate external hard disk creating problems

I've bought a new hard disk, a Seagate (Backup Plus), but I'm having problems with it. Firstly, it doesn't mounts every time I plug it in. In such cases, I've got to restart the machine to work with ...
2
votes
0answers
181 views

How to explain strange kernel messages?

I have a server running on Debian Wheezy 3.2.68-1+deb7u1 x86_64. Lately strange records in /var/log/messages appeared. First messages of this log starts just after server reboot. 6.222.18 LEN=44 ...
2
votes
0answers
116 views

Restart rsyslog after ntp time sync

I want to ensure that the logs written, have the correct timestamp. So, when ntpd completes the sync (ntpq -c rv displays sync_ntp), I want to restart rsyslogd. But I am not finding any hooks/config ...
2
votes
0answers
275 views

Extract particular words from Rsyslog %msg% facility

After lot of search on Google and reading all manuals available on man page and internet, I finally ask here. In my scenario, I have one rsyslog server working with mysql and a custom template ...
2
votes
0answers
98 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
0answers
327 views

Logwatch ignores self-defined service, but explicit setting --service $service works

I am using SSLH on my server to accept both SSL and SSH connections on Port 443. As the logs of sshd and apache2 show each incoming connection via SSLH originating from 127.0.0.1, I want to add the ...
2
votes
0answers
135 views

Nested filtering in rsyslogd

I'm using rsyslogd and trying to figure out why things like if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/bla2app work just fine, but if $hostname startswith ...
1
vote
0answers
9 views

Loggin apt history to syslog

I have a centralized log management server (graylog) and I want to be able to see the installed/updated/removed packages from a couple of ubuntu serveres there is running. But is there anyway to ...
1
vote
0answers
25 views

rsyslogd eating up 20+ GB (!) of RAM - what evidence to gather?

I have a Ubuntu 14.04.3 box running kernel 3.13.0-74 with 32GB RAM, which features a rsyslogd process gone mad: $ ps -auxww | grep rsyslog syslog 16212 0.7 64.0 27966168 21070336 ? Ssl Jan04 ...
1
vote
0answers
14 views

rsyslog — devices have same hostname and pub ip

I'm working on a remote logging setup for some cellular devices that are on a carrier's private network. I have it set up to pass syslogs from the cellular devices to a publicly available server. My ...
1
vote
0answers
19 views

Suppress Rsyslog to terminal

When I use Rsyslog (in bash using logger and in Node using winston-syslog), all log levels are also shown on the terminal window. I only want to log these events, and silent the output unless they ...
1
vote
0answers
59 views

How to save logs from remote clients to a different file?

I have the below changes in the rsyslog.conf ################# #### MODULES #### ################# $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel ...
1
vote
0answers
73 views

Where do these boot log entries come from and who creates them?

I'm wondering what kind of code writes these first two lines into /var/log/syslog while booting my machine: Aug 4 10:13:48 HOSTNAME kernel: imklog 5.8.11, log source = /proc/kmsg started. Aug 4 ...
1
vote
0answers
154 views

Can rsyslogd write to more than one named pipe

If I have the following two lines in the rsyslogd.conf *.* |/var/run/rsyslog/pipe1 *.* |/var/run/rsyslog/pipe2 Will all messages be sent to both pipes? I have two programs that want to inspect ...
1
vote
0answers
127 views

rsyslog and netsnmp support for Linux namespaces

I have configured different net namespaces (netns) on my linux machine (Ubuntu) with different routes in each. Now, if I want rsyslog and SNMP traps (netsnmp) to use one of the route from these ...
1
vote
0answers
122 views

Generating Email alert for events in system log

How to generate email alert for every critical event logged in system log /var/log/messages. Suppose, for the following log message, I want an email alert to be generated. Oct 24 11:17:42 eforms ...
1
vote
0answers
236 views

Changing the date format of auth.log

I was looking to change the date format in which auth.log logs information. I could not find a way to do it. Is there a method to do this? My system uses rsyslog.
1
vote
0answers
327 views

really basic bootstrap logger - (preferably syslog, cascade to http/raw)

I have a bootstrap shell script that is run as the very first thing when a fresh Linux server is booted up to multi-user mode with networking. Once it is complete, I would like to report the error ...
0
votes
0answers
8 views

Rsyslog not creating dynamic directories

I have Red Hat Enterprise Linux Server release 6.5 running rsyslogd 5.8.10 I'm trying to collect logs from a remote client (VM1) and I have the following line configured if $inputname == 'imudp' ...
0
votes
0answers
6 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
0
votes
0answers
9 views

extra rsyslog conf works if I restart rsyslog but not at boot

I'm on ubuntu and trying to get rid of a bunch of extra crap that Avahi puts in the system logs (/var/log/syslog). My understanding is that things in /etc/rsyslogd are loaded into the rsyslog config, ...
0
votes
0answers
29 views

Syslog stopped logging after using journalctl

Today I was configuring some things in my VPS running CentOS 7, and checked /var/log/secure several times without noticing any problems.Later I used journalctl to look for some cron logs, and now it ...
0
votes
0answers
27 views

rsyslog not working

I have been trying to start the rsyslog service on centos 7 but I wont work. Please see te configuration file- # rsyslog configuration file # For more information see ...
0
votes
0answers
26 views

rsyslog , change facility of sending host in remote logging

Is there a way to set a facility for sending host in rsyslog remote logging? All facilities in sending host as one facility in receiving host. like cisco when saying logging trap FACILITY_NUM. ...
0
votes
0answers
39 views

Execute command to get value in rsyslog.conf template parameter

I want to get value of template parameter via command.like below:- $template precise,",%syslogpriority%,host_ip=%fromhost-ip%,|%syslogfacility% ...
0
votes
0answers
36 views

rsyslog treats message string as the source hostname

Sample device kernel logs sent across the wire to rsyslog server- 2015-08-27T09:43:53.141273+00:00 console [netcon0] enabled 2015-08-27T11:26:39.658558+00:00 console [netcon0] enabled ...
0
votes
0answers
1k views

Tomcat 7 not producing log output to catalina.out on RHEL7

I have a RHEL7 server with Apache Tomcat 7.0 installed and after a recent update to RHEL7.1 all of the logging to ${catalina.base}/logs/catalina.out was stopped. However i am receiving the logs inside ...
0
votes
0answers
107 views

RSyslog Log Rotation using rsyslog.conf

I'm using the rsyslog to rotate logs and it stopped working. Not sure where it went wrong. This was working and now it stopped... rsyslog.conf $outchannel ...
0
votes
0answers
52 views

rsyslog problem

I'm trying to execute this 3 commands into rsyslog: IFS=':' read -a trap <<< "${msg}" IFS='#' read -a trap2 <<< "${trap[11]}" if $trap2 > 300 then ^/pruebas/script.sh But when ...
0
votes
0answers
14 views

rsyslogd taking up all my drive space, only when the service is started

I have configured rsyslogd to write log files to an external drive. When the service is not started, but the drive is mounted, my disk utilization (by df) is low. As soon as I start rsyslogd, the ...
0
votes
0answers
46 views

Why rsyslog leaves the last file in spool directory

Suppose I am using a rsyslog remote server (R1) & have a client box (C1). C1 is configured to sync up and use R1 for logging (over port 514; TCP) The spool directory is '/var/log/rsyslog'. Now, ...
0
votes
0answers
31 views

Lightdm and rsyslogd intermittenly consuming 50% of CPU

I'm running Cubieboard3 (CubieTruck) mini pc thats runs Cubian (a derivative of Debian). Sometimes after booting up the CPU got consumed by almost 50%. When I ran top these two processes are ...
0
votes
0answers
132 views

Rsyslog logs retransmitted after log rotation

I have config setup on all my CentOS servers to forward all syslog messages to a Graylog server via rsyslog. In Graylog I have then configured streams to alert on the occurrence of certain message ...
0
votes
0answers
74 views

Equivalent to syslog-ng program-override option for rsyslog

I would like to know what is the rsyslog equivalent to the program-override option in syslog-ng?
0
votes
0answers
174 views

Stopping syslogd also closes /dev/log UNIX domain socket

I am working on a project and from some testing I found out that stopping syslogd daemon also closes /dev/log socket. Is there some other way so that even if syslogd is down, /dev/log socket still ...
0
votes
0answers
407 views

Seeing SSH debug messages in Terminal/console

I am seeing "debug3: Received SSH2_MSG_IGNORE" appear in the terminal on a RHEL 6 Linux server. I thought maybe rsyslog had a console entry, but it doesn't. sshd_config has logging at AUTHPRIV, and ...