rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

3
votes
1answer
761 views

Prevent rsyslog from logging remote hosts messages to local /var/log/syslog

I use rsyslog to save logs from remote hosts to a server this way: Server: # Logfile for each host $template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log" *.* -?DynaFile Clients: *.* @servername ...
3
votes
0answers
2k views

Why does rsyslogd not honor the following lines in rsyslog.d

This is somewhat related to my previous question here. I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf: 00-iptables.conf 50-default.conf postfix.conf The first one ...
3
votes
0answers
1k views

Seagate external hard disk creating problems

I've bought a new hard disk, a Seagate (Backup Plus), but I'm having problems with it. Firstly, it doesn't mounts every time I plug it in. In such cases, I've got to restart the machine to work with ...
2
votes
0answers
154 views

Restart rsyslog after ntp time sync

I want to ensure that the logs written, have the correct timestamp. So, when ntpd completes the sync (ntpq -c rv displays sync_ntp), I want to restart rsyslogd. But I am not finding any hooks/config ...
2
votes
0answers
328 views

Extract particular words from Rsyslog %msg% facility

After lot of search on Google and reading all manuals available on man page and internet, I finally ask here. In my scenario, I have one rsyslog server working with mysql and a custom template ...
2
votes
0answers
104 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
0answers
357 views

Logwatch ignores self-defined service, but explicit setting --service $service works

I am using SSLH on my server to accept both SSL and SSH connections on Port 443. As the logs of sshd and apache2 show each incoming connection via SSLH originating from 127.0.0.1, I want to add the ...
2
votes
0answers
151 views

Nested filtering in rsyslogd

I'm using rsyslogd and trying to figure out why things like if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/bla2app work just fine, but if $hostname startswith 'd....
1
vote
0answers
30 views

rsyslog is still sending messages to omusrmsg even after using `stop` command

I have the following lines in the 50-default.conf file (in /etc/rsyslog.d): local0.emerg stop *.emerg :omusrmsg:* But all local0 messages are still being sent to every user logged ...
1
vote
0answers
47 views

fail to log from my app through rsyslogd in a linux container

Running an archlinux container on an archlinux host, both using rsyslog with the same configuration file: $ cat /etc/rsyslog.conf # Minimal config $ModLoad imuxsock # provides support for local ...
1
vote
0answers
22 views

Raspberry pi blocks completely after multiple reboots

I have a c++ program running on login on the raspberry pi, this program checks data for multiple devices attached on to it (Arduino Mega 2560 + Modbus RS485), gets inputted data from them and sends ...
1
vote
0answers
111 views

Rsyslog not creating log files

I'm hardening an Ubuntu 14.04 VM to CIS standards and am having a problems getting rsyslog to create the necessary files. Note: I'm getting better with Linux but I'm no master yet, please excuse any ...
1
vote
0answers
30 views

Rsyslog to use hostname instead of leftmost FQDN label

I have an Ubuntu 15.10 configuration in which /etc/hostname reads projectname-environmentname and /etc/hosts reads 127.0.0.1 localhost 127.0.1.1 environmentname.projectname.tld projectname-...
1
vote
0answers
311 views

how to have syslog not log particular warnings?

Short Version: I want to stop the following message from appearing in my syslog. They pertain to a USB port on my keyboard that can be ignored: Feb 9 23:33:45 sunfire kernel: [ 8163.156041] usb 3-6....
1
vote
0answers
39 views

Loggin apt history to syslog

I have a centralized log management server (graylog) and I want to be able to see the installed/updated/removed packages from a couple of ubuntu serveres there is running. But is there anyway to ...
1
vote
0answers
117 views

rsyslogd eating up 20+ GB (!) of RAM - what evidence to gather?

I have a Ubuntu 14.04.3 box running kernel 3.13.0-74 with 32GB RAM, which features a rsyslogd process gone mad: $ ps -auxww | grep rsyslog syslog 16212 0.7 64.0 27966168 21070336 ? Ssl Jan04 ...
1
vote
0answers
18 views

rsyslog — devices have same hostname and pub ip

I'm working on a remote logging setup for some cellular devices that are on a carrier's private network. I have it set up to pass syslogs from the cellular devices to a publicly available server. My ...
1
vote
0answers
23 views

Suppress Rsyslog to terminal

When I use Rsyslog (in bash using logger and in Node using winston-syslog), all log levels are also shown on the terminal window. I only want to log these events, and silent the output unless they ...
1
vote
0answers
107 views

How to save logs from remote clients to a different file?

I have the below changes in the rsyslog.conf ################# #### MODULES #### ################# $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel ...
1
vote
0answers
206 views

Where do these boot log entries come from and who creates them?

I'm wondering what kind of code writes these first two lines into /var/log/syslog while booting my machine: Aug 4 10:13:48 HOSTNAME kernel: imklog 5.8.11, log source = /proc/kmsg started. Aug 4 10:...
1
vote
0answers
209 views

Can rsyslogd write to more than one named pipe

If I have the following two lines in the rsyslogd.conf *.* |/var/run/rsyslog/pipe1 *.* |/var/run/rsyslog/pipe2 Will all messages be sent to both pipes? I have two programs that want to inspect ...
1
vote
0answers
159 views

rsyslog and netsnmp support for Linux namespaces

I have configured different net namespaces (netns) on my linux machine (Ubuntu) with different routes in each. Now, if I want rsyslog and SNMP traps (netsnmp) to use one of the route from these ...
1
vote
0answers
153 views

Generating Email alert for events in system log

How to generate email alert for every critical event logged in system log /var/log/messages. Suppose, for the following log message, I want an email alert to be generated. Oct 24 11:17:42 eforms ...
1
vote
0answers
316 views

Changing the date format of auth.log

I was looking to change the date format in which auth.log logs information. I could not find a way to do it. Is there a method to do this? My system uses rsyslog.
1
vote
0answers
338 views

really basic bootstrap logger - (preferably syslog, cascade to http/raw)

I have a bootstrap shell script that is run as the very first thing when a fresh Linux server is booted up to multi-user mode with networking. Once it is complete, I would like to report the error ...
0
votes
0answers
17 views

How to forward a log file in Kali linux which is in /var/log/MyLog.log using RSYSLOG?

I have setup 2 Kali Linux machines. "Machine 1" is forwarding all the logs to "Machine 2", in /var/log/MyLog.log file. For this I have used, File: Machine 1 /etc/rsyslog.conf: \*.* @192.168.30.140:...
0
votes
0answers
17 views

rsyslog forward all facilities but one

I have a rsyslog client, version 5.8 on centos 6 successfully forwarding log messages to a remote host. Now I have added some local files to the local3 facility, and I want to exclude this facility ...
0
votes
0answers
18 views

How to redirect kernel: lockd: messages to another file from syslog.conf

I do not understand the syntax in syslog.conf for redirecting the following kind of messages (kernel: lockd: ): Jun 13 11:53:43 myserver kernel: lockd: cannot monitor 192.254.223.233 I believe ...
0
votes
0answers
39 views

rsyslog remote logging capturing local messages

We have setup a RHEL 6 server to capture syslogs from remote hosts. Although its working and I am capturing the logs, all of the local system logs are being directed into the remote log directory ...
0
votes
0answers
17 views

rsyslog: how to log to one of multiple log servers

I have a server that generates a lot of log content (single log file), and want to send it out to say 4 backends. I do not want all entries to be duplicated to every backend, but, say, rotate among ...
0
votes
0answers
18 views

How to force rsyslog ommysql use UTF8?

I'm using ommysql in rsyslog for transferring data into MySQL $ModLoad ommysql local6.* :ommysql:localhost,Syslog,rsyslog,1 but Cyrillic data goes like "·Ð¾Ð²Ð°Ð½Ð¸Ðµ иÑ�точнÐ" in ...
0
votes
0answers
10 views

How are rsyslog action numbered?

My log shows that one of my rsyslog actions was not handled: May 28 10:22:02 rpi1 rsyslogd-2007: action 'action 18' suspended, next retry is Sat May 28 10:23:32 2016 [try http://www.rsyslog.com/e/...
0
votes
0answers
23 views

rsyslog doesn't collect logs

I have configured HP 5120 switch to send messages to syslog server: info-center loghost 10.10.84.111 facility local4 on my debian rsyslogd 5.8.11 modified/etc/syslog.conffile: uncommented$...
0
votes
0answers
22 views

Testing OpenSSH Logging

I'm attempting to turn on logging inside OpenSSH running in an Alpine Docker container. I made sure to install rsyslog and start the daemon with /usr/sbin/rsyslogd. My sshd logging settings are as ...
0
votes
0answers
64 views

Not receving tomcat logs on rsyslog sever

We have configured the rsyslogs server for tomcat8 the using the log4j. Here is our tomcat log4j.properties configuration file, but we are not receiving the logs on rsyslog server. Tomcat version 8....
0
votes
0answers
68 views

/var/log/secure and other log files are empty even after restarting rsyslog.service

I am running a Centos7 server with rsyslog for logging. The service is on (sudo systemctl is-enabled rsyslog) outputs "enabled". I have also configured the service to start at boot-time. However, ...
0
votes
0answers
20 views

Handling tab delimited records in rsyslogd

I want to receive tab delimited records via a specific syslog facility. What lines would I need to add to my rsyslogd.conf to log all local0.* messages to a file, while passing through the tab ...
0
votes
0answers
19 views

Rsyslog not creating dynamic directories

I have Red Hat Enterprise Linux Server release 6.5 running rsyslogd 5.8.10 I'm trying to collect logs from a remote client (VM1) and I have the following line configured if $inputname == 'imudp' ...
0
votes
0answers
16 views

How can I query rsyslog settings?

I am using rsyslog for program logging and system logging so I have unified log files. I'm having some messages dropping out and I'm not sure why, but I think it may be a configuration option set ...
0
votes
0answers
33 views

extra rsyslog conf works if I restart rsyslog but not at boot

I'm on ubuntu and trying to get rid of a bunch of extra crap that Avahi puts in the system logs (/var/log/syslog). My understanding is that things in /etc/rsyslogd are loaded into the rsyslog config, ...
0
votes
0answers
101 views

Syslog stopped logging after using journalctl

Today I was configuring some things in my VPS running CentOS 7, and checked /var/log/secure several times without noticing any problems.Later I used journalctl to look for some cron logs, and now it ...
0
votes
0answers
78 views

rsyslog not working

I have been trying to start the rsyslog service on centos 7 but I wont work. Please see te configuration file- # rsyslog configuration file # For more information see /usr/share/doc/rsyslog-*/...
0
votes
0answers
48 views

rsyslog , change facility of sending host in remote logging

Is there a way to set a facility for sending host in rsyslog remote logging? All facilities in sending host as one facility in receiving host. like cisco when saying logging trap FACILITY_NUM. ...
0
votes
0answers
77 views

Execute command to get value in rsyslog.conf template parameter

I want to get value of template parameter via command.like below:- $template precise,",%syslogpriority%,host_ip=%fromhost-ip%,|%syslogfacility% |,%timegenerated%,hostname=%HOSTNAME%,%syslogtag%,%msg%\...
0
votes
0answers
53 views

rsyslog treats message string as the source hostname

Sample device kernel logs sent across the wire to rsyslog server- 2015-08-27T09:43:53.141273+00:00 console [netcon0] enabled 2015-08-27T11:26:39.658558+00:00 console [netcon0] enabled 2015-08-27T10:...
0
votes
0answers
168 views

RSyslog Log Rotation using rsyslog.conf

I'm using the rsyslog to rotate logs and it stopped working. Not sure where it went wrong. This was working and now it stopped... rsyslog.conf $outchannel log_rotation,/var/log/syslog.log,1024000,/...
0
votes
0answers
100 views

rsyslog problem

I'm trying to execute this 3 commands into rsyslog: IFS=':' read -a trap <<< "${msg}" IFS='#' read -a trap2 <<< "${trap[11]}" if $trap2 > 300 then ^/pruebas/script.sh But when ...
0
votes
0answers
15 views

rsyslogd taking up all my drive space, only when the service is started

I have configured rsyslogd to write log files to an external drive. When the service is not started, but the drive is mounted, my disk utilization (by df) is low. As soon as I start rsyslogd, the ...
0
votes
0answers
209 views

Stopping syslogd also closes /dev/log UNIX domain socket

I am working on a project and from some testing I found out that stopping syslogd daemon also closes /dev/log socket. Is there some other way so that even if syslogd is down, /dev/log socket still ...
0
votes
0answers
598 views

Seeing SSH debug messages in Terminal/console

I am seeing "debug3: Received SSH2_MSG_IGNORE" appear in the terminal on a RHEL 6 Linux server. I thought maybe rsyslog had a console entry, but it doesn't. sshd_config has logging at AUTHPRIV, and ...