The tag has no wiki summary.

learn more… | top users | synonyms

3
votes
1answer
1k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
2
votes
1answer
86 views

rsyslogd only logs from remote servers after enabling UDP:514 on Debian

I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance ...
2
votes
1answer
676 views

How to change ssh log location from /var/log/secure to custom location in rhel 6?

By default in RHEL 6, SSH server logs are sent to /var/log/secure. I want to change this location to a custom one. Is it possible to do that? I have tried modifying the rsyslog.conf file, but it does ...
1
vote
1answer
78 views

How to redirect logs to a fifo device?

I have the following line in the rsyslog config file: *.*;auth,daemon,kern,user -/dev/logi and it does what it should, but I wanted to send some iptables logs to a different file, so I added the ...
1
vote
1answer
184 views

logrotate custom “rotate” action equivalent for upstart?

In lots of online posts regarding how to rotate your iptables log files, for example here rsyslog config files get reloaded by the postrotate option of logrotate, presumably in order to stop rsyslog ...
0
votes
1answer
19 views

Logging of what ended a process?

Due to the tight resources of the server, I suspect System will end processes from time to time. I want those events to be logged in a separate file for investigation. How do I set that in ...
0
votes
1answer
45 views

rsyslog doesnt seem to write to log file, without restart after touch'ing the file

I have a separate file for logging local7 facility, and this file is touched and permissions set, from my installer. But sometimes I see that the logs are not being written to it (after I do a ...
0
votes
1answer
26 views

filtering rsyslog log on the server side

Hi I'm trying to filter usb messages, specifically of new connections. all of my clients are configured to send to a central server their 'kern.*' log. problem is I'm getting to much "junk" logs and ...
3
votes
0answers
470 views

Why does rsyslogd not honor the following lines in rsyslog.d

This is somewhat related to my previous question here. I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf: 00-iptables.conf 50-default.conf postfix.conf The first one ...
3
votes
0answers
136 views

Extract particular words from Rsyslog %msg% facility

After lot of search on Google and reading all manuals available on man page and internet, I finally ask here. In my scenario, I have one rsyslog server working with mysql and a custom template ...
2
votes
0answers
60 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
0answers
197 views

Logwatch ignores self-defined service, but explicit setting --service $service works

I am using SSLH on my server to accept both SSL and SSH connections on Port 443. As the logs of sshd and apache2 show each incoming connection via SSLH originating from 127.0.0.1, I want to add the ...
2
votes
0answers
893 views

Seagate external hard disk creating problems

I've bought a new hard disk, a Seagate (Backup Plus), but I'm having problems with it. Firstly, it doesn't mounts every time I plug it in. In such cases, I've got to restart the machine to work with ...
1
vote
0answers
29 views

rsyslog and netsnmp support for Linux namespaces

I have configured different net namespaces (netns) on my linux machine (Ubuntu) with different routes in each. Now, if I want rsyslog and SNMP traps (netsnmp) to use one of the route from these ...
1
vote
0answers
52 views

How to suppress input overrun messages

I have a Raspberry Pi running Raspbian (a Debian flavor: Linux version 3.12-1-rpi (debian-kernel@lists.debian.org) (gcc version 4.7.2 (Debian 4.7.2-5+rpi1) ) #1 Debian 3.12.9-1+rpi1 (2014-05-19) ). ...
1
vote
0answers
18 views

Generating Email alert for events in system log

How to generate email alert for every critical event logged in system log /var/log/messages. Suppose, for the following log message, I want an email alert to be generated. Oct 24 11:17:42 eforms ...
1
vote
0answers
68 views

Get KERN_DEBUG messages into syslog on rhel7/centos7?

I've been trying to get KERN_DEBUG messages logged to a file in centos7, but have had no luck. I can get them just fine from "dmesg," but not /var/log/messages or /var/log/dmesg Here's a MWE kernel ...
1
vote
0answers
70 views

Changing the date format of auth.log

I was looking to change the date format in which auth.log logs information. I could not find a way to do it. Is there a method to do this? My system uses rsyslog.
1
vote
0answers
200 views

rsyslog && sending data to other host

Using CentOS 6.4. Problem is - that messages from kern.* facility doesn't appear on other server. Tring to send data: # logger -p kern.warning -t TEST "Test warning for remote host KERNEL" # logger ...
1
vote
0answers
87 views

Nested filtering in rsyslogd

I'm using rsyslogd and trying to figure out why things like if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/bla2app work just fine, but if $hostname startswith ...
1
vote
0answers
283 views

really basic bootstrap logger - (preferably syslog, cascade to http/raw)

I have a bootstrap shell script that is run as the very first thing when a fresh Linux server is booted up to multi-user mode with networking. Once it is complete, I would like to report the error ...
0
votes
0answers
10 views

Can rsyslogd write to more than one named pipe

If I have the following two lines in the rsyslogd.conf *.* |/var/run/rsyslog/pipe1 *.* |/var/run/rsyslog/pipe2 Will all messages be sent to both pipes? I have two programs that want to inspect ...
0
votes
0answers
45 views

rsyslog does not stream data to flume

I have a problem with Flume as it is not recognizing the events on console. My configuration file is this: ### Name the components on this agent a1.sources = r1 a1.sinks = k1 a1.channels = c1 ### ...
0
votes
0answers
16 views

How do I get debug information from rsyslog?

I followed the directions from: http://www.rsyslog.com/doc/debug.html I put the following in /etc/rsyslog.conf: $DebugLevel 2 $DebugFile /root/RSYSLOG.txt then I try: kill -USR1 `cat ...
0
votes
0answers
54 views

Stopping syslogd also closes /dev/log UNIX domain socket

I am working on a project and from some testing I found out that stopping syslogd daemon also closes /dev/log socket. Is there some other way so that even if syslogd is down, /dev/log socket still ...
0
votes
0answers
82 views

Seeing SSH debug messages in Terminal/console

I am seeing "debug3: Received SSH2_MSG_IGNORE" appear in the terminal on a RHEL 6 Linux server. I thought maybe rsyslog had a console entry, but it doesn't. sshd_config has logging at AUTHPRIV, and ...
0
votes
0answers
71 views

Send data from file to rsyslog local0 facility

Is any possibility for logger to permanently get data from file - and send it to local0 facility? Why - I want to collect all data in database. For this - I'm use rsyslog-mysql. In it - I have ...
0
votes
0answers
68 views

rsyslogd crashes while running from board.(rsyslogd -M /lib/rsyslog option is running well)

when i tried rsyslogd without any option from my board it will give following error. rsyslog runtime error(-2066): could not load module '/home/vipul_test/lib/rsyslog/lmnet.so', dlopen: ...
0
votes
0answers
209 views

Rsyslog Problem, Custom Template

I have a problem with rsyslog. bellow is my configuration ,partial. This is File Name Template: $template ...