rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

learn more… | top users | synonyms

51
votes
1answer
11k views

How to do a `tail -f` of log rotated files?

On a long running system I usually have a terminal with $ tail -f /var/log/kern.log or something like this open. But from time to time I have to restart such command because no new messages are ...
19
votes
2answers
17k views

add new syslog facility

I would like to use syslog to log messages coming from my PHP based site. My question is - can I add custom facility name? I know there are predefined facilities like: auth, authpriv, cron, dæmon, ...
13
votes
1answer
5k views

Understand logging in Linux

As I understand, Linux kernel logs to /proc/kmsg file(mostly hardware-related messages) and /dev/log socket? Anywhere else? Are other applications also able to send messages to /proc/kmsg or /dev/log? ...
10
votes
2answers
3k views

Parse syslog messages into separate MySQL tables with rsyslog

Out of the box rsyslog will dump everything into the SystemEvents table within the `Syslog database (if you use the default schema provided). I would like to use a regular expression to filter inbound ...
9
votes
2answers
13k views

How to tell rsyslog to create log file if not there?

Default behaviour by rsyslog is to append traces to an existing log file. Now, I've seen (CentOs, Scientific Linux) that when rsyslog is already running, you delete the log file (e.g. the one ...
8
votes
3answers
423 views

decrease kernel boot log verbosity level

When my kernel boots, apart from the useful important information, it prints lots of debugging info, such as .... kernel: [0.00000] BIOS-e820: [mem 0x0000000000000000-0x000000000009d3ff] usable ...
8
votes
2answers
16k views

rsyslog not logging

This is an odd issue. I was testing the chrony/ntp services on a RHEL7 VM and was resetting its time as well as the host's. Once I was satisfied with it I checked /var/log/messages and realized it ...
7
votes
4answers
10k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit 5/...
6
votes
2answers
4k views

How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?

I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
6
votes
1answer
6k views

Suppress duplicate messages in rsyslog?

Is there a way to configure rsyslog to suppress identical duplicate messages? In certain situations (often hardware failures) my syslog can grow to 100 MB or more due to repeated messages every ...
5
votes
2answers
73 views

Isolate SSH Authentication Failures into Own Log File on RHEL 6.6

This may be impossible, but I've got a case where we want to log SSH authentication failures separately from standard SSH logging on a RHEL 6.6 box. I am aware we can use SyslogFacility with ...
5
votes
1answer
8k views

What does the *.*;auth,authpriv.none -/var/log/syslog line mean in rsyslog config file?

I'm trying to understand the /etc/rsyslog.conf file, but I'm missing something. For example, this is a part of the file: auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/...
5
votes
2answers
3k views

rsyslog drops messages excessively

We have a CentOS machine acting as our syslog server. I recently noticed that the machine has been dropping large numbers of syslog messages at times. We have over 250 routers and switches, as well ...
5
votes
1answer
2k views

How to check if the remote rsyslog client is running

At the moment I'm implementing the part of the monitoring system that is build around the rsyslog and auditd. I would like to include into the project a correct verification of the fact that remote ...
5
votes
1answer
291 views

logging to /dev/xconsole does not work properly

I am using rsyslog, and I want to send logs to /dev/xconsole. I have following relevant line in /etc/rsyslog.conf *.*;cron.!=info;mail.!=info |/dev/xconsole This works only partially. It looks ...
5
votes
1answer
716 views

rsyslog rule inconsistently applied

I have created a rule to redirect messages containing {FILTER} in file /etc/rsyslog.d/40-filter.conf :msg,contains,"{FILTER}" /var/log/filter.log & ~ I have edited file /etc/rsyslog.conf so it ...
5
votes
3answers
3k views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
4
votes
2answers
452 views

rsyslog - action AND action

I want to create rule to send data from facility to file AND to MySQL database. How it can realized? Only by adding second line like: syslog.* /var/log/syslog.log syslog.* ...
4
votes
1answer
1k views

How to disable systemd's “Time has been changed” message spam in /var/log/syslog on Debian jessie?

Due to combined use of Debian jessie, that uses systemd by default, and sdwdate (that uses Slow Clock Adjuster ( gh )), my system clock is frequently changed. As a result /var/log/syslog gets ...
4
votes
1answer
797 views

Preventing output to /var/log/syslog

I have rules such as: if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog and don't want to output messages that go into that log to /var/log/syslog as well. Is ...
4
votes
3answers
125 views

How to deal with a pre-packaged program not adhering to the Rule of Silence?

Concrete problem: Mailman comes with a script to synchronize mailing list subscribers from a flat file (sync_members(8)). This script does not very well adhere to the Rule of Silence. For example, ...
4
votes
1answer
205 views

Is it possible to change the priority of a message in rsyslog?

I have a very dramatic and hypocondriac program, and it likes to spew alarming messages to syslog in cases when nothing really important happens. Besides, it sends them with priority "alert", so they ...
4
votes
4answers
1k views

rsyslog: execute script on matching log event

I have the following line in my /etc/rsyslog.conf :programname, contains, "suhosin" /var/log/suhosin.log which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I ...
4
votes
1answer
637 views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
4
votes
1answer
234 views

Logging apt/dpkg activity to syslog

My goal is to log apt/dpkg activity using syslog (rsyslog), so that log entries are sent to central syslog server. dpkg writes to /var/log/dpkg.log, apt writes to /var/log/apt directory. I did some ...
3
votes
2answers
47 views

setgid sticky bit not working

I have yet another frustrating problem. I have a group of users belonging to the "testing" group. I have a folder located at /var/log/projects with the setgid bit set. This is so any new files or ...
3
votes
3answers
1k views

Start rsyslog as unprivileged user

On Debian, rsyslog runs by default as root (due to POSIX compatibility). It can drop privileges after start, but a cleaner way would be to start as a non-privileged user. Could somebody please advise, ...
3
votes
2answers
798 views

If I redirect logs using rsyslog, will dmesg be affected?

I am trying to get some logging in place and am trying to troubleshoot it and this question became relevant. I use rsyslog config files to redirect some of my logging. (Will use iptables logging ...
3
votes
1answer
613 views

Rsyslog `logger` message duplicated

I just had a problem with rsyslog's imjournal module, possibly the issue described here, whereby complications with systemd's journal cause the journal to return the same data endlessly in a ...
3
votes
1answer
546 views

Rsyslog Central Log Host

I'm moving from a syslog-ng central log host to rsyslog. I can't even seem to find syslog-ng in the CentOS repos these days. I want to filter logs by hostname and facility. Here is how I do it in ...
3
votes
1answer
935 views

rsyslog conf file problem

I'm running Fedora (F19) and my /var/log/messages is filled with info coming from avahi-daemon: stuff like: Jan 21 14:13:42 localhost avahi-daemon[554]: Invalid response packet from host 10.10.22.3. ...
3
votes
1answer
931 views

Installing rsyslog from source - No package 'liblogging-stdlog' found

I asked this over in AskUbuntu but have had no luck with an answer. I am doing experiments with different logging systems. At the moment I am trying to install rsyslog from source so I can make some ...
3
votes
1answer
289 views

Grep with spaces suddenly doesn't work

When performing a grep like: $ tail -f apilog_2014.07.09.log | grep "HELLO" | grep "99999" I get the desired output: 12:22:35 server apache2: HELLO FRIEND 99999 12:22:35 server apache2: HELLO ...
3
votes
1answer
2k views

rsyslog using short hostname

I'm using CentOS 6.5 and rsyslogd: Name : rsyslog Arch : x86_64 Version : 5.8.10 Release : 8.el6 In rsyslog.d's conf file I have: $PreserveFQDN on and $...
3
votes
1answer
728 views

Prevent rsyslog from logging remote hosts messages to local /var/log/syslog

I use rsyslog to save logs from remote hosts to a server this way: Server: # Logfile for each host $template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log" *.* -?DynaFile Clients: *.* @servername ...
3
votes
0answers
2k views

Why does rsyslogd not honor the following lines in rsyslog.d

This is somewhat related to my previous question here. I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf: 00-iptables.conf 50-default.conf postfix.conf The first one ...
3
votes
0answers
1k views

Seagate external hard disk creating problems

I've bought a new hard disk, a Seagate (Backup Plus), but I'm having problems with it. Firstly, it doesn't mounts every time I plug it in. In such cases, I've got to restart the machine to work with ...
3
votes
1answer
3k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): avc:...
2
votes
1answer
13k views

log files in CentOS 7 [closed]

In CentOS 7, how can I locate and view all the system logs that tell me who tried to enter the system, who got in, what processes they contacted, what they accomplished, etc. I want to be able to ...
2
votes
1answer
691 views

don't log cron events in auth.log

In my /etc/rsyslog.conf, I have the following line to log the auth facility into /var/log/auth.log: auth,authpriv.* /var/log/auth.log but the file is flooded with cron logs, such as these:...
2
votes
1answer
173 views

What defines the type of log data that goes into local1, local2, ect?

I'm new to remote logging with rsyslog and having looked through this page, I am unclear what each of the "locals" are used for. (EDIT - this SF question revealed a little more info) I initially set ...
2
votes
2answers
1k views

rsyslog: make %syslogtag% equal length

I have rsyslog configured to log in the following format: $template long-iso,"%$NOW% %timereported:8:15% %syslogtag% %msg%\n" which produces logs like this one: 2013-12-14 15:59:39 postfix/...
2
votes
2answers
306 views

How to configure logging inside a Docker container?

I was trying to dockerize (into Debian 8.2) an OpenVPN server (yes, I do know, there already are such containers) but something went wrong inside the container and the server failed to start. I ...
2
votes
1answer
1k views

How do I disable local syslog, and is it a good idea?

I use centralized logging with rsyslog, which means that there are dedicated logging servers which collect syslog messages from all servers. All inspections of logs are done from those logging ...
2
votes
1answer
5k views

How to change ssh log location from /var/log/secure to custom location in rhel 6?

By default in RHEL 6, SSH server logs are sent to /var/log/secure. I want to change this location to a custom one. Is it possible to do that? I have tried modifying the rsyslog.conf file, but it does ...
2
votes
1answer
846 views

Syslog TLS Compression and Message Buffering

Where I work, we have a site-to-site VPN tunnel set up between our main data center and a third party data center that does some Oracle PaaS for us. Since they charge per-VM, we're monitoring the ...
2
votes
1answer
640 views

Where does rsyslog keep facility local0?

I added to rsyslog.conf a lines ModLoad imudp UDPServerRun 514 local0.* /var/log/dlink.log With tcpdump I can see the packets from dlink somethimes local0 somethimes local1 even local2. Nothing ...
2
votes
2answers
898 views

rsyslog: how to bind rulesets to unix sockets (imuxsock)

I'm using the imuxsock module to listen to additional local log sockets (i.e., with the $AddUnixListenSocket directive). After reading the awesome http://www.rsyslog.com/doc/multi_ruleset.html page, ...
2
votes
2answers
2k views

rsyslog is not discarding message as it should

I have setup rsyslog to write messages from local0.* to a seperate logfile, and then discard the messages. For some reason, the logs are going to both /var/log/syslog, and the new logfile. I have ...
2
votes
1answer
81 views

systemd, rsyslogd - where are the logs?

I got a Fedora 23 Server edition installation which I have done pretty much nothing with admin-wise besides setting up ssh, fail2ban, samba, and users. The other day I was completely locked out of my ...