The tag has no wiki summary.

learn more… | top users | synonyms

32
votes
1answer
5k views

How to do a `tail -f` of log rotated files?

On a long running system I usually have a terminal with $ tail -f /var/log/kern.log or something like this open. But from time to time I have to restart such command because no new messages are ...
10
votes
2answers
2k views

Parse syslog messages into separate MySQL tables with rsyslog

Out of the box rsyslog will dump everything into the SystemEvents table within the `Syslog database (if you use the default schema provided). I would like to use a regular expression to filter inbound ...
8
votes
2answers
10k views

add new syslog facility

I would like to use syslog to log messages coming from my PHP based site. My question is - can I add custom facility name? I know there are predefined facilities like: auth, authpriv, cron, dæmon, ...
6
votes
2answers
5k views

How to tell rsyslog to create log file if not there?

Default behaviour by rsyslog is to append traces to an existing log file. Now, I've seen (CentOs, Scientific Linux) that when rsyslog is already running, you delete the log file (e.g. the one ...
5
votes
2answers
3k views

How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?

I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
5
votes
2answers
2k views

rsyslog drops messages excessively

We have a CentOS machine acting as our syslog server. I recently noticed that the machine has been dropping large numbers of syslog messages at times. We have over 250 routers and switches, as well ...
5
votes
4answers
5k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit ...
5
votes
1answer
586 views

rsyslog rule inconsistently applied

I have created a rule to redirect messages containing {FILTER} in file /etc/rsyslog.d/40-filter.conf :msg,contains,"{FILTER}" /var/log/filter.log & ~ I have edited file /etc/rsyslog.conf so it ...
4
votes
2answers
128 views

rsyslog - action AND action

I want to create rule to send data from facility to file AND to MySQL database. How it can realized? Only by adding second line like: syslog.* /var/log/syslog.log syslog.* ...
4
votes
3answers
124 views

How to deal with a pre-packaged program not adhering to the Rule of Silence?

Concrete problem: Mailman comes with a script to synchronize mailing list subscribers from a flat file (sync_members(8)). This script does not very well adhere to the Rule of Silence. For example, ...
4
votes
1answer
311 views

Preventing output to /var/log/syslog

I have rules such as: if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog and don't want to output messages that go into that log to /var/log/syslog as well. Is ...
4
votes
1answer
99 views

Is it possible to change the priority of a message in rsyslog?

I have a very dramatic and hypocondriac program, and it likes to spew alarming messages to syslog in cases when nothing really important happens. Besides, it sends them with priority "alert", so they ...
3
votes
2answers
495 views

If I redirect logs using rsyslog, will dmesg be affected?

I am trying to get some logging in place and am trying to troubleshoot it and this question became relevant. I use rsyslog config files to redirect some of my logging. (Will use iptables logging ...
3
votes
1answer
3k views

Suppress duplicate messages in rsyslog?

Is there a way to configure rsyslog to suppress identical duplicate messages? In certain situations (often hardware failures) my syslog can grow to 100 MB or more due to repeated messages every ...
3
votes
1answer
452 views

Rsyslog Central Log Host

I'm moving from a syslog-ng central log host to rsyslog. I can't even seem to find syslog-ng in the CentOS repos these days. I want to filter logs by hostname and facility. Here is how I do it in ...
3
votes
1answer
257 views

rsyslog conf file problem

I'm running Fedora (F19) and my /var/log/messages is filled with info coming from avahi-daemon: stuff like: Jan 21 14:13:42 localhost avahi-daemon[554]: Invalid response packet from host 10.10.22.3. ...
3
votes
1answer
114 views

Grep with spaces suddenly doesn't work

When performing a grep like: $ tail -f apilog_2014.07.09.log | grep "HELLO" | grep "99999" I get the desired output: 12:22:35 server apache2: HELLO FRIEND 99999 12:22:35 server apache2: HELLO ...
3
votes
1answer
734 views

rsyslog using short hostname

I'm using CentOS 6.5 and rsyslogd: Name : rsyslog Arch : x86_64 Version : 5.8.10 Release : 8.el6 In rsyslog.d's conf file I have: $PreserveFQDN on and ...
3
votes
2answers
323 views

rsyslog: execute script on matching log event

I have the following line in my /etc/rsyslog.conf :programname, contains, "suhosin" /var/log/suhosin.log which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I ...
3
votes
0answers
470 views

Why does rsyslogd not honor the following lines in rsyslog.d

This is somewhat related to my previous question here. I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf: 00-iptables.conf 50-default.conf postfix.conf The first one ...
3
votes
3answers
635 views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
3
votes
1answer
2k views

rsyslog not logging

This is an odd issue. I was testing the chrony/ntp services on a RHEL7 VM and was resetting its time as well as the host's. Once I was satisfied with it I checked /var/log/messages and realized it ...
3
votes
0answers
136 views

Extract particular words from Rsyslog %msg% facility

After lot of search on Google and reading all manuals available on man page and internet, I finally ask here. In my scenario, I have one rsyslog server working with mysql and a custom template ...
3
votes
1answer
1k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
2
votes
1answer
2k views

What does the *.*;auth,authpriv.none -/var/log/syslog line mean in rsyslog config file?

I'm trying to understand the /etc/rsyslog.conf file, but I'm missing something. For example, this is a part of the file: auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none ...
2
votes
2answers
408 views

Start rsyslog as unprivileged user

On Debian, rsyslog runs by default as root (due to POSIX compatibility). It can drop privileges after start, but a cleaner way would be to start as a non-privileged user. Could somebody please advise, ...
2
votes
1answer
274 views

How to disable systemd's “Time has been changed” message spam in /var/log/syslog on Debian jessie?

Due to combined use of Debian jessie, that uses systemd by default, and sdwdate (that uses Slow Clock Adjuster ( gh )), my system clock is frequently changed. As a result /var/log/syslog gets ...
2
votes
1answer
336 views

How to check if the remote rsyslog client is running

At the moment I'm implementing the part of the monitoring system that is build around the rsyslog and auditd. I would like to include into the project a correct verification of the fact that remote ...
2
votes
2answers
410 views

rsyslog: make %syslogtag% equal length

I have rsyslog configured to log in the following format: $template long-iso,"%$NOW% %timereported:8:15% %syslogtag% %msg%\n" which produces logs like this one: 2013-12-14 15:59:39 ...
2
votes
1answer
292 views

Syslog TLS Compression and Message Buffering

Where I work, we have a site-to-site VPN tunnel set up between our main data center and a third party data center that does some Oracle PaaS for us. Since they charge per-VM, we're monitoring the ...
2
votes
1answer
154 views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
2
votes
1answer
521 views

rsyslog: how to bind rulesets to unix sockets (imuxsock)

I'm using the imuxsock module to listen to additional local log sockets (i.e., with the $AddUnixListenSocket directive). After reading the awesome http://www.rsyslog.com/doc/multi_ruleset.html page, ...
2
votes
2answers
1k views

rsyslog is not discarding message as it should

I have setup rsyslog to write messages from local0.* to a seperate logfile, and then discard the messages. For some reason, the logs are going to both /var/log/syslog, and the new logfile. I have ...
2
votes
1answer
86 views

rsyslogd only logs from remote servers after enabling UDP:514 on Debian

I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance ...
2
votes
1answer
148 views

Installing rsyslog from source - No package 'liblogging-stdlog' found

I asked this over in AskUbuntu but have had no luck with an answer. I am doing experiments with different logging systems. At the moment I am trying to install rsyslog from source so I can make some ...
2
votes
1answer
676 views

How to change ssh log location from /var/log/secure to custom location in rhel 6?

By default in RHEL 6, SSH server logs are sent to /var/log/secure. I want to change this location to a custom one. Is it possible to do that? I have tried modifying the rsyslog.conf file, but it does ...
2
votes
0answers
60 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
0answers
197 views

Logwatch ignores self-defined service, but explicit setting --service $service works

I am using SSLH on my server to accept both SSL and SSH connections on Port 443. As the logs of sshd and apache2 show each incoming connection via SSLH originating from 127.0.0.1, I want to add the ...
2
votes
0answers
893 views

Seagate external hard disk creating problems

I've bought a new hard disk, a Seagate (Backup Plus), but I'm having problems with it. Firstly, it doesn't mounts every time I plug it in. In such cases, I've got to restart the machine to work with ...
2
votes
2answers
548 views

rsyslog ENABLE “last message repeated”?

I just built a new linux 3.7.6 kernel and have a built-in module (which is not in use) throwing errors as fast as it probably can, ie, reporting a busy loop. Obviously this is not good and I have to ...
1
vote
1answer
83 views

learning to output custom rsyslogs [closed]

I've installed rsyslog. I want to log why my server is refusing to show my index page in the browser in /var/log/browser.log Should it be listening on a standard port? I can see netstat -tpan. To ...
1
vote
1answer
770 views

Add year to entries generated by rsyslogd

The default configuration of rsyslogd writes log entries in the traditional format, which looks like this: Nov 30 10:40:01 localhost CRON[30786]: pam_unix(cron:session): session closed for user list ...
1
vote
1answer
589 views

How to set up a daemon to monitor an error log and trigger email notifications alerts (maybe syslogd?)

I have a log file that my custom application uses named 'application.log'. I want to set up a daemon that will monitor this file and scan for any errors marked CRIT and ignore the other DEBUG and ...
1
vote
1answer
67 views

log files in CentOS 7 [closed]

In CentOS 7, how can I locate and view all the system logs that tell me who tried to enter the system, who got in, what processes they contacted, what they accomplished, etc. I want to be able to ...
1
vote
1answer
59 views

rsyslog: how do I set up remote logging?

I am simply trying to set up a remote logging system. I think my setup is correct but it fails and I can't get any messages from rsyslog to show up in the logs, so I can't find out why. My iptables ...
1
vote
1answer
679 views

if statement apparently not working in rsyslog

I'm trying to use the RainerScript syntax in my Debian /etc/rsyslog.conf file. I want to log daemon stuff to a particular file, but only from pppd. Here's what I added: if $programname == 'pppd' ...
1
vote
1answer
1k views

Pimp rsyslogd to have less i/o (cron, pam,…) and less logging

On my raspberry I really don't need crons and pam logging and I want to have less i/o to make the SD card life a little longer.. I have already removed cron with the second line cron.none, I'm ...
1
vote
1answer
323 views

Where does rsyslog keep facility local0?

I added to rsyslog.conf a lines ModLoad imudp UDPServerRun 514 local0.* /var/log/dlink.log With tcpdump I can see the packets from dlink somethimes local0 somethimes local1 even local2. Nothing ...
1
vote
1answer
468 views

Behavior of rsyslog writing to a pipe

I configure rsyslog with an additional entry, like this: *.* |/var/log/logpipes/pipe1 and have my own evaluation program for the messages received. This works so far, but I am unsure, how rsyslog ...
1
vote
0answers
29 views

rsyslog and netsnmp support for Linux namespaces

I have configured different net namespaces (netns) on my linux machine (Ubuntu) with different routes in each. Now, if I want rsyslog and SNMP traps (netsnmp) to use one of the route from these ...