7

My goal is to log apt/dpkg activity using syslog (rsyslog), so that log entries are sent to central syslog server.

dpkg writes to /var/log/dpkg.log, apt writes to /var/log/apt directory.

I did some research and it seems that apt nor dpkg are able to use syslog. The only option is to use rsyslog "Text File Input Module" feature (http://www.rsyslog.com/doc/master/configuration/modules/imfile.html), which periodically checks log file for new content.

/etc/dpkg/dpkg.cfg configuration file has log option, but there is no manual page for dpkg.cfg options and features.

Is really rsyslog imfile the only option?

  • I don't understand why you would want to do that. Also, do you want it to log to syslog instead or in addition to the places it logs to? – Faheem Mitha Mar 27 '15 at 13:06
  • I need it, because our company's policy requires to have central syslog server with log events from all servers in one place. rsyslog takes care of distributing events, so I need to get apt+dpkg events (installed/removed/updated packages) to rsyslog process. – Petr Stastny Mar 27 '15 at 13:12
  • I assume you've seen blog.actbluetech.com/2012/07/logging-dpkg-to-syslog.html. – Faheem Mitha Mar 27 '15 at 13:20
  • Yes I did, but it logs only packages names without activity details. imfile is better for that. I just wonder why apt/dpkg does not have natural ability to talk to syslog process. – Petr Stastny Mar 27 '15 at 13:27
  • 1
    File wishlist bugs, perhaps? – Faheem Mitha Mar 27 '15 at 13:38
2

For dpkg this can be done by adding

status-logger "logger -t dpkg -p info"

to /etc/dpkg/dpkg.cfg. Since apt-get calls dpkg, also apt-get/apt actions get logged. See man logger for adjusting the information logged to the syslog.

I am using this ansible task to update the configs:

- name: dpkg syslog
  lineinfile:
   dest: /etc/dpkg/dpkg.cfg
   line: 'status-logger "logger -t dpkg -p info"'

If you are using the systemd journal it is convenient to check the logs via

journalctl SYSLOG_IDENTIFIER=dpkg
  • Nice, though the ansible task needs become: yes to avoid an error: FAILED! => {"changed": false, "msg": "The destination directory (/etc/dpkg) is not writable by the current user. Error was: [Errno 13] Permission denied: '/etc/dpkg/.ansible_tmppkCGRodpkg.cfg'"} – Tyson Aug 3 '18 at 6:28
0

Modifying where dpkg logs its output is possible through the --log option. This only allows filenames. DPKG was built as a simple and efficient tool to manipulate packages, so not having logger that complicates stuff is a plus. The simplest way would be that you write to a file and syslog reads from that file as you already know.

You can use status-fd to send the status to a file descriptor like /dev/log or status-logger to have a middleman that sends the entries to the syslog.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.