2

I'm working on an pre-existing installation of rsyslog. I am not sure what remote hosts are sending log files to the server. Some of the folders have unhelpful names like 'last', 'Server', 'syslogd', and 'exiting'. How do I track down where these are coming from (e.g. useful log files, etc.)?

/etc/rsyslog.conf:

#  Default rules for rsyslog.
#
#           For more information see rsyslog.conf(5) and /etc/rsyslog.conf

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
#cron.*             /var/log/cron.log
#daemon.*           -/var/log/daemon.log
kern.*              -/var/log/kern.log
#lpr.*              -/var/log/lpr.log
mail.*              -/var/log/mail.log
#user.*             -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
#mail.info          -/var/log/mail.info
#mail.warn          -/var/log/mail.warn
mail.err            /var/log/mail.err

#
# Logging for INN news system.
#
news.crit           /var/log/news/news.crit
news.err            /var/log/news/news.err
news.notice         -/var/log/news/news.notice

#
# Some "catch-all" log files.
#
#*.=debug;\
#   auth,authpriv.none;\
#   news.none;mail.none -/var/log/debug
#*.=info;*.=notice;*.=warn;\
#   auth,authpriv.none;\
#   cron,daemon.none;\
#   mail,news.none      -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                                :omusrmsg:*

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#   news.=crit;news.=err;news.=notice;\
#   *.=debug;*.=info;\
#   *.=notice;*.=warn   /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
# 
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
#daemon.*;mail.*;\
#   news.err;\
#   *.=debug;*.=info;\
#   *.=notice;*.=warn   |/dev/xconsole
ubuntu@rsyslog:/mnt/data/rsyslog/hosts/last/2013/12/31$ cat /etc/rsyslog.conf 
#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#           For more information see
#           /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

# Enable non-kernel facility klog messages
$KLogPermitNonKernelFacility on

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

/etc/rsyslog.d/60-remote.conf:

$WorkDirectory /mnt/data/rsyslog/queue # default location for work (spool) files
$DefaultNetstreamDriver gtls
$DefaultNetstreamDriverCAFile /etc/rsyslog.d/ssl/XXXXX.pem
$DefaultNetstreamDriverCertFile /etc/rsyslog.d/ssl/XXXXXX.crt
$DefaultNetstreamDriverKeyFile /etc/rsyslog.d/ssl/XXXXXX.key
$ModLoad imudp
$ModLoad imtcp
$template syslog,"/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/syslog
$template apacheError,"/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/apache-error.log
$template apacheAccess,"/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/apache-access.log
$template auth,"/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/auth.log
$template kern,"/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/kern.log
$template mail,"/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/mail.log
$template daemon,"/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/daemon.log
$RuleSet remote
$ActionQueueType LinkedList   # use asynchronous processing
$ActionQueueFileName logstash # set file name, also enables disk mode
$ActionResumeRetryCount -1    # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
$ActionQueueMaxFileSize 100m
$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
$ActionQueueDequeueSlowdown 0
$ActionQueueWorkerThreads 4
*.* @@logstash.anotherdomain.com
local7.* ?apacheError
& ~
local6.notice ?apacheAccess
& ~
auth,authpriv.* ?auth
& ~
kern.* ?kern
& ~
mail.* ?mail
& ~
daemon.* ?daemon
& ~
*.* ?syslog
$InputTCPServerStreamDriverMode 1
$InputTCPServerStreamDriverAuthMode anon
$InputTCPServerBindRuleset remote
$InputTCPServerRun 1514
$InputUDPServerBindRuleset remote
$UDPServerRun 514
  • Can you include the configuration file here? Unfortunately names can sometimes be generated by the recipient rsyslog server, an intermediate (if one exists) or even the source. – roaima May 2 '16 at 15:39
  • as roaima said, the logs themselves should have hostnames in them, whether those are the actual sources or not. – Jeff Schaller May 2 '16 at 15:42
  • I don't see names in the logs themselves, but most folders in the directory are named from the host they come from – David Welch May 2 '16 at 15:48
  • We probably need the contents of /etc/rsyslog.d/*.conf. In rsyslog.conf I can't see receiving of remote logs enabled. – BenjaminH May 2 '16 at 18:02
0

All of the forwarding in rsyslog.conf, the stuff that looks like this:

auth,authpriv.*         /var/log/auth.log

is going to log files without a hostname. The stuff in 60-remote.conf, that looks like this:

`auth,authpriv.* ?auth

is going to the log files defined by the templates such as this:

$template auth,"/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/auth.log

So it appears there are two different systems in place, with a lot of overlap. The stuff in rsyslog.conf is the default, and the stuff in 60-remote.conf is another nearly-complete system.

As I understand it, hosts send events, not files. Each log event in the files may or may not have a hostname in it right after the timestamp (they do in most default configurations). The events are put in the files by the local syslog daemon.

0

Since the syslog packet only contains the IP Address, you could use host:

for h in  last Server syslogd exiting ; do
    host $h
done

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.