How do I configure SSSD to send logs to syslog? I would like to include the SSSD debug logs as well. We would like to feed the sssd logs to Splunk. Our systems are already configured to send syslog to Splunk Security Module. So we would like to use that setup, instead of the Splunk Forwarder.

  • 1
    I don't know of any way to output to syslog natively, but you may be able to use a third-party forwarder such as logstash to ingest and forward the logs.
    – jayhendren
    Dec 7, 2016 at 23:45

1 Answer 1


Depending on which distro you are using, your syslog daemon is likely rsyslog or syslog-ng. Both can be configured to watch specific files and pull in log events for futher processing (for example forwarding to Splunk)

  • rsyslog's imfile module can be configured to watch other log files.
  • syslog-ng's file directive can be used in its configuration files to declare a specific log file as a source of log events.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .