How do I configure SSSD to send logs to syslog? I would like to include the SSSD debug logs as well. We would like to feed the sssd logs to Splunk. Our systems are already configured to send syslog to Splunk Security Module. So we would like to use that setup, instead of the Splunk Forwarder.

  • 1
    I don't know of any way to output to syslog natively, but you may be able to use a third-party forwarder such as logstash to ingest and forward the logs. – jayhendren Dec 7 '16 at 23:45

Depending on which distro you are using, your syslog daemon is likely rsyslog or syslog-ng. Both can be configured to watch specific files and pull in log events for futher processing (for example forwarding to Splunk)

  • rsyslog's imfile module can be configured to watch other log files.
  • syslog-ng's file directive can be used in its configuration files to declare a specific log file as a source of log events.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.