1

I am trying to provide the option to user to add their user configuration option for rsyslog. The default rsyslog is working fine for me.

The main or default configuration for rsyslog file looks like below:

# if you experience problems, check
# http://www.rsyslog.com/troubleshoot for assistance

# rsyslog v3: load input modules
# If you do not load inputs, nothing happens!
# You may need to set the module load path if modules are not found.
#
# Ported from debian's sysklogd.conf

$ModLoad immark   # provides --MARK-- message capability
$ModLoad imuxsock # provides support for local system logging (e.g. via 
logger command)
$ModLoad imklog   # kernel logging (formerly provided by rklogd)

# Enable traditional timestamp format                                                                                                                                                                            
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Set the default permissions
#
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

## Include custom config fragments
##
$IncludeConfig /usr/local/etc/rsyslog.d/*.conf
$IncludeConfig /tmp/rsyslog.d/*.conf

# Default logs
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
cron.*                          /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

# Logging for INN news system
#
news.crit                       /var/log/news.crit
news.err                        /var/log/news.err
news.notice                     -/var/log/news.notice

#
# Some `catch-all' logfiles.
#
 *.=debug;\
    auth,authpriv.none;\
    news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none          -/var/log/messages

 #
 # Emergencies are sent to everybody logged in.
 #
 *.emerg                         :omusrmsg:*

 # Save boot messages also to boot.log
 local7.*                                                /var/log/boot.log

My rsyslog filter file looks something like below and is located at /etc/rsyslog.ab.conf

##############################################################################
  ##                                                                            
  #
  ## Security relevant user authentication tags                                 
  #
  ##                                                                            
  #
  ## ALS, ALF                                                                   
  #

  ###############################################################################
  #$template ALS_sshd,"<38>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% 
  %PROCID% %MSGID% %STRUCTURED-DATA% ALS : %msg%\n"
  #if $programname contains 'sshd' and $msg contains 'Accepted password' then 
  /var/log/sedl.log;ALS_sshd
  #if $programname contains 'sshd' and $msg contains 'Accepted password' then 
  @128.224.124.147;ALS_sshd

  #$template ALS_login,"<38>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% 
  %PROCID% %MSGID% %STRUCTURED-DATA% ALS : %msg%\n"
  #if $programname contains 'login' and $msg contains 'login' then 
  /var/log/sedl.log;ALS_login
  #if $programname contains 'login' and $msg contains 'login' then 
  @128.224.124.147;ALS_login

  $template ALF_sshdPW,"<38>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% 
  %PROCID% %MSGID% %STRUCTURED-DATA% ALF : %msg%\n"
  if $programname contains 'sshd' and $msg contains 'Failed password' then 
  /var/log/sedl.log;ALF_sshdPW
  if $programname contains 'sshd' and $msg contains 'Failed password' then 
  @128.224.124.147;ALF_sshdPW

if I uncomment the "if's" from above example it works fine however if I move this file to /usr/local/etc/rsyslog.d/*.conf with uncommented "if's" it does not work. Even though I have added the $IncludeConfig /usr/local/etc/rsyslog.d/*.conf which should make it work. However, it only works it is in /etc/*conf not for /usr/local/etc/rsyslog.d/*conf. I tried using $ResetConfigVariables but did not work.

Although I see the log entry in the syslog.

I rsyslog version I am using is 7.4.4. Any pointers would be appreciated. Thanks

  • 1
    "It doesn't work" - what happens, or does not happen? (Do you get an error? Is your configuration accepted? If you use something like logger to synthesise expected input does that get processed?) – roaima Jul 24 '18 at 8:23
  • I can see the that the input messages get generated and see the entry in syslog, however, it is not been send on the network ... – JNI_OnLoad Jul 24 '18 at 8:28
  • 1
    OK. Please incorporate that in your question so it's easy for anyone to find. – roaima Jul 24 '18 at 8:31
  • 1
    I have fixed it, there was an issue in startup script for rsyslog daemon, the script was not taking the all the files in consideration. Thanks for the help. – JNI_OnLoad Jul 27 '18 at 7:00
  • Pleased you're fixed. You should add that as a answer - and then you can accept your own answer. To make it helpful to others you could explain where the set of included files is defined. – roaima Jul 27 '18 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.