1

By default, rsyslog's config file is in /etc/rsyslog.conf. You can set the config file path on startup with the -f /path/to/file option.

My question is: how can you find the config file if it's been set somewhere other than the default?

2
  • ps -fe | grep rsyslog? Look to see what's specified on the command line.
    – doneal24
    Commented Jul 25, 2018 at 16:48
  • That's a great simple solution that I hadn't considered. Thank you. Commented Jul 25, 2018 at 18:39

1 Answer 1

1

This will depend on the software and how it has been configured; rsyslogd at least the version present on Centos 7 does close the configuration file after reading it so a tool like lsof will not reveal that file once the daemon is up and running:

% sudo lsof -p `pidof rsyslogd` | perl -nle 'print for grep -f, split'
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
/usr/sbin/rsyslogd
...

The filename does however appear in the process table, which can then be searched for under /etc as that's usually where such configuration is hidden:

% < /proc/`pidof rsyslogd`/cmdline tr '\0' ' ' ; echo
/usr/sbin/rsyslogd -n -f /nunca/adivinarás/esto
% sudo grep -r '/nunca/adivinar' /etc
/etc/sysconfig/rsyslog:SYSLOGD_OPTIONS="-f /nunca/adivinarás/esto"

On a completely unknown system you may need to use something like SystemTap or sysdig—a kernel tracing facility, in other words—and report on what files the daemon uses:

% sudo sysdig -p '%fd.name' 'proc.name = rsyslogd' | tee files-used
...

And then restart the daemon.

Lacking a kernel tracing facility one may be able to trace the daemon in question with a userland tool such as strace or ktrace and from the system calls possibly figure out what the configuration file is. You may need to compare the trace output from a sensibly configured system to figure out where to look for the configuration file read.

1
  • This is thorough, and I appreciate the different approaches. I won't always have access to ps results so this was very helpful. Commented Jul 25, 2018 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .