Questions tagged [rsyslog]

rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

Filter by
Sorted by
Tagged with
1
vote
0answers
29 views

Replacing rsyslog with journald for a more modern approach of logging

I'm looking for a more modern way of keeping logs my Linux servers. Rsyslog still strongly relies on logrotate to keep logs maintainable and space occupation by logs to a minimum, which is not a ...
0
votes
1answer
19 views

Where to find / How to install missing imjournal shared object file (/usr/lib/rsyslog/imjournal.so) for rsyslog

I am playing around with logging using rsyslog and journald and I wanted to see how effective the imjournal module was. So I added $ModLoad imjournal to my /etc/rsyslog.conf and restarted rsyslog. ...
1
vote
1answer
19 views

Can I group load-balanced apache http logs on a rsyslog log server by VirtualHost?

I have an array of load balanced app servers (app1-app4) for multiple websites logging to a single log server (log1). I would like the logs on the log server to be grouped by virtualhost so I can see ...
0
votes
1answer
24 views

How to replace timestamp of messages received on an rsyslog server with a local timestamp?

I have a router that forwards its logs to an rsyslog server and I'd like to configure the rsyslog server to replace the timestamp with a local timestamp. The message format looks like this: Jan 1 00:...
1
vote
0answers
11 views

Unable to create nested Syslog filter with NOT condition

I have a syslog filter setup in my syslog.conf file and data is getting filtered and coming in. source s_network { tcp(port(6514) max-connections(100) keep-alive(yes) tls( key_file("/opt/certs/cert....
1
vote
0answers
18 views

rsyslog not sending nova, neutron logs from openstack controller

I have my rsyslog server setup and I want to collect logs from my OpenStack controller. I have followed these steps, https://wiki.openstack.org/wiki/OpsGuide-Logging-RSysLog but I am not able to see ...
0
votes
0answers
16 views

rsyslog server and client not working when roles are switched

I have two CentOS-7 machines. I have configured one as a rsyslog server and the other as rsyslog client. I am using UDP/514. In rsyslog server machine I have added the following entries in the /etc/...
1
vote
1answer
23 views

How to figure out why this process is terminated accidentally On Ubuntu16.04

I tried to run a python script which trains a lstm model on a server. (figure 1 server's OS information.) However,everytime before the traning ends,the process will be terminated. (figure2&3 ...
1
vote
1answer
42 views

rsyslog: can you check if two local variables are equal?

EDIT: More context. I have the follow example: set $.dev1IP = 192.168.1.1; set $.dev2IP = 192.168.1.2; set $.dev3IP = 192.168.1.3; set $.sourceIP = $fromhost-ip; set $.sourceTag = ""; template(...
0
votes
0answers
35 views

How do I 'tail -f' to a file, while also executing a script utilising that file indefinitely?

I am so close to getting it, but fear I have spent too long looking at this and am getting lost as to how to accomplish what I want. What I am trying to do: Take the access log from my server, parse ...
1
vote
1answer
24 views

rsyslog: how to extract values from metadata and store in variable?

I currently have the following input configuration: input(type="imfile" File="/scp_tmp/<source_ip_address>/*.log" addMetadata="on") And two global variables: set $.sourceIP = $...
1
vote
1answer
31 views

rsyslog: how to assign properties in imfile?

I have rsyslog configured to listen on UDP/514 for syslogs from other devices in my environment, but I have a certain logs that cannot be sent through normal UDP/TCP syslog and the only way to do so ...
0
votes
1answer
19 views

Does rsyslog ignore any files under rsyslog.d that do not end in .conf?

The reason why I ask this is that I want to configure my deployment in a modular manner. I would have N number of text files where I can edit how rsyslog behaves in N number of cases, all of which ...
0
votes
1answer
41 views

Is UDP data lost when executing kill -HUP on rsyslog?

I am very new to rsyslog and I am going through the documentation as well as seeing examples of what other people have done with their configuration and a question came to mind when the topic of log ...
0
votes
1answer
26 views

Error while rotating logs

I am two issue with the /var/log/message rotation. Below is the log-message configuration # cat /etc/logrotate.d/logrotate-messages /var/log/messages { daily rotate 7 create dateext ...
0
votes
1answer
42 views

Understanding rsyslog log format and filtering

I am working on filtering logs from syslog and forwading to another log. I am able too capture/filter the log based on "internal-sftp". By using if $programname == 'internal-sftp' then /var/log/...
2
votes
1answer
39 views

rsyslog not writing dynamic log file

The systemd unit files for my Java apps (on Ubuntu 18.04) appear to be working - I had set stdout and stderr to be sent to syslog and the log entries were appearing in /var/log/syslog. However I want ...
2
votes
0answers
70 views

Rsyslog and Journald - Log processing in Linux

I do not really understand the forwarding from Journald to Rsyslog. Basically I understood it in the way that the 'pipeline' is built up as follows: Kernel logs through printk() → /proc/kmesg ← ...
1
vote
1answer
69 views

SFTP user activity logging on Ubuntu 16.04.4 LTS

I'm using Ubuntu Server 16.04.4 LTS to set up a SFTP server via openssh-sftp-server 1:7.2p2-4ubuntu2.8 from my Server I would like to log user activity (change dir, upload/download file etc). So, I am ...
0
votes
1answer
20 views

Rsyslog not saving logs from another servers into custom directories

I am receving logs on UDP 514 from another server and i have configured rsyslog.conf to save the logs to another custom directory but i am unable to do so, i confirmed through tcpdump logs are getting ...
0
votes
0answers
26 views

Linux Rsyslog disable DNS resolution per facility / log file

I have some cisco logs coming to a linux server on facility4, (local4.*) via udp/514. I know I can disable DNS resolution globally with global(net.enableDNS="off") in the rsyslog.conf file but is ...
0
votes
1answer
16 views

Troubleshooting rsyslog 8.32 on Ubuntu writing to MariaDB

I am trying to get LogAnalyzer running and setup the system based on How to setup loganalyzer with rsyslog on Ubuntu 16.04 LTS / Ubuntu 18.04 LTS. It went smoothly up until the first of LogAnalyzer ...
0
votes
0answers
13 views

Remote host logs are being stored on /var/log/messages along with specified path in rsyslog.conf

I am facing the same issue. Remote host logs are being saved to /var/log/messages also. I tried & stop or & ~ but it gives me error when I try to use these keyworkds inmy rsyslog.conf file ...
1
vote
1answer
45 views

rsyslog logs are not stored in queue files

I’m using rsyslog 8.40 and I’m trying to setup logforwarding with queues. I was able to send logs to the forwarding servers using the following configurations. action(type="omfwd" target="host1" ...
2
votes
0answers
16 views

secure log file data not up to date, behind a few hours

When I tail -f my /var/secure log file the data in it is about 3 hours behind the current time. This only happens when someone attacks this particular server and the secure log files blows up with ...
1
vote
1answer
37 views

Getting messages from services that don't exist

For about 3 hours this afternoon, I got the following messages from services that I don't have (either uninstalled or never heard of): [2020-01-27 14:02:57] dss-mint [daemon.info] [systemd] Started ...
1
vote
2answers
75 views

/var/log/messages growing indefinately because rsyslog won't let it be deleted

I had an issue with /var running low on space despite it only appearing to have only 2 gigs of files allocated on the 5 gig partition. I determined the issue was that /var/log/messages was deleted but ...
1
vote
1answer
37 views

Prevent rsyslog messages from repeating in different priority levels

[Running Linux Mint 19.3] I'm trying to work with individual rsyslog priority levels, separating out the messages like this (from /etc/rsyslog.d/50-default.conf): *.info /var/...
0
votes
0answers
499 views

Getting errors trying to configure rsyslog to create daily per-IP logfiles

This is on a Raspberry Pi 4. I can post the entire rsyslog.conf here if needed, but it's the stock file with this added to it: $template DailyPerHost,”/var/log/syslog_devices/%FROMHOST-IP%/%FROMHOST-...
1
vote
0answers
98 views

What happens to rsyslog queue files after they have been processed?

I am working on a machine (ubuntu 18.04) that generates logs at times when it's not connected to a network. I have configured rsyslog to forward some of these logs to an aggregator service (fluentd) ...
0
votes
1answer
151 views

Using syslog for user/application logs on Centos 7/8

I want to use syslog(3) to write application logs to a central recorder. The application runs on a collection of computers on the same subnet. Not interested (at present) in capturing system (non-...
0
votes
1answer
31 views

Mounting a remote share (why do I supply a local path?)

I have zero previous experience with unix (other than I used to have an account on an SGI box more than 25 years ago and remember some of the commands). I want a rasberry pi 4 to auto-logon to a ...
0
votes
1answer
331 views

Haproxy seems to not send logs to 127.0.0.1:514 despite configuration

Edit: the actual problem ended up being either the local0 vs local2 distinction and the rsyslog end of deal. I'm building a kubernetes / openshift cluster, and on front of that, I need to set up a L4 ...
0
votes
1answer
36 views

Using rsyslog, is it possible to have ruleset within an action, within a ruleset?

The question might be confusing... What I have: *.local1 call rule1 I have a ruleset rule1, that has two actions, a1 and a2. a2 is only executed if a1 failes, something like ruleset(name="rule1"){...
1
vote
1answer
129 views

Redirecting information from syslog to separate file

I want to log all incoming TCP connections to my Ubuntu 18.04.3 system. That works fine and is not the problem, just as an intro. I am using this command in crontab for this: @reboot /sbin/iptables -...
0
votes
0answers
52 views

Pipe systemd StandardOutput and StandardError to both Syslog and File?

I have a systemd process that currently runs with the options StandardOutput=syslog StandardError=syslog I would like to continue sending logs to syslog, while also sending each to a different log ...
1
vote
2answers
74 views

Forward journald Logs on CentOS7 to SIEM-Server

Is it possible to directly forward logs from journald to a Remote-Log-Server? I only see the option ForwardToSyslog in the /etc/systemd/journald.conf config file. Or do I have to forward it to ...
0
votes
0answers
119 views

add module omfwd and omkafka to rsyslog

I install rsyslog latest version, but without omfwd and omkafka module! how can I add these modules? thanks.
1
vote
0answers
86 views

How to know why a service was restarted by systemd?

I have a host running rsyslog which uses imuxsock to accept messages from journald. However, during boot, after rsyslog is started, it is restarted (stopped and started) again by systemd. I need to ...
2
votes
2answers
261 views

How to split logs into monthly, daily and hourly folders when bringing in syslog events?

I am bringing in log files via rsyslog and my config looks like the following: root@rhel:/etc/rsyslog.d# head mail_prod_logs.conf if $fromhost-ip=="10.10.10.10" and $programname=="AMP_Logs" then -/...
0
votes
1answer
22 views

How to edit my config file to create two log files while ingesting syslog events?

I am sending mail message logs and amp logs from the same server 10.10.10.10 via syslog to my RHEL7 server. I am running rsyslog and have the following config file: mail_logs.conf $template ...
1
vote
1answer
126 views

rsyslog error in logstash

I have installed ELK and tried to configure rsyslog server with logstash but i am getting lot of \ while executing curl -XGET 'http://172.22.63.61:9200/logstash-*/_search?q=*&pretty' Rsyslog ...
0
votes
0answers
24 views

How to read from syslog using systemd service

Does anyone know what the proper way is to create a systemd service and read from syslog write the logs out to the network? I had this in a service: tail -f /var/log/syslog | ...
0
votes
0answers
43 views

rsyslogd missing message?

I set up a logging host in the ryslogd config using python, restart daemon etc and get a correct message: Sep 20 09:03:20 Desk-r6 CLI[13845]: (admin) (root) (192.168.1.10) startup : Success Code to ...
0
votes
1answer
181 views

rsyslog omprog when an audit logfile is rotated

We have an use case that we need to compress a logfile when it is rotated. More specifically we have the auditd audit trail that is rotated based on size... So when the size of the logfile reaches ...
0
votes
0answers
24 views

how to send log content through udp to rsyslog

I'm a fresh Linux user. I was trying to write my application log to rsyslog docker instead of writing it on disk directly. I pulled the rsyslog docker from docker hub and made a configure file like ...
0
votes
0answers
45 views

$InputTCPMaxListeners and $InputTCPMaxSessions not being respected

I have set up many rulesets with $RulesetCreateMainQueue on and when I prepend $InputTCPMaxListeners and $InputTCPMaxSessions before any $InputTCPServerRun directives, the $InputTCPMaxListeners and $...
0
votes
0answers
57 views

rsyslog for SUSE Linux Enterprise Server 12 SP2

I need to ship a log "/opt/app/dbsv/dbsv.log" from one server to a centralized log server. What are the configurations that needs to be done to achieve this. \ I have added a conf file "dbsv.conf" ...
2
votes
2answers
345 views

rsyslog filter severity not working

I have following Rsyslog config to send logs to remote servers. Problem is its sending lots of INFO mesg to remote server and i don't want that noise. I am trying to configure filter so it send all ...
1
vote
2answers
110 views

How to get rid of number suffix in rsyslog's own 'programname' ang 'syslogtag' property

I'm forwarding logs from local rsyslogs to central rsyslog and then to Elasticsearch. Everything works fine, but entries with severity error generated by rsyslog itself have property programname like ...

1
2 3 4 5
7