Questions tagged [rsyslog]

rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

Rsyslog - how to stop sending logs to a console

I've just started using rsyslog on my embedded Linux built with Yocto. Some logs are printing in a console what is very annoying. I find a way to disable it calling dmesg -n <level>. This ...
1
vote
0answers
40 views

How to redirect some specific messages to a particular file with syslogd?

I would like syslogd to write one specific log message to a specific file. I foud the syntax for rsyslog: :msg, contains, "some text" /path/to/file When I add it to /etc/syslog.conf and try ...
0
votes
0answers
22 views

How to send openvpn syslog?

I'm trying to figure out how I can send openvpn syslog message to a remote server. Openvpn documentation is non existent but according to server.conf messages should be forwarded to syslog by default ...
0
votes
0answers
18 views

CentOS remote syslog message stores in two files

I am using rsyslog server in CentOS steam. want to log each remote server log message in /data/log/<hostname>.log and local server message in /var/log/message file. using below configuration, ...
1
vote
1answer
39 views

RSYSLOG force only TLS 1.3 version

Debian: 10.10 rsyslog-gnutls: 8.1901.0-1 libgnutls: 30.6.7 I search in where path and name file insert this var "gnutlsPriorityString". What is her path? And her Name file? to put this var &...
0
votes
0answers
17 views

Getting rsyslog to fwd to Splunk from Ubuntu .20.04

So I've got an Ubuntu 20.04 LTS server setup with Haproxy and I'm trying to fwd log info to Splunk Cloud. I have the Haproxy.cfg with a Global entry: log 127.0.0.1 local4 And I've got an entry in /...
0
votes
1answer
42 views

rsyslog custom log file permissions

I have haproxy service running on the server. For haproxy logging created following /etc/rsyslog.d/haproxy.conf file with content mentioned below: $ModLoad imudp $UDPServerAddress 127.0.0.1 $...
0
votes
0answers
19 views

Error when trying to run rsyslogd with RELP module on dd-wrt

I'm trying to setup Rsyslog reliable remote logging through the rsyslog-relp module on dd-wrt (x64). Rsyslogd itself works fine by installing the OpenWrt package, rsyslog-relp instead needs to be ...
2
votes
0answers
43 views

Calculating MAX NOFILE and MAX NPROC on Linux Servers

Is there any formula or basis that we can consider to calculate hard and soft limits for NPROC and NOFILE? My system is currently using 4096 for NOFILE which is the default value, and we recently had ...
0
votes
0answers
26 views

Cannot write to Custom Log file /var/log/test.log

I'm trying to implement a custom PAM via SSHD. I've added a logger file to the program which stores logs in /var/log/test.log .But, logs are not being printed into the file while running the custom ...
1
vote
0answers
45 views

What are the message formats in `/var/log/syslog` and the output of `dmesg`?

On Debian or Ubuntu, what are the formats of /var/log/syslog and the output of dmesg? In /var/log/syslog, I figure from Apr 1 08:15:01 mycomputer CRON[12494]: (root) CMD (command -v debian-sa1 > /...
0
votes
1answer
165 views

In syslog or rsyslog, are ring buffer, queue of message, and write buffer the same?

Are the ring buffer, the queue of messages, and the write buffer the same? If not, how do ring buffer, queue and write buffer work together in syslogd or rsyslogd? Most implementations of syslogd ...
0
votes
1answer
175 views

Have SELinux allow syslog and logrotate to handle files outside of /var/log

on a Centos 8 server, I attached a bigger disk mounted to /mnt/data. The server runs rsyslogd which has a policy to write logs from external systems to /mnt/data/logs/$HOSTNAME. I do now have the ...
1
vote
0answers
98 views

Rsyslog - send logs to remote server

I'm trying to send service log files to a centralized Rsyslog server. On the Syslog server, I have a simple configuration $template DailyPerHostLogs,"/var/log/syslog/%$DAY%/%Fromhost-ip%/%...
0
votes
1answer
109 views

rsyslog not logging kern messages

I'm using Ubuntu 20.04 with rsyslog and up-to-date packages. I want to log messages from iptables. I can see those messages with dmesg - it shows the data I expect. deploy$ dmesg -x kern :warn : [...
1
vote
1answer
85 views

Rsyslogd spamming messages when hard drive is full

We are monitoring a few Linux servers (mostly CentOS 8) that aren't administrated by us, but we're responsible for providing the VMs. These servers have rsyslog installed and are sending messages to ...
0
votes
1answer
31 views

Forwarding Data From rsyslog

We have set up a centralized syslog server (RHEL 7 running rsyslogd) that receives syslog data from most of our hosts. Our Security team wants to receive data as well. I'd prefer not to duplicate the ...
0
votes
1answer
29 views

Rsyslog - prevent local host logging twice

I've enabled remote logging in my rsyslog.conf with: # provides UDP syslog reception module(load="imudp") input(type="imudp" port="514") and then in /etc/rsyslog.d/...
1
vote
0answers
19 views

Any way to keep Stunnel from blowing up my logfiles?

I have stunnel v5.44 (Ubuntu 18.04 v3:5.44-1ubuntu3) configured on a client to connect to a server in a screened subnet. The remote host has syslog configured to listen for logfiles over the stunnel ...
0
votes
0answers
12 views

Modifying logs journal

I have a use case where I need to export the logs from journald to some remote host but before doing that I need to prepend some info to every log. Can someone help me on how can that be achieved, if ...
1
vote
0answers
26 views

rsyslog only forwarding to remote server with logger -n and rsyslogd -n

Having an issue with forwarding rsyslog to a remote server and I can't quite pin it down. I don't think anything is wrong with my rsyslog.conf, seen below. I basically just added the line to forward ...
1
vote
1answer
102 views

How to record local3 with all severity levels to a file using system logger?

I'm using a VM. Ubuntu Linux. What I'm trying to do is use System logger to record the local3 facility with all severity levels to a file /var/log/local3.log I'm confused as to what the process is. Am ...
2
votes
1answer
1k views

Does Linux's rsyslog support RFC 5424?

For some reason, rsyslogd does not seem to be able to properly interpret a valid RFC 5424 message. Even the example given by the RFC does not work: $ echo "<165>1 2003-08-24T05:14:15.000003-...
0
votes
0answers
355 views

rsyslogd: sd_journal_get_cursor() failed: 'Cannot assign requested address'

I have 2 physical and 4 VM machines. all have CentOS 7.5 as OS. once a day i get this error in their /var/log/messages: rsyslogd: sd_journal_get_cursor() failed: 'Cannot assign requested address' ...
1
vote
1answer
138 views

How to configure rsyslogd to emit rfc5424 messages?

I want to configure my Linux machine using rsyslogd with the simplest yet standard way. I'll save all the logs to /var/log/syslog with rotation. From my research it looks like the standard syslog ...
0
votes
1answer
52 views

Missing syslog entries for OpenSSH

I would like to save the log for OpenSSH client. The manual says that I can use ssh -y example.com to turn on logging. Configuration manual says that the default Syslog facility is user; I didn't ...
0
votes
0answers
8 views

Rsyslog to limit backlogs on database?

I just connected my Rsyslog to a MariaDB database called Syslog. Is it possible to set rsyslog to automatically limit the data within the database to contain only 3-4 months worth of backlogs? Like ...
1
vote
0answers
125 views

Error message starting rsyslog after configuring system logging without journald on RHEL 7

I followed this procedure from Red Hat website https://access.redhat.com/articles/4058681 to configuring system logging without journald but after reboot rsyslog failed to start. edit the /etc/...
2
votes
1answer
151 views

How to combine template and outchannel together in rsyslog.conf?

i am try to play with rsyslog configuration. To my knowledge To enable log rotation: we should do something below: $outchannel log_rotation,/var/log/syslog.log, 1048576 ,/usr/bin/rotate.sh *.* :omfile:...
-1
votes
3answers
57 views

rhel 7.x machines unexpected failure and message file

we have today strange behavior with our Linux server rhel 7.6 from some reason server goes down and from the messages file we can see that server stop be available on Oct 16 18:17:22 after some ...
1
vote
2answers
38 views

Where are manual locations for $configs?

In Ubuntu, when I run the command man rsyslog.conf, a manual page comes up. So I tried to find the location of this man page by whereis -m rsyslog.conf, but it didn't give me any results. Should I use ...
0
votes
1answer
64 views

rainerscript: how to log to file named $programname substring?

How can I write a rainerscript rule to log to a file whose name is a substring of $programname? I want something along the lines of this pseudo-rule: if $programname startswith "foo" then /...
0
votes
1answer
1k views

rsyslogd[xxxx]: error during config processing: STOP is followed by unreachable statements

I have the following configuration in master syslog server: [root@STGSYSLOG ~]# egrep -v "^$|^#" /etc/rsyslog.conf $MaxMessageSize 32k $ModLoad imuxsock # provides support for local system ...
1
vote
0answers
71 views

rsyslog is creating empty directories

I have the following rsyslog configurations. SYSLOG MASTER(centos 7.x): [root@SYSLOGMASTER ~]# egrep -i "UDP|TCP|template" /etc/rsyslog.conf -A3 # Provides UDP syslog reception $ModLoad ...
3
votes
1answer
297 views

how are early logs logged in rsysylog, when rsysylog is not yet running?

I am using rsyslog on Debian Buster. I am using old-style sysvinit, not systemd. rsyslog is started late in the init startup sequence, after most init scripts have run. The dmesg messages during boot ...
0
votes
1answer
2k views

systemd-journald and rsyslogd: high cpu usage

This is a fresh Debian 10 installation that's two-three weeks old. For the last couple of days, my system has been acting up, it would just slow down and I would not be able to use sudo in the ...
0
votes
1answer
11 views

Full text of commands cut off in /var/log/secure

I've got a server that's using rsyslogd. When looking for commands run by specific users in /var/log/secure, I see that some commands appear to be cut off. For example, you can see that the beginning ...
2
votes
2answers
821 views

rsyslog.conf config check issues

Running rsyslogd -N 1, I receive two complains : rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 27: parameter 'RebindInterval' not known -- typo in config file? [v8.27.0 try ...
0
votes
0answers
16 views

How can I send logs from rsyslog to systemd?

In a previous question I tried to configure logging network traffic with: https://serverfault.com/questions/1029234/how-can-i-log-all-network-activity-with-iptables/1029235 I had a rysyslog config ...
0
votes
0answers
161 views

Configuring rsyslog for sending log files to diffrerent remote machines

I am newbie in using rsyslog - I have a scenario where in I want to send file1.log, file2.log to remote machine say 10.10.10.123 , and file3.log to a remote machine say 10.11.11.123. Is it possible ...
0
votes
0answers
135 views

Custom logrotate with hostnames

I have recently set up my central log server on CentOS 8, I had the following template on my main server: $template RemoteMessages, "/var/log/%HOSTNAME%/messages" $template RemoteSecure, &...
0
votes
2answers
104 views

Is rsyslog a mandatory requirement in Linux with journald?

Note that this question is mainly about the openSUSE distro, but a general answer will also be appreciated. Since journald can be used to do all the logging work (when forwardtosyslog option is ...
1
vote
0answers
390 views

Replacing rsyslog with journald for a more modern approach of logging

I'm looking for a more modern way of keeping logs my Linux servers. Rsyslog still strongly relies on logrotate to keep logs maintainable and space occupation by logs to a minimum, which is not a ...
0
votes
1answer
258 views

Where to find / How to install missing imjournal shared object file (/usr/lib/rsyslog/imjournal.so) for rsyslog

I am playing around with logging using rsyslog and journald and I wanted to see how effective the imjournal module was. So I added $ModLoad imjournal to my /etc/rsyslog.conf and restarted rsyslog. ...
1
vote
1answer
68 views

Can I group load-balanced apache http logs on a rsyslog log server by VirtualHost?

I have an array of load balanced app servers (app1-app4) for multiple websites logging to a single log server (log1). I would like the logs on the log server to be grouped by virtualhost so I can see ...
0
votes
1answer
409 views

How to replace timestamp of messages received on an rsyslog server with a local timestamp?

I have a router that forwards its logs to an rsyslog server and I'd like to configure the rsyslog server to replace the timestamp with a local timestamp. The message format looks like this: Jan 1 00:...
1
vote
0answers
16 views

Unable to create nested Syslog filter with NOT condition

I have a syslog filter setup in my syslog.conf file and data is getting filtered and coming in. source s_network { tcp(port(6514) max-connections(100) keep-alive(yes) tls( key_file("/opt/certs/cert....
1
vote
0answers
49 views

rsyslog not sending nova, neutron logs from openstack controller

I have my rsyslog server setup and I want to collect logs from my OpenStack controller. I have followed these steps, https://wiki.openstack.org/wiki/OpsGuide-Logging-RSysLog but I am not able to see ...
0
votes
0answers
57 views

rsyslog server and client not working when roles are switched

I have two CentOS-7 machines. I have configured one as a rsyslog server and the other as rsyslog client. I am using UDP/514. In rsyslog server machine I have added the following entries in the /etc/...
1
vote
1answer
29 views

How to figure out why this process is terminated accidentally On Ubuntu16.04

I tried to run a python script which trains a lstm model on a server. (figure 1 server's OS information.) However,everytime before the traning ends,the process will be terminated. (figure2&3 ...

1
2 3 4 5
8