The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [rsyslog]

rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

Filter by
Sorted by
Tagged with
2
votes
2answers
28 views

How to split logs into monthly, daily and hourly folders when bringing in syslog events?

I am bringing in log files via rsyslog and my config looks like the following: root@rhel:/etc/rsyslog.d# head mail_prod_logs.conf if $fromhost-ip=="10.10.10.10" and $programname=="AMP_Logs" then -/...
0
votes
1answer
15 views

How to edit my config file to create two log files while ingesting syslog events?

I am sending mail message logs and amp logs from the same server 10.10.10.10 via syslog to my RHEL7 server. I am running rsyslog and have the following config file: mail_logs.conf $template ...
1
vote
1answer
28 views

rsyslog error in logstash

I have installed ELK and tried to configure rsyslog server with logstash but i am getting lot of \ while executing curl -XGET 'http://172.22.63.61:9200/logstash-*/_search?q=*&pretty' Rsyslog ...
0
votes
0answers
10 views

How to read from syslog using systemd service

Does anyone know what the proper way is to create a systemd service and read from syslog write the logs out to the network? I had this in a service: tail -f /var/log/syslog | ...
0
votes
0answers
10 views

rsyslogd missing message?

I set up a logging host in the ryslogd config using python, restart daemon etc and get a correct message: Sep 20 09:03:20 Desk-r6 CLI[13845]: (admin) (root) (192.168.1.10) startup : Success Code to ...
0
votes
1answer
34 views

rsyslog omprog when an audit logfile is rotated

We have an use case that we need to compress a logfile when it is rotated. More specifically we have the auditd audit trail that is rotated based on size... So when the size of the logfile reaches ...
0
votes
0answers
17 views

how to send log content through udp to rsyslog

I'm a fresh Linux user. I was trying to write my application log to rsyslog docker instead of writing it on disk directly. I pulled the rsyslog docker from docker hub and made a configure file like ...
0
votes
0answers
22 views

$InputTCPMaxListeners and $InputTCPMaxSessions not being respected

I have set up many rulesets with $RulesetCreateMainQueue on and when I prepend $InputTCPMaxListeners and $InputTCPMaxSessions before any $InputTCPServerRun directives, the $InputTCPMaxListeners and $...
0
votes
0answers
34 views

rsyslog for SUSE Linux Enterprise Server 12 SP2

I need to ship a log "/opt/app/dbsv/dbsv.log" from one server to a centralized log server. What are the configurations that needs to be done to achieve this. \ I have added a conf file "dbsv.conf" ...
1
vote
2answers
46 views

rsyslog filter severity not working

I have following Rsyslog config to send logs to remote servers. Problem is its sending lots of INFO mesg to remote server and i don't want that noise. I am trying to configure filter so it send all ...
1
vote
2answers
37 views

How to get rid of number suffix in rsyslog's own 'programname' ang 'syslogtag' property

I'm forwarding logs from local rsyslogs to central rsyslog and then to Elasticsearch. Everything works fine, but entries with severity error generated by rsyslog itself have property programname like ...
0
votes
0answers
57 views

Apache log files rotation and webalizer

I have a default installation of Fedora 30 with httpd and webalizer. The webalizer is run in a cron job, but I have the problem that it seems that webalizer is not run regularly. Instead, there are ...
1
vote
0answers
94 views

Logrotate + rsyslog issue

Actually, i have an issue with rsyslog. When rsyslog should rotate the log (via logrotate); i got this issue : gzip: standard input: Bad file descriptor error: failed to compress log /var/log/...
0
votes
1answer
55 views

Rsyslog running on RHEL unable to forward messages - rsyslogd: action 'action 8' suspended

I'm trying to configure an rsyslog agent which will forward the log messages to a centralized server. However, I get the following error. The link provided in the error message does not specify the ...
1
vote
0answers
27 views

switching rsyslog destination file if a directory exists

I have configured rsyslog server to send logs from some remote hosts to specific files in my application directory like that: $template TmplApplication, "/whatever/jboss/logs/%fromhost-ip%/sum.log" ...
1
vote
0answers
184 views

rsyslog configuration without restart

I have a problem with logging. With my configuration below, I have to perform rsyslog restart if I want to have my application log file in /var/log. Also, I have to restart rsyslog it in case of log ...
1
vote
0answers
44 views

Double dots in kern.log

The kern.log in an embedded ARM linux system with the kernel 3.10.104 contains a lot of messages: 2019-06-24T14:13:43.056996+00:00 localhost kernel: .. 2019-06-24T14:13:43.596996+00:00 localhost ...
-1
votes
1answer
251 views

Rsyslog in not logging due to Selinux, is my workaround ok

I have these two parameters in /etc/rsyslog.conf $ModLoad imjournal # provides access to the systemd journal ... # Turn off message reception via local log socket; # local messages are retrieved ...
1
vote
1answer
404 views

How to disable messages from syslogd for my own user?

I am using a Centos Linux OS with ssh tools. I get these messages every minute. Message from syslogd@rakhsh4 at May 6 17:48:34 ... kernel:[Hardware Error]: Corrected error, no action required. ...
0
votes
0answers
303 views

How do I forward particular logs under a directory using rsyslog?

Trying to froward following logs from /home/ddlog/ms/logs/execution_logs/_abc-xyz-ms_* to VMware vRealize Log Insight using rsyslog. For some reason that does not seem to be working. I have tried ...
0
votes
0answers
34 views

CentOS 7 - Rsyslog error7

My syslog server does not write messages correctly, traffic capture shows me 100 events, but the file in /var/log/xxx.log only 50 or 60 Have rsyslogd 7.4.7, compiled with: FEATURE_REGEXP: ...
-1
votes
1answer
155 views

Syntax to only forward logs for certain contain condition

i needed to forward logs only if the log contained a certain keyword. I achieve this by adding this line in rsyslog.conf. :msg, !contains, "xyz" ~ I know this condition means that if log contains ...
1
vote
0answers
67 views

Parse log file continuously and send out a URL request to a predetermined IP address

We have a radius server which forwards the accounting messages to a Syslog server hosted on Linux server. we want to gather specific values from that log file and use those values as parameters in a ...
0
votes
0answers
37 views

how to update the log message about failure of service

I configured the service - calc_mem.service as the following Restart=on-failure RestartSec=5 StartLimitInterval=400 StartLimitBurst=3 the configuration above should do the following the service ...
0
votes
1answer
86 views

How to discard debug messages using rsyslog?

We have a requirement to write incoming debug messages to our rsyslog server, but not forward them on to our Splunk server. I have tried putting *.debug stop in front of our local rules, but that is ...
0
votes
1answer
313 views

How to keep kern.log out of syslog

I'm working on Ubuntu 16.04.3 and I found that I could get the log of kernel from two places: /var/log/kern.log and /var/log/syslog. /var/log/syslog contains other logs but I could find /var/log/kern....
1
vote
0answers
56 views

why messages logs are zero

we have linux machine: more /etc/redhat-release Red Hat Enterprise Linux Server release 7.2 (Maipo) all message files under /var/log are ZERO how it could be ? what is wrong here ? -rw-------. 1 ...
1
vote
1answer
1k views

Writing to /dev/kmsg randomly shows up in /proc/kmsg and always in dmesg?

When writing a message to /dev/kmsg while tailing /proc/kmsg the messages show up very randomly, in never shows up in /var/log/kern.log. However, dmesg gets all the messages correctly. Example # ...
0
votes
2answers
104 views

Syslog Output File Splitting HOURLY at Syslog Server

I have implemented syslog server on CentOS and using below Template to generate output file on daily basis - $template TmplNationalIP_PL, "/var/log/NIPFW/MX480/CGNAT_PL_%$year%.%$month%.%$day%" if ($...
0
votes
2answers
31 views

Centos 7 rsyslog service issue

I have a problem concerning rsyslog. After system reboot, the service does not start after a few tries. I noticed, that pid file still exists after reboot, and after rm /var/run/syslogd.pid I can ...
0
votes
1answer
104 views

How to negate certain messages based on negation syntax

I want to use negation to stop certain messages to be passed on the rsyslog bassed on the $rawmsg. Message exaple like: (root) CMD (LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/...
2
votes
1answer
215 views

How to discard particular Severity's in the Rsyslog Server

I have an rsyslog server that's having the data from multiple remote clients; now I want to discard particular Severity types like warn , info and debug and the rest of the messages I want to be ...
1
vote
1answer
425 views

What is causing my rsyslog timezone offset and / or time to be incorrect?

I have a central logging server running rsyslog 7.x on RHEL 6 The logs are coming in with a UTC time but an EST offset for a device. Here are some relevant configs. $template TEMPLATE_NAME,"%...
0
votes
0answers
700 views

rsyslog template with multiple filters and condition

This just in continuation of my previous post While working with the rsyslog configuration i have came across many challenges and got to know many caveats of it while most of my config is working now ...
0
votes
1answer
575 views

rsyslog conditional forwarding for remote logs de-formatting the date and time in the log file

I've another question about the conditional forwarding of logs via rsyslog.conf, i have below configuration. # cat /etc/rsyslog.conf ##################################################################...
1
vote
0answers
195 views

Installing mmdblookup module for rsyslog on Ubuntu

I am currently trying to perform an IP lookup in the MaxMind/GeoIP DB lookup via the mmdblookup module of rsyslog. (https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmdblookup.html) As ...
1
vote
1answer
605 views

How to forward rsyslog logs from multiple locations to ELK and make it show in kibana?

rsyslog server template consideration for multiple remote hosts ---> link to previously answered question @ meuh, I find this post very useful as am currently working on this configuration. I ...
0
votes
0answers
99 views

rsyslog: send logs to different file by filtering syslogs

I have a CentOS based rsyslog server which have the below settings, where it's getting all the remote NATing events from multiple hosts. $template TmplcpFW, "/var/log/%HOSTNAME%.log" if ($hostname == ...
0
votes
0answers
50 views

change maillog default path in rsyslog

I am using redhat linux and the default location of my postfix is /var/log/maillog . I am trying to change maillog location to /app/log/maillog. I have tried to update rsyslog.conf mail.* ...
3
votes
2answers
240 views

How to suppress rsyslogd HUPed messages from logcheck?

Getting these... Jan 7 06:25:01 debian liblogging-stdlog: [origin software="rsyslogd" swVersion="8.24.0" x-pid="551" x-info="http://www.rsyslog.com"] rsyslogd was HUPed Debian default logcheck ...
0
votes
0answers
83 views

Rsyslog concatenate postfix output

I'm trying to concatenate postfix log output with rsyslog directly. This is my template. template(name="TestMailTemplate" type="list"){ property(name="timestamp" dateFormat="rfc3339") constant(value="...
2
votes
1answer
788 views

Rsyslog exclude $programname from syslog

I get duplication on a remote rsyslog server: Even though I've configured a catch for clamav logs from mail servers - I still get the logs appearing in syslog # Configuration for Mail ClamAV logs in ...
2
votes
1answer
506 views

rsyslog conditional forwarding for remote logs

I have a rsyslog Server which have the below settings,Where its getting all the remote Linux systems logs and network logs. # cat /etc/rsyslog.conf $ModLoad imudp $UDPServerRun 514 $...
-8
votes
1answer
56 views

Write an login script on Ubuntu [closed]

The idea is that I need to write the username and the password and the script tell me who I am. if: username: admin pass: admin the script echo: "you are an admin" if: username: user pass: user the ...
1
vote
1answer
919 views

rsyslog: send logs to different file using custom template

So, I'm using systemd to send the logs to rsyslog, and I want to write the logs to /var/log/app.log. Since it is a Java app with its own log format, I don't want to have timestamps or anything on it,...
0
votes
1answer
89 views

Rsyslog alter log line before forwarding

being on Ubuntu 16.04.5 LTS with rsyslogd. We have the following situation: (1) An appliance forwards syslog to the Ubuntu host. (2) Ubuntu Host stores those forwarded messages in a separate logfile ...
1
vote
1answer
120 views

My attempts to use rsyslog to route messages to a log file

In myapp.service, I have : StandardOutput=syslog StandardErr=syslog When I do : $ journalctl -e -u myapp I can see each line of log contains "myapp[PID]". I've tried to set up /etc/rsyslog.d/...
-1
votes
1answer
156 views

Could I disable syslog.service after installing rsyslog on Ubuntu 18.04 server?

I am making a minimal Ubuntu for embedded system starting from Ubuntu base. Our samba-related script code relies on rsyslog so I installed this package. systemctl shows there is also a syslog.service,...
0
votes
1answer
169 views

journald socket buffering for option ForwardToSyslog

I have a configuration in which journald is set with ForwardToSyslog=yes. Quote from the documentation: If forwarding to syslog is enabled but nothing reads messages from the socket, ...
0
votes
1answer
66 views

How does systemd provide data to the service triggered by a socket?

The concept behind systemd sockets is to provide a "cheap listener service" that will start the "service that would normally bind that socket but we don't want to run it all the time" once data on the ...