Questions tagged [rsyslog]

rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

Filter by
Sorted by
Tagged with
1 vote
0 answers
8 views

Why is rsyslog not working properly?

rsyslog is failing to send messages to /var/log/messages and to the external syslog collector as detailed below. I have an AWS EC2 RHEL 7 instance and an on-premise RHEL 7 instance. They are both ...
user avatar
1 vote
1 answer
34 views

Systemd/rsyslog logging not working as expected

I've got a fairly vanilla Ubuntu 20.04LTS box where I've deployed Tomcat9 from repo. Out of the box, this appears to be configured to write its logs to /var/log/tomcat9/ and there are indeed log files ...
user avatar
  • 4,225
1 vote
0 answers
30 views

TLS 1.3 only for rsyslog on Debian and CentOS

We have an existing rsyslog set up using TLS 1.2 We want to upgrade to TLS1.3 ONLY. I've read the other questions here, but when I set everything up, I get no logs. The result of "openssl ...
user avatar
1 vote
1 answer
44 views

Rsyslog losing log message when file does not exist

I'm encountering case when rsyslog message is lost when the file its supposed to write to does not exist. Here is my setup: log server 192.168.1.2 have such config: module(load="imtcp") ...
user avatar
  • 177
1 vote
1 answer
45 views

Rsyslog Dropping messages before getting sent remote - filter not working

I am struggling with dropping certain syslog messages before rsyslog sends them to a remote logging server. Here is my entire rsyslog.conf file look like this: # /etc/rsyslog.conf configuration file ...
user avatar
  • 87
0 votes
0 answers
20 views

Example for Systemlogging with an output on the screen

Does anyone have an example to illustrate how to write a simple configuration on rsyslog that gives an output on the console?
user avatar
  • 37
0 votes
0 answers
31 views

rsyslog: discriminate between boots with new files or break line

I've got a system that uses rsyslog for logging. Some of the messages being logged I want to store on the device (error messages) so that if something has gone wrong I can review them later. All works ...
user avatar
  • 1
0 votes
2 answers
53 views

How can I have "rsyslogd" start automatically after a reboot?

I'm running an Ubuntu based distro Linux version 4.1.18-ipipe (ubuntu1604@ubuntu1604) (gcc version 4.9.3 (Ubuntu/Linaro 4.9.3-13ubuntu2) When this system boots up, rsyslogd is not running. So any C ...
user avatar
  • 587
2 votes
0 answers
63 views

Write logs to specifc file in linux

I have logs coming from my stormshield firewall to my debian server looking like this : 92.168.2.253 → 12.12.4.58 Syslog 758 USER.WARNING: 1 2021-12-22T10:45:38+01:00 FW-STORMSHIELD asqd - - - \357\...
user avatar
  • 21
0 votes
1 answer
34 views

Netconsole not sending UDP messages

I have set up netconsole logging on a CentOS 7 client. I added SYSLOGADDR=192.168.1.54 SYSLOGPORT=514 to /etc/sysconfig/netconsole, the ran systemctl start netconsole.service and systemctl enable ...
user avatar
2 votes
2 answers
855 views

Almalinux 8.5 - Log Files (secure, messages, cron, etc) are not populating / blank?

Running Almalinux 8.5, rsyslog version 8.2102.0-5.el8. A few weeks ago all my system logs (secure, messages, cron...) began to show 0 byte values. Turns out they are not receiving messages from the ...
user avatar
0 votes
0 answers
29 views

Syslog server redirects received logs for itself [duplicate]

I have a syslog server, I receive logs from up to 100 machines I receive logs in /syslog/year/month/day/serverIP/ and everything works fine. But the problem is that the server logs received lines into ...
user avatar
  • 11
0 votes
1 answer
64 views

Should (and how can) non-critical logs be sent to /var/log/messages using logger(1)?

I have a cron script logging msgs via | logger …. I am understanding that /var/log/syslog is mainly for critical or err msgs and /var/log/messages is for informational, non-critical msgs. If the ...
user avatar
1 vote
0 answers
107 views

How can I stop SSH server to send logs to syslog?

Debian 10 I have a lot of log info like this: localhost systemd[1]: Started Session 30522 of user xxxx. How can I stop sshd to send logging info to sysconf ? Thank you I reproduced what the ...
user avatar
4 votes
4 answers
541 views

cron: send error messages to file, when no MTA is installed

I get this message when there is an error in my crontab: cron: No MTA installed, discarding output I don't want to install a MTA on my system, but I also don't want to miss these error messages. ...
user avatar
1 vote
1 answer
101 views

rsyslog discard message

I'm trying to discard any "kernel: nfs: Deprecated parameter 'intr'" messages from /var/log/messages Rsyslog version: 8.1911.0-6.el8 In my /etc/rsyslog.conf file I have the following: module(...
user avatar
1 vote
1 answer
162 views

Rsyslog - Change Default Log Directory(/var/log) for multiple clients

I have 2 Clients connected to my rsyslog server. I want to change the default log directory for each client. So client A writes to /var/log/ClientA and client B writes to /var/log/clientB. I am ...
user avatar
  • 33
0 votes
0 answers
7 views

Howto put laptop to standby via shell and catch output

My Dell G3 Fedora 33 laptop stopped going to sleep after update. It almost does it but than screen wakes up again, then keyboard is dead, and all I can do is to hard turn off. How to put it to sleep ...
user avatar
  • 66
0 votes
0 answers
26 views

How to avoid multiple sequence numbers with logrotate

I want to use a central syslog-server (Ubuntu 20.04) to collect log events from other linux servers. This is the logrotate.d config file I use: rotate 90 daily missingok nocompress dateext dateformat ...
user avatar
  • 1
1 vote
2 answers
138 views

Rsyslog - Parsing audit.log / omprog change log value

I'm trying to parse audit.log with rsyslog by using a bash script in order to transform the hex part of proctitle to ascii. However I do not get ressults: the file audit_ascii.log do not have lines ...
user avatar
1 vote
1 answer
106 views

Sending logs between rsyslog (client) and syslogd (server)

I have two machines. First of them runs embedded Linux and the second one runs FreeBSD. The machine with Linux has rsyslog and needs to be a syslog client. The other one has installed syslogd and ...
user avatar
0 votes
1 answer
37 views

How to stop rsyslog output TIMESTAMP

this same question has already received a solution but it doesn't work I'm looking for exactly this, I apply it in my rsyslog but it doesn't work for me, I restart my rsyslog, and nothing, I restart ...
user avatar
0 votes
1 answer
288 views

How to prevent rsyslog from logging cron tasks to /var/log/syslog using additional config

I have a Docker image for cron tasks. Here is the Dockerfile: FROM php:8.0-fpm RUN apt-get update RUN apt-get install -y cron rsyslog RUN touch /var/log/cron.log RUN chmod 0777 /var/log/cron.log ...
user avatar
1 vote
0 answers
148 views

how to write logs to specific file from kernel space?

I have a kernel module that uses printk() for debugging. printk() logs to /var/log/messages. /var/log/messages contains information of other modules too. I am trying to implement dynamic tracing for ...
user avatar
  • 11
0 votes
1 answer
158 views

Rsyslog remote and local log [duplicate]

I got a little problem, i try to use rsyslog for both local and remote log from a server. Since i use this configuration to get the remote log, my local logs are empty. Any help please ? is it the *.* ...
user avatar
  • 57
0 votes
0 answers
82 views

Rsyslog - how to stop sending logs to a console

I've just started using rsyslog on my embedded Linux built with Yocto. Some logs are printing in a console what is very annoying. I find a way to disable it calling dmesg -n <level>. This ...
user avatar
0 votes
0 answers
73 views

How to redirect some specific messages to a particular file with syslogd?

I would like syslogd to write one specific log message to a specific file. I foud the syntax for rsyslog: :msg, contains, "some text" /path/to/file When I add it to /etc/syslog.conf and try ...
user avatar
0 votes
0 answers
229 views

How to send openvpn syslog?

I'm trying to figure out how I can send openvpn syslog message to a remote server. Openvpn documentation is non existent but according to server.conf messages should be forwarded to syslog by default ...
user avatar
  • 434
0 votes
0 answers
24 views

CentOS remote syslog message stores in two files [duplicate]

I am using rsyslog server in CentOS steam. want to log each remote server log message in /data/log/<hostname>.log and local server message in /var/log/message file. using below configuration, ...
user avatar
  • 310
0 votes
1 answer
311 views

RSYSLOG force only TLS 1.3 version

Debian: 10.10 rsyslog-gnutls: 8.1901.0-1 libgnutls: 30.6.7 I search in where path and name file insert this var "gnutlsPriorityString". What is her path? And her Name file? to put this var &...
user avatar
  • 5
0 votes
0 answers
67 views

Getting rsyslog to fwd to Splunk from Ubuntu .20.04

So I've got an Ubuntu 20.04 LTS server setup with Haproxy and I'm trying to fwd log info to Splunk Cloud. I have the Haproxy.cfg with a Global entry: log 127.0.0.1 local4 And I've got an entry in /...
user avatar
  • 53
0 votes
1 answer
435 views

rsyslog custom log file permissions

I have haproxy service running on the server. For haproxy logging created following /etc/rsyslog.d/haproxy.conf file with content mentioned below: $ModLoad imudp $UDPServerAddress 127.0.0.1 $...
user avatar
  • 1
3 votes
0 answers
90 views

Calculating MAX NOFILE and MAX NPROC on Linux Servers

Is there any formula or basis that we can consider to calculate hard and soft limits for NPROC and NOFILE? My system is currently using 4096 for NOFILE which is the default value, and we recently had ...
user avatar
1 vote
0 answers
170 views

What are the message formats in `/var/log/syslog` and the output of `dmesg`?

On Debian or Ubuntu, what are the formats of /var/log/syslog and the output of dmesg? In /var/log/syslog, I figure from Apr 1 08:15:01 mycomputer CRON[12494]: (root) CMD (command -v debian-sa1 > /...
user avatar
  • 81
0 votes
1 answer
488 views

In syslog or rsyslog, are ring buffer, queue of message, and write buffer the same?

Are the ring buffer, the queue of messages, and the write buffer the same? If not, how do ring buffer, queue and write buffer work together in syslogd or rsyslogd? Most implementations of syslogd ...
user avatar
  • 81
0 votes
1 answer
949 views

Have SELinux allow syslog and logrotate to handle files outside of /var/log

on a Centos 8 server, I attached a bigger disk mounted to /mnt/data. The server runs rsyslogd which has a policy to write logs from external systems to /mnt/data/logs/$HOSTNAME. I do now have the ...
user avatar
1 vote
0 answers
274 views

Rsyslog - send logs to remote server

I'm trying to send service log files to a centralized Rsyslog server. On the Syslog server, I have a simple configuration $template DailyPerHostLogs,"/var/log/syslog/%$DAY%/%Fromhost-ip%/%...
user avatar
  • 11
0 votes
1 answer
776 views

rsyslog not logging kern messages

I'm using Ubuntu 20.04 with rsyslog and up-to-date packages. I want to log messages from iptables. I can see those messages with dmesg - it shows the data I expect. deploy$ dmesg -x kern :warn : [...
user avatar
1 vote
1 answer
273 views

Rsyslogd spamming messages when hard drive is full

We are monitoring a few Linux servers (mostly CentOS 8) that aren't administrated by us, but we're responsible for providing the VMs. These servers have rsyslog installed and are sending messages to ...
user avatar
0 votes
1 answer
93 views

Forwarding Data From rsyslog

We have set up a centralized syslog server (RHEL 7 running rsyslogd) that receives syslog data from most of our hosts. Our Security team wants to receive data as well. I'd prefer not to duplicate the ...
user avatar
0 votes
1 answer
302 views

Rsyslog - prevent local host logging twice

I've enabled remote logging in my rsyslog.conf with: # provides UDP syslog reception module(load="imudp") input(type="imudp" port="514") and then in /etc/rsyslog.d/...
user avatar
  • 25
1 vote
1 answer
246 views

Any way to keep Stunnel from blowing up my logfiles?

I have stunnel v5.44 (Ubuntu 18.04 v3:5.44-1ubuntu3) configured on a client to connect to a server in a screened subnet. The remote host has syslog configured to listen for logfiles over the stunnel ...
user avatar
1 vote
0 answers
428 views

rsyslog only forwarding to remote server with logger -n and rsyslogd -n

Having an issue with forwarding rsyslog to a remote server and I can't quite pin it down. I don't think anything is wrong with my rsyslog.conf, seen below. I basically just added the line to forward ...
user avatar
1 vote
1 answer
401 views

How to record local3 with all severity levels to a file using system logger?

I'm using a VM. Ubuntu Linux. What I'm trying to do is use System logger to record the local3 facility with all severity levels to a file /var/log/local3.log I'm confused as to what the process is. Am ...
user avatar
4 votes
2 answers
3k views

Does Linux's rsyslog support RFC 5424?

For some reason, rsyslogd does not seem to be able to properly interpret a valid RFC 5424 message. Even the example given by the RFC does not work: $ echo "<165>1 2003-08-24T05:14:15.000003-...
user avatar
1 vote
1 answer
539 views

How to configure rsyslogd to emit rfc5424 messages?

I want to configure my Linux machine using rsyslogd with the simplest yet standard way. I'll save all the logs to /var/log/syslog with rotation. From my research it looks like the standard syslog ...
user avatar
0 votes
1 answer
169 views

Missing syslog entries for OpenSSH

I would like to save the log for OpenSSH client. The manual says that I can use ssh -y example.com to turn on logging. Configuration manual says that the default Syslog facility is user; I didn't ...
user avatar
  • 1,073
1 vote
0 answers
319 views

Error message starting rsyslog after configuring system logging without journald on RHEL 7

I followed this procedure from Red Hat website https://access.redhat.com/articles/4058681 to configuring system logging without journald but after reboot rsyslog failed to start. edit the /etc/...
user avatar
3 votes
1 answer
319 views

How to combine template and outchannel together in rsyslog.conf?

i am try to play with rsyslog configuration. To my knowledge To enable log rotation: we should do something below: $outchannel log_rotation,/var/log/syslog.log, 1048576 ,/usr/bin/rotate.sh *.* :omfile:...
user avatar
  • 41
-1 votes
3 answers
64 views

rhel 7.x machines unexpected failure and message file

we have today strange behavior with our Linux server rhel 7.6 from some reason server goes down and from the messages file we can see that server stop be available on Oct 16 18:17:22 after some ...
user avatar
  • 10.9k

1
2 3 4 5
8