Questions tagged [rsyslog]

rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

Filter by
Sorted by
Tagged with
0 votes
1 answer
29 views

Finding the PORT NUMBER of the process using a specific PID?

I have a specific PID and my question is how can I know which port belongs to that PID. Any tips on how to know the port of a service that has a specific PID? Thanks a lot.
  • 1
1 vote
0 answers
14 views

/dev/log: Connection refused after boot, but only on one system

I have two systems running NVIDIA jetpack 5.0.2, based on Ubuntu 20.04. /etc and /boot are identical on both systems. On the first system, after boot, if I try to run logger I get an error /dev/log: ...
  • 201
1 vote
0 answers
16 views

Any way to change rsyslog configuration per user (for cron)?

I am a user without sudo on a CentOS 7 system running rsyslog. I would like to log my cronjobs. Ideally, rsyslog would log all my user's cron activity to somewhere like ~/log/cron. There are good ...
  • 411
1 vote
0 answers
36 views

rsyslog forwarding msg using template format to remote server

I want to send logs from 2 client servers to a single remote server. The client config : ... module(load="imfile" PollingInterval="10") # Polling every 10 secondes ... ...
  • 111
1 vote
1 answer
21 views

rsyslog config does not write to file

I just installed rsyslog on rhel8. So the /etc/rsyslog.conf file is stock. Here's my custom config: /etc/rsyslog.d/10-remote.conf module(load="imudp") ruleset(name="remote_udp"){ ...
1 vote
1 answer
32 views

kernel: USB disconnect message

When I plug in USB disk, I get a message like this: kernel: usb 2-10.2: new SuperSpeed USB device number 5 using xhci_hcd kernel: usb-storage 2-10.2:1.0: USB Mass Storage device detected kernel: scsi ...
0 votes
1 answer
61 views

rsyslog: how to cut string from starting field to end of message

i have some messy devices which i want to handle trough rsyslog 90% of job is done, but i am stuck here rawmsg: '<133>2022-07-15 17:11:11 eleservice-sw02 51891 Logout the web by admin on web (...
  • 1
0 votes
1 answer
26 views

Forwarding historic (old) syslog to syslog server

We can forward syslogs to syslog server by making the below entry in syslog.conf/rsyslog.conf *.*<space/tab>@<syslog_server_name>:<port_no> However, this only sends new syslogs, ...
  • 3
2 votes
1 answer
53 views

Generating fake old log messages e.g. six months old ( fake timestamp ) for syslog RFC5424

Good day; I need to test my log management stack's database query performance and in order to do so, I need to generate bulks of log messages that seem to be six months old and send them to rsyslogd. ...
  • 50
1 vote
1 answer
63 views

Can't find cron config file

I have CentOS 7 and am trying to access a configuration file that looks a little something like this: # Cron configuration options # For quick reference, the currently available log levels are: # 0 ...
0 votes
1 answer
38 views

How to stop cron logs from getting sent to syslog?

I posted this question in the Superuser community but maybe this forum is better suited to my question: I'm sending logs to a syslog server, but cron logs there are taking up more space than they ...
0 votes
1 answer
49 views

Postfix not logging authentication failures

I have a postfix server running on Ubuntu 18.04lts with authentication enabled. (from main.cf) smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination ...
  • 4,374
0 votes
0 answers
20 views

Custom file for syslog messages received by rsyslog

We are trying to forward syslog from network devices to a rsyslog ( Centos 7.9 ) and it seems to be writing it all in /var/log/messages. Is there a way to write this into another custom file?
  • 1,761
0 votes
2 answers
166 views

How to redirect stdout and stderr to rsyslog permamently in Linux

I use an embedded Linux build in Yocto. I would like none of the applications running on the system to display information in the console. I would like to redirect these logs to syslog, or eventually, ...
1 vote
2 answers
2k views

How can journald be disabled?

I've recently learned that journalctl is occupying a big chunk of my 16GB SD card (Raspberry Pi): $ journalctl --disk-usage Archived and active journals take up 312.1M in the file system. I don't ...
  • 2,275
0 votes
0 answers
130 views

How to reload (kill -HUP) rsyslog.service after a mount point comes up with systemd?

I've set up rsyslog to copy certain logs on a separate volume. I want it to be up as early as possible for obvious reasons, but also I want it to start writing to the volume as soon as it becomes ...
  • 1,584
1 vote
1 answer
164 views

Why is rsyslog not working properly?

rsyslog is failing to send messages to /var/log/messages and to the external syslog collector as detailed below. I have an AWS EC2 RHEL 7 instance and an on-premise RHEL 7 instance. They are both ...
1 vote
1 answer
260 views

Systemd/rsyslog logging not working as expected

I've got a fairly vanilla Ubuntu 20.04LTS box where I've deployed Tomcat9 from repo. Out of the box, this appears to be configured to write its logs to /var/log/tomcat9/ and there are indeed log files ...
  • 4,374
1 vote
0 answers
93 views

TLS 1.3 only for rsyslog on Debian and CentOS

We have an existing rsyslog set up using TLS 1.2 We want to upgrade to TLS1.3 ONLY. I've read the other questions here, but when I set everything up, I get no logs. The result of "openssl ...
1 vote
1 answer
221 views

Rsyslog losing log message when file does not exist

I'm encountering case when rsyslog message is lost when the file its supposed to write to does not exist. Here is my setup: log server 192.168.1.2 have such config: module(load="imtcp") ...
  • 187
1 vote
1 answer
171 views

Rsyslog Dropping messages before getting sent remote - filter not working

I am struggling with dropping certain syslog messages before rsyslog sends them to a remote logging server. Here is my entire rsyslog.conf file look like this: # /etc/rsyslog.conf configuration file ...
  • 109
0 votes
0 answers
29 views

Example for Systemlogging with an output on the screen

Does anyone have an example to illustrate how to write a simple configuration on rsyslog that gives an output on the console?
  • 37
0 votes
0 answers
35 views

rsyslog: discriminate between boots with new files or break line

I've got a system that uses rsyslog for logging. Some of the messages being logged I want to store on the device (error messages) so that if something has gone wrong I can review them later. All works ...
  • 1
0 votes
2 answers
162 views

How can I have "rsyslogd" start automatically after a reboot?

I'm running an Ubuntu based distro Linux version 4.1.18-ipipe (ubuntu1604@ubuntu1604) (gcc version 4.9.3 (Ubuntu/Linaro 4.9.3-13ubuntu2) When this system boots up, rsyslogd is not running. So any C ...
  • 889
2 votes
0 answers
65 views

Write logs to specifc file in linux

I have logs coming from my stormshield firewall to my debian server looking like this : 92.168.2.253 → 12.12.4.58 Syslog 758 USER.WARNING: 1 2021-12-22T10:45:38+01:00 FW-STORMSHIELD asqd - - - \357\...
  • 21
0 votes
1 answer
67 views

Netconsole not sending UDP messages

I have set up netconsole logging on a CentOS 7 client. I added SYSLOGADDR=192.168.1.54 SYSLOGPORT=514 to /etc/sysconfig/netconsole, the ran systemctl start netconsole.service and systemctl enable ...
2 votes
2 answers
2k views

Almalinux 8.5 - Log Files (secure, messages, cron, etc) are not populating / blank?

Running Almalinux 8.5, rsyslog version 8.2102.0-5.el8. A few weeks ago all my system logs (secure, messages, cron...) began to show 0 byte values. Turns out they are not receiving messages from the ...
0 votes
0 answers
29 views

Syslog server redirects received logs for itself [duplicate]

I have a syslog server, I receive logs from up to 100 machines I receive logs in /syslog/year/month/day/serverIP/ and everything works fine. But the problem is that the server logs received lines into ...
  • 11
0 votes
1 answer
291 views

Should (and how can) non-critical logs be sent to /var/log/messages using logger(1)?

I have a cron script logging msgs via | logger …. I am understanding that /var/log/syslog is mainly for critical or err msgs and /var/log/messages is for informational, non-critical msgs. If the ...
1 vote
0 answers
184 views

How can I stop SSH server to send logs to syslog?

Debian 10 I have a lot of log info like this: localhost systemd[1]: Started Session 30522 of user xxxx. How can I stop sshd to send logging info to sysconf ? Thank you I reproduced what the ...
4 votes
4 answers
966 views

cron: send error messages to file, when no MTA is installed

I get this message when there is an error in my crontab: cron: No MTA installed, discarding output I don't want to install a MTA on my system, but I also don't want to miss these error messages. ...
1 vote
1 answer
350 views

rsyslog discard message

I'm trying to discard any "kernel: nfs: Deprecated parameter 'intr'" messages from /var/log/messages Rsyslog version: 8.1911.0-6.el8 In my /etc/rsyslog.conf file I have the following: module(...
  • 91
1 vote
1 answer
529 views

Rsyslog - Change Default Log Directory(/var/log) for multiple clients

I have 2 Clients connected to my rsyslog server. I want to change the default log directory for each client. So client A writes to /var/log/ClientA and client B writes to /var/log/clientB. I am ...
  • 33
0 votes
0 answers
47 views

How to avoid multiple sequence numbers with logrotate

I want to use a central syslog-server (Ubuntu 20.04) to collect log events from other linux servers. This is the logrotate.d config file I use: rotate 90 daily missingok nocompress dateext dateformat ...
  • 1
1 vote
2 answers
275 views

Rsyslog - Parsing audit.log / omprog change log value

I'm trying to parse audit.log with rsyslog by using a bash script in order to transform the hex part of proctitle to ascii. However I do not get ressults: the file audit_ascii.log do not have lines ...
1 vote
1 answer
279 views

Sending logs between rsyslog (client) and syslogd (server)

I have two machines. First of them runs embedded Linux and the second one runs FreeBSD. The machine with Linux has rsyslog and needs to be a syslog client. The other one has installed syslogd and ...
0 votes
1 answer
73 views

How to stop rsyslog output TIMESTAMP

this same question has already received a solution but it doesn't work I'm looking for exactly this, I apply it in my rsyslog but it doesn't work for me, I restart my rsyslog, and nothing, I restart ...
0 votes
1 answer
606 views

How to prevent rsyslog from logging cron tasks to /var/log/syslog using additional config

I have a Docker image for cron tasks. Here is the Dockerfile: FROM php:8.0-fpm RUN apt-get update RUN apt-get install -y cron rsyslog RUN touch /var/log/cron.log RUN chmod 0777 /var/log/cron.log ...
1 vote
0 answers
184 views

how to write logs to specific file from kernel space?

I have a kernel module that uses printk() for debugging. printk() logs to /var/log/messages. /var/log/messages contains information of other modules too. I am trying to implement dynamic tracing for ...
  • 11
0 votes
1 answer
437 views

Rsyslog remote and local log [duplicate]

I got a little problem, i try to use rsyslog for both local and remote log from a server. Since i use this configuration to get the remote log, my local logs are empty. Any help please ? is it the *.* ...
  • 57
0 votes
0 answers
443 views

How to send openvpn syslog?

I'm trying to figure out how I can send openvpn syslog message to a remote server. Openvpn documentation is non existent but according to server.conf messages should be forwarded to syslog by default ...
  • 454
0 votes
0 answers
24 views

CentOS remote syslog message stores in two files [duplicate]

I am using rsyslog server in CentOS steam. want to log each remote server log message in /data/log/<hostname>.log and local server message in /var/log/message file. using below configuration, ...
  • 320
0 votes
1 answer
496 views

RSYSLOG force only TLS 1.3 version

Debian: 10.10 rsyslog-gnutls: 8.1901.0-1 libgnutls: 30.6.7 I search in where path and name file insert this var "gnutlsPriorityString". What is her path? And her Name file? to put this var &...
  • 15
0 votes
0 answers
123 views

Getting rsyslog to fwd to Splunk from Ubuntu .20.04

So I've got an Ubuntu 20.04 LTS server setup with Haproxy and I'm trying to fwd log info to Splunk Cloud. I have the Haproxy.cfg with a Global entry: log 127.0.0.1 local4 And I've got an entry in /...
  • 53
0 votes
1 answer
670 views

rsyslog custom log file permissions

I have haproxy service running on the server. For haproxy logging created following /etc/rsyslog.d/haproxy.conf file with content mentioned below: $ModLoad imudp $UDPServerAddress 127.0.0.1 $...
  • 1
3 votes
0 answers
111 views

Calculating MAX NOFILE and MAX NPROC on Linux Servers

Is there any formula or basis that we can consider to calculate hard and soft limits for NPROC and NOFILE? My system is currently using 4096 for NOFILE which is the default value, and we recently had ...
1 vote
0 answers
293 views

What are the message formats in `/var/log/syslog` and the output of `dmesg`?

On Debian or Ubuntu, what are the formats of /var/log/syslog and the output of dmesg? In /var/log/syslog, I figure from Apr 1 08:15:01 mycomputer CRON[12494]: (root) CMD (command -v debian-sa1 > /...
  • 81
0 votes
1 answer
610 views

In syslog or rsyslog, are ring buffer, queue of message, and write buffer the same?

Are the ring buffer, the queue of messages, and the write buffer the same? If not, how do ring buffer, queue and write buffer work together in syslogd or rsyslogd? Most implementations of syslogd ...
  • 81
0 votes
1 answer
1k views

Have SELinux allow syslog and logrotate to handle files outside of /var/log

on a Centos 8 server, I attached a bigger disk mounted to /mnt/data. The server runs rsyslogd which has a policy to write logs from external systems to /mnt/data/logs/$HOSTNAME. I do now have the ...
1 vote
0 answers
378 views

Rsyslog - send logs to remote server

I'm trying to send service log files to a centralized Rsyslog server. On the Syslog server, I have a simple configuration $template DailyPerHostLogs,"/var/log/syslog/%$DAY%/%Fromhost-ip%/%...
  • 11

1
2 3 4 5
8