Questions tagged [rsyslog]

rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

Filter by
Sorted by
Tagged with
1
vote
0answers
16 views

rsyslog only forwarding to remote server with logger -n and rsyslogd -n

Having an issue with forwarding rsyslog to a remote server and I can't quite pin it down. I don't think anything is wrong with my rsyslog.conf, seen below. I basically just added the line to forward ...
1
vote
1answer
38 views

How to record local3 with all severity levels to a file using system logger?

I'm using a VM. Ubuntu Linux. What I'm trying to do is use System logger to record the local3 facility with all severity levels to a file /var/log/local3.log I'm confused as to what the process is. Am ...
1
vote
1answer
92 views

Does Linux's rsyslog support RFC 5424?

For some reason, rsyslogd does not seem to be able to properly interpret a valid RFC 5424 message. Even the example given by the RFC does not work: $ echo "<165>1 2003-08-24T05:14:15.000003-...
0
votes
0answers
64 views

rsyslogd: sd_journal_get_cursor() failed: 'Cannot assign requested address'

I have 2 physical and 4 VM machines. all have CentOS 7.5 as OS. once a day i get this error in their /var/log/messages: rsyslogd: sd_journal_get_cursor() failed: 'Cannot assign requested address' ...
1
vote
1answer
40 views

How to configure rsyslogd to emit rfc5424 messages?

I want to configure my Linux machine using rsyslogd with the simplest yet standard way. I'll save all the logs to /var/log/syslog with rotation. From my research it looks like the standard syslog ...
0
votes
1answer
27 views

Missing syslog entries for OpenSSH

I would like to save the log for OpenSSH client. The manual says that I can use ssh -y example.com to turn on logging. Configuration manual says that the default Syslog facility is user; I didn't ...
0
votes
0answers
8 views

Rsyslog to limit backlogs on database?

I just connected my Rsyslog to a MariaDB database called Syslog. Is it possible to set rsyslog to automatically limit the data within the database to contain only 3-4 months worth of backlogs? Like ...
1
vote
0answers
24 views

Error message starting rsyslog after configuring system logging without journald on RHEL 7

I followed this procedure from Red Hat website https://access.redhat.com/articles/4058681 to configuring system logging without journald but after reboot rsyslog failed to start. edit the /etc/...
0
votes
1answer
44 views

How to combine template and outchannel together in rsyslog.conf?

i am try to play with rsyslog configuration. To my knowledge To enable log rotation: we should do something below: $outchannel log_rotation,/var/log/syslog.log, 1048576 ,/usr/bin/rotate.sh *.* :omfile:...
-1
votes
3answers
46 views

rhel 7.x machines unexpected failure and message file

we have today strange behavior with our Linux server rhel 7.6 from some reason server goes down and from the messages file we can see that server stop be available on Oct 16 18:17:22 after some ...
1
vote
2answers
32 views

Where are manual locations for $configs?

In Ubuntu, when I run the command man rsyslog.conf, a manual page comes up. So I tried to find the location of this man page by whereis -m rsyslog.conf, but it didn't give me any results. Should I use ...
0
votes
1answer
33 views

rainerscript: how to log to file named $programname substring?

How can I write a rainerscript rule to log to a file whose name is a substring of $programname? I want something along the lines of this pseudo-rule: if $programname startswith "foo" then /...
0
votes
0answers
443 views

rsyslogd[xxxx]: error during config processing: STOP is followed by unreachable statements

I have the following configuration in master syslog server: [root@STGSYSLOG ~]# egrep -v "^$|^#" /etc/rsyslog.conf $MaxMessageSize 32k $ModLoad imuxsock # provides support for local system ...
1
vote
0answers
32 views

rsyslog is creating empty directories

I have the following rsyslog configurations. SYSLOG MASTER(centos 7.x): [root@SYSLOGMASTER ~]# egrep -i "UDP|TCP|template" /etc/rsyslog.conf -A3 # Provides UDP syslog reception $ModLoad ...
3
votes
1answer
129 views

how are early logs logged in rsysylog, when rsysylog is not yet running?

I am using rsyslog on Debian Buster. I am using old-style sysvinit, not systemd. rsyslog is started late in the init startup sequence, after most init scripts have run. The dmesg messages during boot ...
0
votes
1answer
674 views

systemd-journald and rsyslogd: high cpu usage

This is a fresh Debian 10 installation that's two-three weeks old. For the last couple of days, my system has been acting up, it would just slow down and I would not be able to use sudo in the ...
0
votes
1answer
9 views

Full text of commands cut off in /var/log/secure

I've got a server that's using rsyslogd. When looking for commands run by specific users in /var/log/secure, I see that some commands appear to be cut off. For example, you can see that the beginning ...
2
votes
2answers
245 views

rsyslog.conf config check issues

Running rsyslogd -N 1, I receive two complains : rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 27: parameter 'RebindInterval' not known -- typo in config file? [v8.27.0 try ...
0
votes
0answers
11 views

How can I send logs from rsyslog to systemd?

In a previous question I tried to configure logging network traffic with: https://serverfault.com/questions/1029234/how-can-i-log-all-network-activity-with-iptables/1029235 I had a rysyslog config ...
0
votes
0answers
79 views

Configuring rsyslog for sending log files to diffrerent remote machines

I am newbie in using rsyslog - I have a scenario where in I want to send file1.log, file2.log to remote machine say 10.10.10.123 , and file3.log to a remote machine say 10.11.11.123. Is it possible ...
0
votes
0answers
60 views

Custom logrotate with hostnames

I have recently set up my central log server on CentOS 8, I had the following template on my main server: $template RemoteMessages, "/var/log/%HOSTNAME%/messages" $template RemoteSecure, &...
0
votes
2answers
38 views

Is rsyslog a mandatory requirement in Linux with journald?

Note that this question is mainly about the openSUSE distro, but a general answer will also be appreciated. Since journald can be used to do all the logging work (when forwardtosyslog option is ...
1
vote
0answers
162 views

Replacing rsyslog with journald for a more modern approach of logging

I'm looking for a more modern way of keeping logs my Linux servers. Rsyslog still strongly relies on logrotate to keep logs maintainable and space occupation by logs to a minimum, which is not a ...
0
votes
1answer
121 views

Where to find / How to install missing imjournal shared object file (/usr/lib/rsyslog/imjournal.so) for rsyslog

I am playing around with logging using rsyslog and journald and I wanted to see how effective the imjournal module was. So I added $ModLoad imjournal to my /etc/rsyslog.conf and restarted rsyslog. ...
1
vote
1answer
40 views

Can I group load-balanced apache http logs on a rsyslog log server by VirtualHost?

I have an array of load balanced app servers (app1-app4) for multiple websites logging to a single log server (log1). I would like the logs on the log server to be grouped by virtualhost so I can see ...
0
votes
1answer
123 views

How to replace timestamp of messages received on an rsyslog server with a local timestamp?

I have a router that forwards its logs to an rsyslog server and I'd like to configure the rsyslog server to replace the timestamp with a local timestamp. The message format looks like this: Jan 1 00:...
1
vote
0answers
14 views

Unable to create nested Syslog filter with NOT condition

I have a syslog filter setup in my syslog.conf file and data is getting filtered and coming in. source s_network { tcp(port(6514) max-connections(100) keep-alive(yes) tls( key_file("/opt/certs/cert....
1
vote
0answers
36 views

rsyslog not sending nova, neutron logs from openstack controller

I have my rsyslog server setup and I want to collect logs from my OpenStack controller. I have followed these steps, https://wiki.openstack.org/wiki/OpsGuide-Logging-RSysLog but I am not able to see ...
0
votes
0answers
35 views

rsyslog server and client not working when roles are switched

I have two CentOS-7 machines. I have configured one as a rsyslog server and the other as rsyslog client. I am using UDP/514. In rsyslog server machine I have added the following entries in the /etc/...
1
vote
1answer
24 views

How to figure out why this process is terminated accidentally On Ubuntu16.04

I tried to run a python script which trains a lstm model on a server. (figure 1 server's OS information.) However,everytime before the traning ends,the process will be terminated. (figure2&3 ...
1
vote
1answer
157 views

rsyslog: can you check if two local variables are equal?

EDIT: More context. I have the follow example: set $.dev1IP = 192.168.1.1; set $.dev2IP = 192.168.1.2; set $.dev3IP = 192.168.1.3; set $.sourceIP = $fromhost-ip; set $.sourceTag = ""; template(...
0
votes
0answers
37 views

How do I 'tail -f' to a file, while also executing a script utilising that file indefinitely?

I am so close to getting it, but fear I have spent too long looking at this and am getting lost as to how to accomplish what I want. What I am trying to do: Take the access log from my server, parse ...
1
vote
1answer
113 views

rsyslog: how to extract values from metadata and store in variable?

I currently have the following input configuration: input(type="imfile" File="/scp_tmp/<source_ip_address>/*.log" addMetadata="on") And two global variables: set $.sourceIP = $...
1
vote
1answer
261 views

rsyslog: how to assign properties in imfile?

I have rsyslog configured to listen on UDP/514 for syslogs from other devices in my environment, but I have a certain logs that cannot be sent through normal UDP/TCP syslog and the only way to do so ...
0
votes
1answer
72 views

Does rsyslog ignore any files under rsyslog.d that do not end in .conf?

The reason why I ask this is that I want to configure my deployment in a modular manner. I would have N number of text files where I can edit how rsyslog behaves in N number of cases, all of which ...
0
votes
1answer
117 views

Is UDP data lost when executing kill -HUP on rsyslog?

I am very new to rsyslog and I am going through the documentation as well as seeing examples of what other people have done with their configuration and a question came to mind when the topic of log ...
0
votes
1answer
56 views

Error while rotating logs

I am two issue with the /var/log/message rotation. Below is the log-message configuration # cat /etc/logrotate.d/logrotate-messages /var/log/messages { daily rotate 7 create dateext ...
0
votes
1answer
92 views

Understanding rsyslog log format and filtering

I am working on filtering logs from syslog and forwading to another log. I am able too capture/filter the log based on "internal-sftp". By using if $programname == 'internal-sftp' then /var/log/...
2
votes
1answer
91 views

rsyslog not writing dynamic log file

The systemd unit files for my Java apps (on Ubuntu 18.04) appear to be working - I had set stdout and stderr to be sent to syslog and the log entries were appearing in /var/log/syslog. However I want ...
3
votes
0answers
517 views

Journald to rsyslog forwarding confusion

I do not really understand the forwarding from Journald to Rsyslog. Basically I understood it in the way that the 'pipeline' is built up as follows: Kernel logs through printk() → /proc/kmesg ← ...
1
vote
1answer
310 views

SFTP user activity logging on Ubuntu 16.04.4 LTS

I'm using Ubuntu Server 16.04.4 LTS to set up a SFTP server via openssh-sftp-server 1:7.2p2-4ubuntu2.8 from my Server I would like to log user activity (change dir, upload/download file etc). So, I am ...
0
votes
1answer
49 views

Rsyslog not saving logs from another servers into custom directories

I am receving logs on UDP 514 from another server and i have configured rsyslog.conf to save the logs to another custom directory but i am unable to do so, i confirmed through tcpdump logs are getting ...
0
votes
0answers
52 views

Linux Rsyslog disable DNS resolution per facility / log file

I have some cisco logs coming to a linux server on facility4, (local4.*) via udp/514. I know I can disable DNS resolution globally with global(net.enableDNS="off") in the rsyslog.conf file but is ...
0
votes
1answer
42 views

Troubleshooting rsyslog 8.32 on Ubuntu writing to MariaDB

I am trying to get LogAnalyzer running and setup the system based on How to setup loganalyzer with rsyslog on Ubuntu 16.04 LTS / Ubuntu 18.04 LTS. It went smoothly up until the first of LogAnalyzer ...
0
votes
0answers
15 views

Remote host logs are being stored on /var/log/messages along with specified path in rsyslog.conf

I am facing the same issue. Remote host logs are being saved to /var/log/messages also. I tried & stop or & ~ but it gives me error when I try to use these keyworkds inmy rsyslog.conf file ...
1
vote
1answer
60 views

rsyslog logs are not stored in queue files

I’m using rsyslog 8.40 and I’m trying to setup logforwarding with queues. I was able to send logs to the forwarding servers using the following configurations. action(type="omfwd" target="host1" ...
2
votes
0answers
16 views

secure log file data not up to date, behind a few hours

When I tail -f my /var/secure log file the data in it is about 3 hours behind the current time. This only happens when someone attacks this particular server and the secure log files blows up with ...
1
vote
1answer
52 views

Getting messages from services that don't exist

For about 3 hours this afternoon, I got the following messages from services that I don't have (either uninstalled or never heard of): [2020-01-27 14:02:57] dss-mint [daemon.info] [systemd] Started ...
1
vote
2answers
271 views

/var/log/messages growing indefinately because rsyslog won't let it be deleted

I had an issue with /var running low on space despite it only appearing to have only 2 gigs of files allocated on the 5 gig partition. I determined the issue was that /var/log/messages was deleted but ...
1
vote
1answer
58 views

Prevent rsyslog messages from repeating in different priority levels

[Running Linux Mint 19.3] I'm trying to work with individual rsyslog priority levels, separating out the messages like this (from /etc/rsyslog.d/50-default.conf): *.info /var/...

1
2 3 4 5
7