Questions tagged [rsyslog]

rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

Filter by
Sorted by
Tagged with
1 vote
0 answers
15 views

How to change the facility of sshd

The default config in /etc/ssh/sshd_config is #SyslogFacility AUTH I added SyslogFacility LOCAL5 below, and local5.* /var/log/sshd.log in /etc/rsyslog.conf As usual restarted sshd and rsyslog....
Matrix24601's user avatar
0 votes
0 answers
13 views

rsyslog service mulfuction after server reboot

We recently faced an issue with rsyslog service on CentOS-7. This server was running for like 2-3 years continuously and we rebooted it last night. Since then rsyslogs are not written. Tried steps ...
Sachith Muhandiram's user avatar
-1 votes
1 answer
31 views

Portable logging from Python?

I am writing a small plugin for Postfix using python and want to it to emit logging messages. I am not particularly familiar with python and was advised to use loguru. This was certainly easy when I ...
symcbean's user avatar
  • 5,557
1 vote
1 answer
18 views

How to use rsyslog ltrim function?

I would like to trim leading and trailing spaces from the msg field using rsyslog. I read it has functions called rtrim and ltrim but I can't find any explanation of how to use functions in ...
Elliott B's user avatar
  • 565
0 votes
1 answer
16 views

rsyslogd v3.x.x unexpectedly closes write connection to named pipe target

I've configured rsyslog to forward certain log messages to a named pipe /tmp/logger.pipe. I then have a separate process reading from the named pipe. Relevant section from /etc/rsyslog.conf # Remote ...
Izzo's user avatar
  • 961
5 votes
1 answer
544 views

/var/log/auth.log stops recording authentication errors

As the title says, /var/log/auth.log stops recording authentication errors. It all began with I accidentally deleting it. Then I created it using touch command and changed the owner:group to syslog:...
zzzhhh's user avatar
  • 95
0 votes
1 answer
42 views

function log2syslog in kali linux 2023.4

Can you please help me with this ? im trying to logging the bash commands. In Centos or another Linux OS works , but does not wotk in Kali Linux. I have created shell file with name log2syslog.sh in /...
George Filippaios's user avatar
0 votes
0 answers
24 views

What does rsyslog do if it fills up a named pipe?

I'm working on a C application that is intended to monitor and process the output of rsyslog. My research shows that a way to do this is to create a named pipe and then create a new syslog target that ...
Izzo's user avatar
  • 961
0 votes
1 answer
23 views

remote clients logging to syslog in their own file questionable configs

I've got logservers set up to receive from clients on UDP/514 and write to a file with hostname/IP as the name using a ruleset. I've had the same configuration on different servers and sometimes it ...
sbusgs's user avatar
  • 1
0 votes
0 answers
22 views

rsyslog template regexp

I'm trying to split login users into his own log file. The log text to match is this: <user name> (<IP>): logged in For example: 370 (10.5.21.57): logged in Note that user name could be an ...
Rafael Dellà's user avatar
0 votes
0 answers
56 views

is it possible to prevent rsyslog messages going to systemd-journal log and how?

I have an iptables rule that is logging some of my networks activities into a log file using the jump LOG rule. I filter the events to go to a specific file using the following rsyslog configuration ...
Or Yaacov's user avatar
0 votes
1 answer
789 views

Logrotation is not rotating logs each day

I am new to log rotation and have a syslog server that have been setup to recieve firewall logs over 514. Now, the firewall is generating A LOT of data, ~600-800GB/day and the servers capacity is 1TB. ...
phil_sw's user avatar
0 votes
0 answers
538 views

Is rsyslog compatible with syslog-ng?

I am doing a project where the organisation uses syslog-ng for the central remote logging servers and this will surely not change. The application suite that I am developing on, is using Red Hat ...
user581894's user avatar
0 votes
1 answer
33 views

vpnc does not log anything to rsyslog

I am using vpnc-connect and vpnc-disconnect (from package vpnc) on Debian 12. when I start vpnc-connect it just prints message: VPNC started in background (pid: 2345) But other than that, the whole ...
Martin Vegter's user avatar
1 vote
1 answer
247 views

omprog does not capture script output to file

I've got a problem where the omprog module of rsyslog doesn't seem to be using the output parameter to capture the script's output to file. What am I doing wrong? My rsyslog server receives a dozen ...
user3629081's user avatar
0 votes
0 answers
426 views

How to turn "Suppressed n messages from /" into visible, logged messages?

CentOS 7.9, latest kernel, latest micro updates. The console log level is set to "debug" (7) to see all messages I can get. Suddenly: grep "journal: Suppressed" messages | less ...
LT493GU's user avatar
0 votes
0 answers
333 views

Audit Logging Discrepancy: Journald vs Rsyslog

After installing Debian 12 and rsyslog 8.2302 (for TLS remote syslog), I noticed that apparmor logs (or any audit logs) were not being sent remotely. After reviewing the local system, journald DOES ...
user avatar
0 votes
1 answer
90 views

rsyslog: capture errors from "omprog" script

I am using custom python script to process logs, and ban offending IPs. Here is the line from my /etc/rsyslog.conf: local0.* action(type="omprog" name="asterisk" binary="/usr/...
Martin Vegter's user avatar
2 votes
1 answer
199 views

How to tell rsyslog to use Unix domain sockets to write syslog messages to a Postgresql database?

I created a database as explained here: https://github.com/rsyslog/rsyslog/blob/master/plugins/ompgsql/createDB.sql I created a "root" user in the database and granted insert permissions: ...
ceving's user avatar
  • 3,579
0 votes
1 answer
204 views

Split logging on rsyslogd

My goal is to send all logs to one source remote and still log local but then send all the AuditD logs to its own source on port 20002. But for some reason, my auditd logs are still ending up with my ...
Jason's user avatar
  • 1,734
0 votes
0 answers
1k views

rsyslogd: imjournal: fopen() failed for path: '/imjournal.state.tmp': Permission denied

I am having a Linux server with 128 GB RAM, 32 CPU and its running TIBCO EBX application. When I checked my server log file(/var/log/messages), it filled with below messages. Are these messages ...
SinghVK's user avatar
  • 113
1 vote
1 answer
363 views

Unable to run rsyslogd as non-root user on CentOS Stream 9

When I run rsyslogd as non-root user, I see such errors. However I can do that on RHEL (tried both 8 and 9) [drizzlex@ray myrsyslog]$ rsyslogd -f /home/drizzlex/myrsyslog/myrsyslog.conf -i /home/...
DrizzleX's user avatar
  • 125
1 vote
1 answer
1k views

Rsyslog producing errors when trying to write to mounted drive

Could anyone take a look at this and see if I've done something obviously wrong? I am running RockyLinux and attempting to setup a syslog server. Its running with an Azure VM with an additional 2TB ...
Beckyboo's user avatar
2 votes
1 answer
67 views

rsyslogd sometimes doesn't write the initial bits of dmesg to /var/log/syslog

I have a Linux machine running Ubuntu 16.04.7 LTS that uses rsyslogd. My understanding of rsyslogd is that it rotates the content from the kernel ring buffer (ie, dmesg) to an on-disk file (ie, /var/...
Ken Lin's user avatar
  • 153
0 votes
0 answers
357 views

Where is Rsyslog programname set?

I am using AWS Elasticbeanstalk to run my java web application. In EC2 node under /etc/rsyslog.d/web.conf if $programname == 'web' then { *.=warning;*.=err;*.=crit;*.=alert;*.=emerg /var/log/web....
Jeevi's user avatar
  • 101
1 vote
1 answer
212 views

What is the meaning of the daemon facility in rsyslog.conf on Red Hat Linux

I'm looking for detailed information about what the daemon facility would log if configured in /etc/rsyslog.conf. So far, the most detail I have found is: daemon: affects a daemon without any special ...
Tech109's user avatar
  • 13
0 votes
1 answer
1k views

Debian 11 - audit logs appearing in /var/log/auth

I'm on a Debian 11 server and my audit logs are going into /var/log/audit/audit.log as well as in /var/log/auth.log. They are filling up my auth.log and they really should not be going there. Below ...
kathyl's user avatar
  • 46
1 vote
1 answer
183 views

(When) are different queue file names needed when logging to multiple servers?

I would like to setup rsyslog to log to multiple servers. For the moment it should be based on UDP, but later on it might change to TCP or RELP. I found multiple ressources that explain how to do so, ...
pt1's user avatar
  • 21
0 votes
1 answer
413 views

Do kernel messages go through syslogd or journald?

I'm using Debian. Debian ships with rsyslogd for its syslogd. It also ships journald. Does the kernel log to rsyslogd first, or journald? I want to filter one of the messages out of the logs which is ...
Evan Carroll's user avatar
  • 30.9k
1 vote
1 answer
819 views

Avoid duplicating syslog messages into /var/log/messages and /var/log/syslog

I'm using the following rsyslog configuration file to redirect logs of a program to a specific file. # Name of the program set $.program_name = "myapp"; # Path to the log file set $....
Arkaik's user avatar
  • 1,156
0 votes
2 answers
109 views

Log forwarding in partially disconnected client

Considering the following architecture: I have a laptop connected to a server over ethernet. This laptop is configured to send log events with rsyslog on the server, the server is configured to accept ...
Jaay's user avatar
  • 145
0 votes
1 answer
283 views

How Do Logs Get From "Kernel Ring Buffer" to "/proc/kmgs" and "/dev/kmsg"?

I can not get any reliable information about how do kernel logs get from Kernel Ring Buffer to /proc/kmgs and /dev/kmsg. Is there any source I could have possbily missed or does perhaps anyone know ...
GabrijelOkorn's user avatar
0 votes
1 answer
101 views

Journald and Sources of Log Messages

I would like to know what process is meant to write Timestapms (and other parts of Log messages) in Syslog protocol. In other words, is it Syslog that sets timestamp of log message (exact time of ...
GabrijelOkorn's user avatar
1 vote
0 answers
154 views

klogd, dmesg and syslog(2)

I got quite confused reading manual pages of klogd, dmesg and syslog(2). I would like to understand how the message produced by the kernel gets to /var/log/file. First thing I would like to get to ...
GabrijelOkorn's user avatar
0 votes
0 answers
662 views

Rsyslog is not installed after successfully executing "sudo make install" using source file

I need mmaudit plugin for converting system audit logs into JSON formatted logs. But mmaudit is not available with standard versions. so I decided to work with source files from GitHub. I followed ...
Logesh R's user avatar
2 votes
1 answer
377 views

When I reconfigure syslog, my application logs don't follow the new configuration

I have a question about a syslog application. I wrote a simple program using syslog API. I compiled and launched the program. It works, I can see logs on the journal. However, when I reconfigured ...
Lioyerar's user avatar
3 votes
2 answers
5k views

How to setup syslog forwarding for systemd journal namespace

I have a configuration /etc/systemd/[email protected] which contains the setting ForwardToSyslog=yes and a systemd service unit configured with LogNamespace=my-namespace. The documentation ...
Aaron Enberg's user avatar
1 vote
0 answers
190 views

how to exclude some file patterns from being processed by rsyslog

I would like to limit files processed by rsyslog Currently I have: input(type="imfile" file="/var/log/containers/*.log" tag="container-logs") and I need to ...
DmitrySemenov's user avatar
0 votes
0 answers
826 views

Unable to send logs from rsyslog to logstash and elasticsearch

I am using ubuntu and I installed the ELK stack version 8.5 on the same machine. I did the necessary configurations for each of the services(logstash, elasticsearch, kibana) and I equally configured ...
Ngouaba Rosalie's user avatar
0 votes
1 answer
585 views

how to NOT show syslog info messages on terminal TTY

I have a home media server in the kitchen (OMV / Debian). I have one physical terminal open - display and keyboard running musikcube player that shows browses and plays the music library. Looks very ...
r0berts's user avatar
  • 730
0 votes
1 answer
136 views

send particular log file from rsyslog client host to remote rsyslog server

I need to send ONLY jboss.log logfile to remote rsyslog server /var/log/jboss/jboss.log Can smbd provide me simple configs on client and server side to do that? Thank you PS reading similar questions ...
user3199267's user avatar
1 vote
1 answer
3k views

Access denied for rsyslog

Good Morning, I am trying to sends Zeek logs to another host on my local network with rsyslog. So far I have a configuration file in /etc/rsyslog.d which looks like this : module(load="imfile&...
Leviath's user avatar
  • 33
0 votes
0 answers
159 views

Rsyslog program name for postfix processes (qmgr, lmtp, cleanup)

I would like to filter out the sub-programs of postfix (qmgr, lmtp, and cleanup) on Debian 11, rsyslog 8.2102, and postfix 3.5.13 The logs appear like this: Oct 28 20:06:10 mail postfix/qmgr[915]: ...
user avatar
4 votes
1 answer
1k views

How to redirect rsyslog messges from a specific unix socket to a different log file without duplication?

I have been trying to implement separate logging for haproxy. But I end up with duplicate logging and can't separate logs based on the input socket or facility alone. My sample configuration in ...
GP92's user avatar
  • 815
1 vote
1 answer
429 views

Regex is not work for [][][.*] in the rsyslog conf

I want to redirect the following messages into the log file: "[example]:[foo][bar]: " "[example]:[foo][hello]: " "[example]:[foo][world]: " "[example]:[foo][other]: &...
stackbiz's user avatar
  • 115
0 votes
1 answer
608 views

How to disable iptables logging without removing the rule

Can I disable the iptables logging without removing the --log-prefix "iptables: " rule? I have added the following rules into the iptables: iptables -A INPUT -j LOG --log-prefix "...
stackbiz's user avatar
  • 115
0 votes
0 answers
42 views

Update service log at each print

I have a couple of Python scripts running as services, which periodically (for instance, every minute) print something. By checking the system logs, I noticed that these periodic prints are someway ...
rudicangiotti's user avatar
1 vote
1 answer
1k views

rsyslog: append source IP in log file name

I have a number of hosts sending logs to rsyslog server, and I'd like to distinguish them by adding their IP, i.e. /var/log/10.10.10.1-messages.log, /var/log/10.10.10.2-messages.log and so on. At the ...
Mark's user avatar
  • 1,793
0 votes
1 answer
187 views

Finding the PORT NUMBER of the process using a specific PID?

I have a specific PID and my question is how can I know which port belongs to that PID. Any tips on how to know the port of a service that has a specific PID? Thanks a lot.
EuDaKi's user avatar
  • 1
2 votes
0 answers
557 views

/dev/log: Connection refused after boot, but only on one system

I have two systems running NVIDIA jetpack 5.0.2, based on Ubuntu 20.04. /etc and /boot are identical on both systems. On the first system, after boot, if I try to run logger I get an error /dev/log: ...
Jayen's user avatar
  • 211

1
2 3 4 5
9