Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsyslog]

rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

0
votes
1answer
18 views

Centos 7 rsyslog service issue

I have a problem concerning rsyslog. After system reboot, the service does not start after a few tries. I noticed, that pid file still exists after reboot, and after rm /var/run/syslogd.pid I can ...
0
votes
1answer
14 views

How to negate certain messages based on negation syntax

I want to use negation to stop certain messages to be passed on the rsyslog bassed on the $rawmsg. Message exaple like: (root) CMD (LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/...
2
votes
1answer
33 views

How to discard particular Severity's in the Rsyslog Server

I have an rsyslog server that's having the data from multiple remote clients; now I want to discard particular Severity types like warn , info and debug and the rest of the messages I want to be ...
1
vote
0answers
17 views

What is causing my rsyslog timezone offset and / or time to be incorrect?

I have a central logging server running rsyslog 7.x on RHEL 6 The logs are coming in with a UTC time but an EST offset for a device. Here are some relevant configs. $template TEMPLATE_NAME,"%...
0
votes
0answers
31 views

rsyslog template with multiple filters and condition

This just in continuation of my previous post While working with the rsyslog configuration i have came across many challenges and got to know many caveats of it while most of my config is working now ...
0
votes
1answer
21 views

rsyslog conditional forwarding for remote logs de-formatting the date and time in the log file

I've another question about the conditional forwarding of logs via rsyslog.conf, i have below configuration. # cat /etc/rsyslog.conf ##################################################################...
1
vote
0answers
32 views

Installing mmdblookup module for rsyslog on Ubuntu

I am currently trying to perform an IP lookup in the MaxMind/GeoIP DB lookup via the mmdblookup module of rsyslog. (https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmdblookup.html) As ...
1
vote
1answer
86 views

How to forward rsyslog logs from multiple locations to ELK and make it show in kibana?

rsyslog server template consideration for multiple remote hosts ---> link to previously answered question @ meuh, I find this post very useful as am currently working on this configuration. I ...
0
votes
0answers
34 views

rsyslog: send logs to different file by filtering syslogs

I have a CentOS based rsyslog server which have the below settings, where it's getting all the remote NATing events from multiple hosts. $template TmplcpFW, "/var/log/%HOSTNAME%.log" if ($hostname == ...
0
votes
0answers
13 views

change maillog default path in rsyslog

I am using redhat linux and the default location of my postfix is /var/log/maillog . I am trying to change maillog location to /app/log/maillog. I have tried to update rsyslog.conf mail.* ...
2
votes
1answer
46 views

How to suppress rsyslogd HUPed messages from logcheck?

Getting these... Jan 7 06:25:01 debian liblogging-stdlog: [origin software="rsyslogd" swVersion="8.24.0" x-pid="551" x-info="http://www.rsyslog.com"] rsyslogd was HUPed Debian default logcheck ...
0
votes
0answers
16 views

Rsyslog concatenate postfix output

I'm trying to concatenate postfix log output with rsyslog directly. This is my template. template(name="TestMailTemplate" type="list"){ property(name="timestamp" dateFormat="rfc3339") constant(value="...
2
votes
1answer
45 views

Rsyslog exclude $programname from syslog

I get duplication on a remote rsyslog server: Even though I've configured a catch for clamav logs from mail servers - I still get the logs appearing in syslog # Configuration for Mail ClamAV logs in ...
2
votes
1answer
168 views

rsyslog conditional forwarding for remote logs

I have a rsyslog Server which have the below settings,Where its getting all the remote Linux systems logs and network logs. # cat /etc/rsyslog.conf $ModLoad imudp $UDPServerRun 514 $...
-8
votes
1answer
47 views

Write an login script on Ubuntu [closed]

The idea is that I need to write the username and the password and the script tell me who I am. if: username: admin pass: admin the script echo: "you are an admin" if: username: user pass: user the ...
0
votes
1answer
113 views

rsyslog: send logs to different file using custom template

So, I'm using systemd to send the logs to rsyslog, and I want to write the logs to /var/log/app.log. Since it is a Java app with its own log format, I don't want to have timestamps or anything on it,...
0
votes
1answer
51 views

Rsyslog alter log line before forwarding

being on Ubuntu 16.04.5 LTS with rsyslogd. We have the following situation: (1) An appliance forwards syslog to the Ubuntu host. (2) Ubuntu Host stores those forwarded messages in a separate logfile ...
1
vote
1answer
37 views

My attempts to use rsyslog to route messages to a log file

In myapp.service, I have : StandardOutput=syslog StandardErr=syslog When I do : $ journalctl -e -u myapp I can see each line of log contains "myapp[PID]". I've tried to set up /etc/rsyslog.d/...
-1
votes
1answer
49 views

Could I disable syslog.service after installing rsyslog on Ubuntu 18.04 server?

I am making a minimal Ubuntu for embedded system starting from Ubuntu base. Our samba-related script code relies on rsyslog so I installed this package. systemctl shows there is also a syslog.service,...
0
votes
1answer
49 views

journald socket buffering for option ForwardToSyslog

I have a configuration in which journald is set with ForwardToSyslog=yes. Quote from the documentation: If forwarding to syslog is enabled but nothing reads messages from the socket, ...
0
votes
1answer
32 views

How does systemd provide data to the service triggered by a socket?

The concept behind systemd sockets is to provide a "cheap listener service" that will start the "service that would normally bind that socket but we don't want to run it all the time" once data on the ...
0
votes
1answer
140 views

What is the correct syntax for rsyslog's re_match()?

I'm trying to filter unwanted messages from a cron job (systemd) from rsyslog output. However rsyslog always complains about the second argument of re_match(). The filter rule I have is: if $...
1
vote
1answer
48 views

journald - resent archived logs to logging socket

I have an embedded device that has both systemd and rsyslog. journald is the main mechanism for local logging and rsyslog for remote logging. rsyslog isn't always running and is started only when ...
1
vote
2answers
102 views

Rsyslog - How to disable udp syslog?

Currently rsyslog is listening on both UDP socket and UNIX socket, as shown below: [root@machine ~]# netstat -ap | grep rsyslog udp 0 0 0.0.0.0:59018 0.0.0.0:* ...
0
votes
1answer
384 views

rsyslog server template consideration for multiple remote hosts

Linux Destro is : Centos 6.8 Below is what the rsyslog.conf looks like: # cat /etc/rsyslog.conf $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad ...
1
vote
1answer
87 views

Encryption of syslog & auditd in local disk? [closed]

We need to use encrypted syslog and auditd in local disk. Is it possible to save syslog and auditd message encrypted in disk ?
1
vote
1answer
109 views

Message forwarding with de-duplication - SyslogNG

Based on the advice from answer that says: Simply adding both servers and always write to both is the easiest one, we have setup syslog-NG server on two machines that receive same syslog message and ...
1
vote
1answer
105 views

Remove formatting from specific rsyslog configuration

I'm building an application that will have quite a few moving parts. Some of them will be scheduled by cron, others are triggered by a service using inotify to listen for file arrivals. Because I ...
1
vote
1answer
326 views

Can I use regexp captured string into rsyslog paths?

Say I want to filter logs to use different files per user ID, I can write one rule per uid as here : if $msg contains 'uid=500' then /var/log/uid/500 if $msg contains 'uid=501' then /var/log/uid/501 ...
0
votes
0answers
26 views

delete csv file by rsyslog after transfer

We have two expectations from the rsyslog. we config : module (load=imfile) input (type="imfile" file="/opt/reports/*.csv") tag="send_csv" ruleset="test") ruleset(name="test") { action (type="omfwd"...
1
vote
0answers
39 views

rsyslog to stop forwarding logs if recover/destination server is unavailable

I'm forwarding the logs with rsyslog (tcp) from 10 servers to a log collector. RHEL 6.9. If the network between log collector and the servers is down, I'm hitting login issues. Known issue: https://...
1
vote
0answers
71 views

Rsyslogd - remove timestamp on certain logs

I'm trying to achieve the questioned here, but I need to discard the timestamp only on a specific log file. I.e. only /var/log/mylog.log should have no timestamps. Is that possible with rsyslogd?
0
votes
0answers
110 views

LogStash Json ParserError

I need to send a log with JSON format from rsyslog to logsatsh and then from logstash to graylog. All the steps I have done. step 1 : config /etc/rsyslog.conf *.* action(type="omfwd" target="192....
1
vote
1answer
83 views

rsyslog only making log files in /var/logs

Running centos 7, my rsyslog.conf looks like this: 59 # Log all the mail messages in one place. 60 mail.* /var/log/maillog 61 mail.* /var/log/logtest1 62 mail.* /root/logtest Then I use the ...
1
vote
0answers
31 views

journald to rsyslog paging issues

I'm using rsyslog to dump journald entries to a log file so that they can be sent to Logstash. The issue I'm having is that some of the log lines are getting split across two lines. When viewing ...
1
vote
0answers
35 views

Where do Logrotate files end up?

I've got a Graylog server that I configured logrotating on. /var/lib/graylog-server/journal/messagejournal-0/000*.log { size 2G create 550 ubuntu ubuntu rotate 5 } I came in one morning ...
1
vote
0answers
127 views

Why might rsyslog %syslogtag% display “(none)”?

Given the following lines in an instance of /etc/rsyslog.conf: $template MyFmt, "%timereported:::date-year%%timereported:::date-month%%timereported:::date-day%_%timereported:::date-hour%%timereported:...
0
votes
1answer
27 views

Why is 'logger' always executed as the same user?

I'm using rsyslog 8.24 on debian. Each time I trigger logger "some message" the syslog refers to the same and only system user - it does not matter if I switch user (even as root), the messages are ...
1
vote
1answer
102 views

How can I find the configuration file for rsyslog if it's not the default?

By default, rsyslog's config file is in /etc/rsyslog.conf. You can set the config file path on startup with the -f /path/to/file option. My question is: how can you find the config file if it's been ...
1
vote
0answers
319 views

user configuration of rsyslog does not work

I am trying to provide the option to user to add their user configuration option for rsyslog. The default rsyslog is working fine for me. The main or default configuration for rsyslog file looks ...
0
votes
1answer
45 views

How do I write a rsyslog rule to forward conditional on facility and fromhost?

This rsyslog rule forwards syslog and auth facilities to another host: syslog,auth.* @another-host The following (taken from here) forwards syslogs conditional on ...
0
votes
0answers
26 views

Why does rsyslog only infinitely recurse when listening with UDP?

This is a follow-up to this question. I'm trying to understand recursion potential with rsyslog. I have a simple rsyslog configuration that sends syslogs to a named pipe as well as to 127.0.0.1 (i.e. ...
1
vote
1answer
199 views

Pass kernel and boot logs to syslog

I have a systemd based system and for some services I had to set up remote logging. The simplest way to set this was to use rsyslog and set the StandardOutput=syslog+console in the unit file. Now I ...
0
votes
1answer
35 views

Why doesn't this rsyslog conf file cause recursion?

I'm studying rsyslog by a combination of man pages, online reading, and experimenting. I'd like to understand why the following does not result in infinite recursion: From terminal 1: $ cat /etc/...
0
votes
1answer
757 views

SFTP not logging to /var/log/sftp.log

This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that! However, for some reason, my logs ...
0
votes
0answers
26 views

rsyslog to log file Redahat Linux, works at boot not on system to start

I have a couple apps that start and log properly to files. This is controlled via conf files for rsyslog. But this logging only works when the system is booted. If I use systemctl to stop//start these ...
0
votes
0answers
31 views

React to a writing error

Hi there, I'm curently working on a debian system, this system (under Jessie) write datas to an SDcard really often, sometimes (i'm working on it but it is not the question here) the system is unable ...
0
votes
0answers
94 views

Hostname in the audit reports not shown

I'm creating a nfs share. Also i configured auditd to combine the logs to a centralized server. I configured audisp-remote as per the instructions in the link: https://luppeng.wordpress.com/2016/08/...
0
votes
1answer
66 views

Which one should I choose for log management, systemd-journald or rsyslog?

We have both systemd-journald and rsyslog running on our linux box, and we have to make a decision bewteen these two for managing our application logs. From what we've known (please correct me if I'm ...
1
vote
1answer
60 views

Dash Slash Meaning vs just Slash -/var vs /var [duplicate]

Working with Centos 7 In the rsyslog.conf file there are some rules that place logs in directories that start with a -/ (Dash slash) before stating which directory to place the logs, while others ...