Questions tagged [rsyslog]
rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.
442
questions
1
vote
0
answers
148
views
Ubuntu Rsyslog cannot read certificates because permission denies
I am setting up a syslog serer that will listen for logs from a Fortigate firewall. Rsyslog gets error
'/home/syslog_cert/ACDC_CA.pem' could not be accessed: Permission denied"
This is my ...
- 113
-1
votes
1
answer
25
views
logrotate not working as per configuration provided
I am working on a java application running in Ubuntu Server (16.04) which copies log files from certain folders and consolidate then when user closes the session.
In ubuntu server rsyslog filters and ...
0
votes
2
answers
96
views
How do I check which conf file was loaded by syslog-ng when starting?
I am running syslog-ng on debian.
How do I check which conf file was loaded upon startup?
Neither
systemctl status syslog-ng
nor
systemctl show syslog-ng
tell me.
- 153
0
votes
1
answer
110
views
rsyslog variable from mmnormalize as part of omfile filename
I have a log line that looks like this:
May 20 10:25:42 192.168.20.100 Timestamp="2024-05-20 10:25:42",LogId="535666280",NodeId="192.168.1.100",Facility="Packet ...
- 1,000
1
vote
0
answers
33
views
How to change the facility of sshd
The default config in /etc/ssh/sshd_config is
#SyslogFacility AUTH
I added
SyslogFacility LOCAL5
below, and local5.* /var/log/sshd.log in /etc/rsyslog.conf
As usual restarted sshd and rsyslog....
- 11
0
votes
0
answers
16
views
rsyslog service mulfuction after server reboot
We recently faced an issue with rsyslog service on CentOS-7.
This server was running for like 2-3 years continuously and we rebooted it last night. Since then rsyslogs are not written.
Tried steps ...
-1
votes
1
answer
84
views
Portable logging from Python?
I am writing a small plugin for Postfix using python and want to it to emit logging messages. I am not particularly familiar with python and was advised to use loguru. This was certainly easy when I ...
- 5,936
1
vote
1
answer
28
views
How to use rsyslog ltrim function?
I would like to trim leading and trailing spaces from the msg field using rsyslog. I read it has functions called rtrim and ltrim but I can't find any explanation of how to use functions in ...
- 575
0
votes
1
answer
23
views
rsyslogd v3.x.x unexpectedly closes write connection to named pipe target
I've configured rsyslog to forward certain log messages to a named pipe /tmp/logger.pipe. I then have a separate process reading from the named pipe. Relevant section from /etc/rsyslog.conf
# Remote ...
- 973
5
votes
1
answer
838
views
/var/log/auth.log stops recording authentication errors
As the title says, /var/log/auth.log stops recording authentication errors. It all began with I accidentally deleting it. Then I created it using touch command and changed the owner:group to syslog:...
- 95
0
votes
1
answer
59
views
function log2syslog in kali linux 2023.4
Can you please help me with this ? im trying to logging the bash commands. In Centos or another Linux OS works , but does not wotk in Kali Linux. I have created shell file with name log2syslog.sh in /...
0
votes
0
answers
60
views
What does rsyslog do if it fills up a named pipe?
I'm working on a C application that is intended to monitor and process the output of rsyslog. My research shows that a way to do this is to create a named pipe and then create a new syslog target that ...
- 973
0
votes
1
answer
62
views
remote clients logging to syslog in their own file questionable configs
I've got logservers set up to receive from clients on UDP/514 and write to a file with hostname/IP as the name using a ruleset. I've had the same configuration on different servers and sometimes it ...
- 1
0
votes
0
answers
47
views
rsyslog template regexp
I'm trying to split login users into his own log file.
The log text to match is this: <user name> (<IP>): logged in
For example: 370 (10.5.21.57): logged in
Note that user name could be an ...
0
votes
0
answers
237
views
is it possible to prevent rsyslog messages going to systemd-journal log and how?
I have an iptables rule that is logging some of my networks activities into a log file using the jump LOG rule.
I filter the events to go to a specific file using the following rsyslog configuration ...
- 81
0
votes
1
answer
2k
views
Logrotation is not rotating logs each day
I am new to log rotation and have a syslog server that have been setup to recieve firewall logs over 514.
Now, the firewall is generating A LOT of data, ~600-800GB/day and the servers capacity is 1TB.
...
- 3
0
votes
0
answers
839
views
Is rsyslog compatible with syslog-ng?
I am doing a project where the organisation uses syslog-ng for the central remote logging servers and this will surely not change.
The application suite that I am developing on, is using Red Hat ...
0
votes
1
answer
66
views
vpnc does not log anything to rsyslog
I am using vpnc-connect and vpnc-disconnect (from package vpnc) on Debian 12.
when I start vpnc-connect it just prints message:
VPNC started in background (pid: 2345)
But other than that, the whole ...
- 748
1
vote
1
answer
445
views
omprog does not capture script output to file
I've got a problem where the omprog module of rsyslog doesn't seem to be using the output parameter to capture the script's output to file. What am I doing wrong?
My rsyslog server receives a dozen ...
- 115
1
vote
0
answers
772
views
How to turn "Suppressed n messages from /" into visible, logged messages?
CentOS 7.9, latest kernel, latest micro updates.
The console log level is set to "debug" (7) to see all messages I can get. Suddenly:
grep "journal: Suppressed" messages | less
...
- 11
0
votes
0
answers
427
views
Audit Logging Discrepancy: Journald vs Rsyslog
After installing Debian 12 and rsyslog 8.2302 (for TLS remote syslog), I noticed that apparmor logs (or any audit logs) were not being sent remotely.
After reviewing the local system, journald DOES ...
user432564
0
votes
1
answer
141
views
rsyslog: capture errors from "omprog" script
I am using custom python script to process logs, and ban offending IPs. Here is the line from my /etc/rsyslog.conf:
local0.* action(type="omprog" name="asterisk" binary="/usr/...
- 748
2
votes
1
answer
259
views
How to tell rsyslog to use Unix domain sockets to write syslog messages to a Postgresql database?
I created a database as explained here:
https://github.com/rsyslog/rsyslog/blob/master/plugins/ompgsql/createDB.sql
I created a "root" user in the database and granted insert permissions:
...
- 3,659
0
votes
1
answer
269
views
Split logging on rsyslogd
My goal is to send all logs to one source remote and still log local but then send all the AuditD logs to its own source on port 20002. But for some reason, my auditd logs are still ending up with my ...
- 1,744
0
votes
0
answers
2k
views
rsyslogd: imjournal: fopen() failed for path: '/imjournal.state.tmp': Permission denied
I am having a Linux server with 128 GB RAM, 32 CPU and its running TIBCO EBX application. When I checked my server log file(/var/log/messages), it filled with below messages. Are these messages ...
- 113
1
vote
1
answer
434
views
Unable to run rsyslogd as non-root user on CentOS Stream 9
When I run rsyslogd as non-root user, I see such errors. However I can do that on RHEL (tried both 8 and 9)
[drizzlex@ray myrsyslog]$ rsyslogd -f /home/drizzlex/myrsyslog/myrsyslog.conf -i /home/...
- 125
1
vote
1
answer
2k
views
Rsyslog producing errors when trying to write to mounted drive
Could anyone take a look at this and see if I've done something obviously wrong?
I am running RockyLinux and attempting to setup a syslog server.
Its running with an Azure VM with an additional 2TB ...
- 31
2
votes
1
answer
111
views
rsyslogd sometimes doesn't write the initial bits of dmesg to /var/log/syslog
I have a Linux machine running Ubuntu 16.04.7 LTS that uses rsyslogd. My understanding of rsyslogd is that it rotates the content from the kernel ring buffer (ie, dmesg) to an on-disk file (ie, /var/...
- 153
0
votes
0
answers
511
views
Where is Rsyslog programname set?
I am using AWS Elasticbeanstalk to run my java web application. In EC2 node under /etc/rsyslog.d/web.conf
if $programname == 'web' then {
*.=warning;*.=err;*.=crit;*.=alert;*.=emerg /var/log/web....
- 101
1
vote
1
answer
383
views
What is the meaning of the daemon facility in rsyslog.conf on Red Hat Linux
I'm looking for detailed information about what the daemon facility would log if configured in /etc/rsyslog.conf.
So far, the most detail I have found is:
daemon: affects a daemon without any special ...
- 13
0
votes
1
answer
2k
views
Debian 11 - audit logs appearing in /var/log/auth
I'm on a Debian 11 server and my audit logs are going into /var/log/audit/audit.log as well as in /var/log/auth.log. They are filling up my auth.log and they really should not be going there. Below ...
- 46
1
vote
1
answer
306
views
(When) are different queue file names needed when logging to multiple servers?
I would like to setup rsyslog to log to multiple servers. For the moment it should be based on UDP, but later on it might change to TCP or RELP.
I found multiple ressources that explain how to do so, ...
- 21
0
votes
1
answer
589
views
Do kernel messages go through syslogd or journald?
I'm using Debian. Debian ships with rsyslogd for its syslogd. It also ships journald. Does the kernel log to rsyslogd first, or journald?
I want to filter one of the messages out of the logs which is ...
- 32.4k
1
vote
1
answer
1k
views
Avoid duplicating syslog messages into /var/log/messages and /var/log/syslog
I'm using the following rsyslog configuration file to redirect logs of a program to a specific file.
# Name of the program
set $.program_name = "myapp";
# Path to the log file
set $....
- 1,178
0
votes
2
answers
134
views
Log forwarding in partially disconnected client
Considering the following architecture:
I have a laptop connected to a server over ethernet.
This laptop is configured to send log events with rsyslog on the server, the server is configured to accept ...
- 145
0
votes
1
answer
383
views
How Do Logs Get From "Kernel Ring Buffer" to "/proc/kmgs" and "/dev/kmsg"?
I can not get any reliable information about how do kernel logs get from Kernel Ring Buffer to /proc/kmgs and /dev/kmsg. Is there any source I could have possbily missed or does perhaps anyone know ...
0
votes
1
answer
114
views
Journald and Sources of Log Messages
I would like to know what process is meant to write Timestapms (and other parts of Log messages) in Syslog protocol.
In other words, is it Syslog that sets timestamp of log message (exact time of ...
1
vote
0
answers
206
views
klogd, dmesg and syslog(2)
I got quite confused reading manual pages of klogd, dmesg and syslog(2). I would like to understand how the message produced by the kernel gets to /var/log/file.
First thing I would like to get to ...
0
votes
0
answers
821
views
Rsyslog is not installed after successfully executing "sudo make install" using source file
I need mmaudit plugin for converting system audit logs into JSON formatted logs. But mmaudit is not available with standard versions. so I decided to work with source files from GitHub. I followed ...
- 1
2
votes
1
answer
425
views
When I reconfigure syslog, my application logs don't follow the new configuration
I have a question about a syslog application. I wrote a simple program using syslog API.
I compiled and launched the program. It works, I can see logs on the journal.
However, when I reconfigured ...
- 29
3
votes
2
answers
7k
views
How to setup syslog forwarding for systemd journal namespace
I have a configuration /etc/systemd/[email protected] which contains the setting ForwardToSyslog=yes and a systemd service unit configured with LogNamespace=my-namespace.
The documentation ...
- 71
1
vote
0
answers
228
views
how to exclude some file patterns from being processed by rsyslog
I would like to limit files processed by rsyslog
Currently I have:
input(type="imfile"
file="/var/log/containers/*.log"
tag="container-logs")
and I need to ...
- 805
0
votes
0
answers
925
views
Unable to send logs from rsyslog to logstash and elasticsearch
I am using ubuntu and I installed the ELK stack version 8.5 on the same machine. I did the necessary configurations for each of the services(logstash, elasticsearch, kibana) and I equally configured ...
0
votes
1
answer
780
views
how to NOT show syslog info messages on terminal TTY
I have a home media server in the kitchen (OMV / Debian). I have one physical terminal open - display and keyboard running musikcube player that shows browses and plays the music library. Looks very ...
- 730
0
votes
1
answer
178
views
send particular log file from rsyslog client host to remote rsyslog server
I need to send ONLY jboss.log logfile to remote rsyslog server
/var/log/jboss/jboss.log
Can smbd provide me simple configs on client and server side to do that?
Thank you
PS reading similar questions ...
1
vote
1
answer
4k
views
Access denied for rsyslog
Good Morning,
I am trying to sends Zeek logs to another host on my local network with rsyslog.
So far I have a configuration file in /etc/rsyslog.d which looks like this :
module(load="imfile&...
- 33
0
votes
0
answers
178
views
Rsyslog program name for postfix processes (qmgr, lmtp, cleanup)
I would like to filter out the sub-programs of postfix (qmgr, lmtp, and cleanup) on Debian 11, rsyslog 8.2102, and postfix 3.5.13
The logs appear like this:
Oct 28 20:06:10 mail postfix/qmgr[915]: ...
user432564
4
votes
1
answer
1k
views
How to redirect rsyslog messges from a specific unix socket to a different log file without duplication?
I have been trying to implement separate logging for haproxy.
But I end up with duplicate logging and can't separate logs based on the input socket or facility alone.
My sample configuration in ...
- 855
1
vote
1
answer
560
views
Regex is not work for [][][.*] in the rsyslog conf
I want to redirect the following messages into the log file:
"[example]:[foo][bar]: "
"[example]:[foo][hello]: "
"[example]:[foo][world]: "
"[example]:[foo][other]: &...
- 115
0
votes
1
answer
698
views
How to disable iptables logging without removing the rule
Can I disable the iptables logging without removing the --log-prefix "iptables: " rule?
I have added the following rules into the iptables:
iptables -A INPUT -j LOG --log-prefix "...
- 115