Questions tagged [rsyslog]
rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.
421
questions
1
vote
1
answer
22
views
What is the meaning of the daemon facility in rsyslog.conf on Red Hat Linux
I'm looking for detailed information about what the daemon facility would log if configured in /etc/rsyslog.conf.
So far, the most detail I have found is:
daemon: affects a daemon without any special ...
- 13
0
votes
0
answers
13
views
Debian 11 - audit logs appearing in /var/log/auth
I'm on a Debian 11 server and my audit logs are going into /var/log/audit/audit.log as well as in /var/log/auth.log. They are filling up my auth.log and they really should not be going there. Below ...
- 11
1
vote
1
answer
22
views
(When) are different queue file names needed when logging to multiple servers?
I would like to setup rsyslog to log to multiple servers. For the moment it should be based on UDP, but later on it might change to TCP or RELP.
I found multiple ressources that explain how to do so, ...
- 21
0
votes
1
answer
36
views
Do kernel messages go through syslogd or journald?
I'm using Debian. Debian ships with rsyslogd for its syslogd. It also ships journald. Does the kernel log to rsyslogd first, or journald?
I want to filter one of the messages out of the logs which is ...
- 26k
1
vote
1
answer
30
views
Avoid duplicating syslog messages into /var/log/messages and /var/log/syslog
I'm using the following rsyslog configuration file to redirect logs of a program to a specific file.
# Name of the program
set $.program_name = "myapp";
# Path to the log file
set $....
- 1,116
0
votes
2
answers
30
views
Log forwarding in partially disconnected client
Considering the following architecture:
I have a laptop connected to a server over ethernet.
This laptop is configured to send log events with rsyslog on the server, the server is configured to accept ...
- 145
1
vote
1
answer
47
views
How Do Logs Get From "Kernel Ring Buffer" to "/proc/kmgs" and "/dev/kmsg"?
I can not get any reliable information about how do kernel logs get from Kernel Ring Buffer to /proc/kmgs and /dev/kmsg. Is there any source I could have possbily missed or does perhaps anyone know ...
1
vote
1
answer
17
views
Journald and Sources of Log Messages
I would like to know what process is meant to write Timestapms (and other parts of Log messages) in Syslog protocol.
In other words, is it Syslog that sets timestamp of log message (exact time of ...
0
votes
0
answers
33
views
klogd, dmesg and syslog(2)
I got quite confused reading manual pages of klogd, dmesg and syslog(2). I would like to understand how the message produced by the kernel gets to /var/log/file.
First thing I would like to get to ...
0
votes
0
answers
24
views
How to work with rsyslog mmpstrucdata and mmaudit plugins correctly
I need to convert audit logs into JSON formatted logs using rsyslog. so I tried different modules like mmprog, mmnormalize, mmjsonpars, mmpstrucdata, mmaudit. while testing those mmjsonpars and ...
- 1
0
votes
0
answers
35
views
Rsyslog is not installed after successfully executing "sudo make install" using source file
I need mmaudit plugin for converting system audit logs into JSON formatted logs. But mmaudit is not available with standard versions. so I decided to work with source files from GitHub. I followed ...
- 1
2
votes
1
answer
144
views
Why my application logs aren't processed correctly by syslog?
I have a question about a syslog application. I wrote a simple program using syslog API.
I compiled and launched the program. It works, I can see logs on the journal.
However, when I reconfigured ...
- 29
1
vote
2
answers
184
views
How to setup syslog forwarding for systemd journal namespace
I have a configuration /etc/systemd/journald@my-namespace.conf which contains the setting ForwardToSyslog=yes and a systemd service unit configured with LogNamespace=my-namespace.
The documentation ...
- 41
0
votes
0
answers
24
views
How to prevent rsyslog creating junk folders under /var/syslog/rsyslog?
I use rsyslog to save logs from remote hosts and using template I save logs under /var/syslog/rsyslog with hostname. In this process, I noticed some too many junk folder are created like below. What ...
- 1
0
votes
0
answers
98
views
How to prevent Logs from different host being written to "secure" folder under /var/syslog/rsyslog
We collect logs from different host to be stored under rsyslog. I created templates under /etc/rsyslog.conf so the logs get stored with hostname under /var/syslog/rsyslog.
template under /etc/rsyslog....
- 1
0
votes
0
answers
11
views
rsyslog option no parsing [duplicate]
I am trying to forward test.log to syslog, and rsyslog is adding timestamps to the log. What template can I use to exclude that and send only raw messages?
Raw log example:
Dec 13 14:53:58 ops-control ...
0
votes
0
answers
44
views
Why rsyslog don't esclude iptables message from klog/dmesg?
I have configured firewalld to log messages
sudo vim /etc/firewalld/firewalld.conf
LogDenied=all
then I configure rsyslog for separate logging
:msg, contains, "_DROP" /var/log/...
- 11.7k
1
vote
0
answers
79
views
how to exclude some file patterns from being processed by rsyslog
I would like to limit files processed by rsyslog
Currently I have:
input(type="imfile"
file="/var/log/containers/*.log"
tag="container-logs")
and I need to ...
- 659
0
votes
0
answers
242
views
Unable to send logs from rsyslog to logstash and elasticsearch
I am using ubuntu and I installed the ELK stack version 8.5 on the same machine. I did the necessary configurations for each of the services(logstash, elasticsearch, kibana) and I equally configured ...
0
votes
1
answer
106
views
how to NOT show syslog info messages on terminal TTY
I have a home media server in the kitchen (OMV / Debian). I have one physical terminal open - display and keyboard running musikcube player that shows browses and plays the music library. Looks very ...
- 700
0
votes
1
answer
42
views
send particular log file from rsyslog client host to remote rsyslog server
I need to send ONLY jboss.log logfile to remote rsyslog server
/var/log/jboss/jboss.log
Can smbd provide me simple configs on client and server side to do that?
Thank you
PS reading similar questions ...
0
votes
0
answers
31
views
How to forward only filtered logs using rsyslog
So I have a filter appended,
if ($fromhost-ip != '127.0.0.1' ) and ($hostname != 'xxx' or 'xx' or 'xxx' or 'xx' or 'xx' or 'xx' or 'xx' or 'xx') then (*.* @127.0.0.1:2423 and ?remote-incoming-logs)
I ...
1
vote
1
answer
465
views
Access denied for rsyslog
Good Morning,
I am trying to sends Zeek logs to another host on my local network with rsyslog.
So far I have a configuration file in /etc/rsyslog.d which looks like this :
module(load="imfile&...
- 33
0
votes
0
answers
53
views
Rsyslog program name for postfix processes (qmgr, lmtp, cleanup)
I would like to filter out the sub-programs of postfix (qmgr, lmtp, and cleanup) on Debian 11, rsyslog 8.2102, and postfix 3.5.13
The logs appear like this:
Oct 28 20:06:10 mail postfix/qmgr[915]: ...
- 171
2
votes
1
answer
435
views
How to redirect rsyslog messges from a specific unix socket to a different log file without duplication?
I have been trying to implement separate logging for haproxy.
But I end up with duplicate logging and can't separate logs based on the input socket or facility alone.
My sample configuration in ...
- 735
1
vote
1
answer
89
views
Regex is not work for [][][.*] in the rsyslog conf
I want to redirect the following messages into the log file:
"[example]:[foo][bar]: "
"[example]:[foo][hello]: "
"[example]:[foo][world]: "
"[example]:[foo][other]: &...
- 115
0
votes
1
answer
194
views
How to disable iptables logging without removing the rule
Can I disable the iptables logging without removing the --log-prefix "iptables: " rule?
I have added the following rules into the iptables:
iptables -A INPUT -j LOG --log-prefix "...
- 115
0
votes
0
answers
20
views
Update service log at each print
I have a couple of Python scripts running as services, which periodically (for instance, every minute) print something.
By checking the system logs, I noticed that these periodic prints are someway ...
- 123
1
vote
1
answer
142
views
rsyslog: append source IP in log file name
I have a number of hosts sending logs to rsyslog server, and I'd like to distinguish them by adding their IP, i.e. /var/log/10.10.10.1-messages.log, /var/log/10.10.10.2-messages.log and so on. At the ...
- 1,603
0
votes
1
answer
67
views
Finding the PORT NUMBER of the process using a specific PID?
I have a specific PID and my question is how can I know which port belongs to that PID.
Any tips on how to know the port of a service that has a specific PID?
Thanks a lot.
- 1
2
votes
0
answers
165
views
/dev/log: Connection refused after boot, but only on one system
I have two systems running NVIDIA jetpack 5.0.2, based on Ubuntu 20.04. /etc and /boot are identical on both systems. On the first system, after boot, if I try to run logger I get an error /dev/log: ...
- 211
1
vote
0
answers
80
views
Any way to change rsyslog configuration per user (for cron)?
I am a user without sudo on a CentOS 7 system running rsyslog. I would like to log my cronjobs. Ideally, rsyslog would log all my user's cron activity to somewhere like ~/log/cron.
There are good ...
- 443
1
vote
0
answers
288
views
rsyslog forwarding msg using template format to remote server
I want to send logs from 2 client servers to a single remote server.
The client config :
...
module(load="imfile" PollingInterval="10") # Polling every 10 secondes
...
...
- 111
1
vote
1
answer
147
views
rsyslog config does not write to file
I just installed rsyslog on rhel8. So the /etc/rsyslog.conf file is stock. Here's my custom config:
/etc/rsyslog.d/10-remote.conf
module(load="imudp")
ruleset(name="remote_udp"){
...
1
vote
1
answer
137
views
kernel: USB disconnect message
When I plug in USB disk, I get a message like this:
kernel: usb 2-10.2: new SuperSpeed USB device number 5 using xhci_hcd
kernel: usb-storage 2-10.2:1.0: USB Mass Storage device detected
kernel: scsi ...
- 241
0
votes
1
answer
296
views
rsyslog: how to cut string from starting field to end of message
i have some messy devices which i want to handle trough rsyslog
90% of job is done, but i am stuck here
rawmsg: '<133>2022-07-15 17:11:11 eleservice-sw02 51891 Logout the web by admin on web (...
- 1
0
votes
1
answer
97
views
Forwarding historic (old) syslog to syslog server
We can forward syslogs to syslog server by making the below entry in syslog.conf/rsyslog.conf
*.*<space/tab>@<syslog_server_name>:<port_no>
However, this only sends new syslogs, ...
- 3
2
votes
1
answer
145
views
Generating fake old log messages e.g. six months old ( fake timestamp ) for syslog RFC5424
Good day;
I need to test my log management stack's database query performance and in order to do so, I need to generate bulks of log messages that seem to be six months old and send them to rsyslogd.
...
- 107
1
vote
1
answer
94
views
Can't find cron config file
I have CentOS 7 and am trying to access a configuration file that looks a little something like this:
# Cron configuration options
# For quick reference, the currently available log levels are:
# 0 ...
- 13
0
votes
1
answer
149
views
How to stop cron logs from getting sent to syslog?
I posted this question in the Superuser community but maybe this forum is better suited to my question:
I'm sending logs to a syslog server, but cron logs there are taking up more space than they ...
- 13
1
vote
1
answer
324
views
Postfix not logging authentication failures
I have a postfix server running on Ubuntu 18.04lts with authentication enabled.
(from main.cf)
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
...
- 4,679
0
votes
0
answers
26
views
Custom file for syslog messages received by rsyslog
We are trying to forward syslog from network devices to a rsyslog ( Centos 7.9 ) and it seems to be writing it all in /var/log/messages.
Is there a way to write this into another custom file?
- 1,791
0
votes
2
answers
444
views
How to redirect stdout and stderr to rsyslog permamently in Linux
I use an embedded Linux build in Yocto. I would like none of the applications running on the system to display information in the console. I would like to redirect these logs to syslog, or eventually, ...
- 19
2
votes
2
answers
6k
views
How can journald be disabled?
I've recently learned that journalctl is occupying a big chunk of my 16GB SD card (Raspberry Pi):
$ journalctl --disk-usage
Archived and active journals take up 312.1M in the file system.
I don't ...
- 2,390
0
votes
0
answers
348
views
How to reload (kill -HUP) rsyslog.service after a mount point comes up with systemd?
I've set up rsyslog to copy certain logs on a separate volume. I want it to be up as early as possible for obvious reasons, but also I want it to start writing to the volume as soon as it becomes ...
- 1,604
1
vote
1
answer
684
views
Why is rsyslog not working properly?
rsyslog is failing to send messages to /var/log/messages and to the external syslog collector as detailed below.
I have an AWS EC2 RHEL 7 instance and an on-premise RHEL 7 instance. They are both ...
- 131
1
vote
1
answer
534
views
Systemd/rsyslog logging not working as expected
I've got a fairly vanilla Ubuntu 20.04LTS box where I've deployed Tomcat9 from repo. Out of the box, this appears to be configured to write its logs to /var/log/tomcat9/ and there are indeed log files ...
- 4,679
1
vote
1
answer
233
views
TLS 1.3 only for rsyslog on Debian and CentOS
We have an existing rsyslog set up using TLS 1.2 We want to upgrade to TLS1.3 ONLY. I've read the other questions here, but when I set everything up, I get no logs.
The result of "openssl ...
- 11
1
vote
1
answer
568
views
Rsyslog losing log message when file does not exist
I'm encountering case when rsyslog message is lost when the file its supposed to write to does not exist.
Here is my setup:
log server 192.168.1.2 have such config:
module(load="imtcp")
...
- 207
1
vote
1
answer
398
views
Rsyslog Dropping messages before getting sent remote - filter not working
I am struggling with dropping certain syslog messages before rsyslog sends them to a remote logging server.
Here is my entire rsyslog.conf file look like this:
# /etc/rsyslog.conf configuration file ...
- 171