Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsyslog]

rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

-1
votes
1answer
22 views

Rsyslog in not logging due to Selinux, is my workaround ok

I have these two parameters in /etc/rsyslog.conf $ModLoad imjournal # provides access to the systemd journal ... # Turn off message reception via local log socket; # local messages are retrieved ...
0
votes
1answer
50 views

How to disable messages from syslogd for my own user?

I am using a Centos Linux OS with ssh tools. I get these messages every minute. Message from syslogd@rakhsh4 at May 6 17:48:34 ... kernel:[Hardware Error]: Corrected error, no action required. ...
0
votes
0answers
72 views

How do I forward particular logs under a directory using rsyslog?

Trying to froward following logs from /home/ddlog/ms/logs/execution_logs/_abc-xyz-ms_* to VMware vRealize Log Insight using rsyslog. For some reason that does not seem to be working. I have tried ...
0
votes
0answers
34 views

CentOS 7 - Rsyslog error7

My syslog server does not write messages correctly, traffic capture shows me 100 events, but the file in /var/log/xxx.log only 50 or 60 Have rsyslogd 7.4.7, compiled with: FEATURE_REGEXP: ...
-1
votes
1answer
29 views

Syntax to only forward logs for certain contain condition

i needed to forward logs only if the log contained a certain keyword. I achieve this by adding this line in rsyslog.conf. :msg, !contains, "xyz" ~ I know this condition means that if log contains ...
1
vote
0answers
41 views

Parse log file continuously and send out a URL request to a predetermined IP address

We have a radius server which forwards the accounting messages to a Syslog server hosted on Linux server. we want to gather specific values from that log file and use those values as parameters in a ...
0
votes
0answers
32 views

how to update the log message about failure of service

I configured the service - calc_mem.service as the following Restart=on-failure RestartSec=5 StartLimitInterval=400 StartLimitBurst=3 the configuration above should do the following the service ...
0
votes
1answer
39 views

How to discard debug messages using rsyslog?

We have a requirement to write incoming debug messages to our rsyslog server, but not forward them on to our Splunk server. I have tried putting *.debug stop in front of our local rules, but that is ...
0
votes
1answer
85 views

How to keep kern.log out of syslog

I'm working on Ubuntu 16.04.3 and I found that I could get the log of kernel from two places: /var/log/kern.log and /var/log/syslog. /var/log/syslog contains other logs but I could find /var/log/kern....
1
vote
0answers
47 views

why messages logs are zero

we have linux machine: more /etc/redhat-release Red Hat Enterprise Linux Server release 7.2 (Maipo) all message files under /var/log are ZERO how it could be ? what is wrong here ? -rw-------. 1 ...
0
votes
1answer
404 views

Writing to /dev/kmsg randomly shows up in /proc/kmsg and always in dmesg?

When writing a message to /dev/kmsg while tailing /proc/kmsg the messages show up very randomly, in never shows up in /var/log/kern.log. However, dmesg gets all the messages correctly. Example # ...
0
votes
2answers
53 views

Syslog Output File Splitting HOURLY at Syslog Server

I have implemented syslog server on CentOS and using below Template to generate output file on daily basis - $template TmplNationalIP_PL, "/var/log/NIPFW/MX480/CGNAT_PL_%$year%.%$month%.%$day%" if ($...
0
votes
2answers
28 views

Centos 7 rsyslog service issue

I have a problem concerning rsyslog. After system reboot, the service does not start after a few tries. I noticed, that pid file still exists after reboot, and after rm /var/run/syslogd.pid I can ...
0
votes
1answer
38 views

How to negate certain messages based on negation syntax

I want to use negation to stop certain messages to be passed on the rsyslog bassed on the $rawmsg. Message exaple like: (root) CMD (LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/...
2
votes
1answer
112 views

How to discard particular Severity's in the Rsyslog Server

I have an rsyslog server that's having the data from multiple remote clients; now I want to discard particular Severity types like warn , info and debug and the rest of the messages I want to be ...
1
vote
1answer
220 views

What is causing my rsyslog timezone offset and / or time to be incorrect?

I have a central logging server running rsyslog 7.x on RHEL 6 The logs are coming in with a UTC time but an EST offset for a device. Here are some relevant configs. $template TEMPLATE_NAME,"%...
0
votes
0answers
321 views

rsyslog template with multiple filters and condition

This just in continuation of my previous post While working with the rsyslog configuration i have came across many challenges and got to know many caveats of it while most of my config is working now ...
0
votes
1answer
376 views

rsyslog conditional forwarding for remote logs de-formatting the date and time in the log file

I've another question about the conditional forwarding of logs via rsyslog.conf, i have below configuration. # cat /etc/rsyslog.conf ##################################################################...
1
vote
0answers
104 views

Installing mmdblookup module for rsyslog on Ubuntu

I am currently trying to perform an IP lookup in the MaxMind/GeoIP DB lookup via the mmdblookup module of rsyslog. (https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmdblookup.html) As ...
1
vote
1answer
360 views

How to forward rsyslog logs from multiple locations to ELK and make it show in kibana?

rsyslog server template consideration for multiple remote hosts ---> link to previously answered question @ meuh, I find this post very useful as am currently working on this configuration. I ...
0
votes
0answers
62 views

rsyslog: send logs to different file by filtering syslogs

I have a CentOS based rsyslog server which have the below settings, where it's getting all the remote NATing events from multiple hosts. $template TmplcpFW, "/var/log/%HOSTNAME%.log" if ($hostname == ...
0
votes
0answers
30 views

change maillog default path in rsyslog

I am using redhat linux and the default location of my postfix is /var/log/maillog . I am trying to change maillog location to /app/log/maillog. I have tried to update rsyslog.conf mail.* ...
3
votes
2answers
151 views

How to suppress rsyslogd HUPed messages from logcheck?

Getting these... Jan 7 06:25:01 debian liblogging-stdlog: [origin software="rsyslogd" swVersion="8.24.0" x-pid="551" x-info="http://www.rsyslog.com"] rsyslogd was HUPed Debian default logcheck ...
0
votes
0answers
46 views

Rsyslog concatenate postfix output

I'm trying to concatenate postfix log output with rsyslog directly. This is my template. template(name="TestMailTemplate" type="list"){ property(name="timestamp" dateFormat="rfc3339") constant(value="...
2
votes
1answer
343 views

Rsyslog exclude $programname from syslog

I get duplication on a remote rsyslog server: Even though I've configured a catch for clamav logs from mail servers - I still get the logs appearing in syslog # Configuration for Mail ClamAV logs in ...
2
votes
1answer
406 views

rsyslog conditional forwarding for remote logs

I have a rsyslog Server which have the below settings,Where its getting all the remote Linux systems logs and network logs. # cat /etc/rsyslog.conf $ModLoad imudp $UDPServerRun 514 $...
-8
votes
1answer
54 views

Write an login script on Ubuntu [closed]

The idea is that I need to write the username and the password and the script tell me who I am. if: username: admin pass: admin the script echo: "you are an admin" if: username: user pass: user the ...
0
votes
1answer
572 views

rsyslog: send logs to different file using custom template

So, I'm using systemd to send the logs to rsyslog, and I want to write the logs to /var/log/app.log. Since it is a Java app with its own log format, I don't want to have timestamps or anything on it,...
0
votes
1answer
60 views

Rsyslog alter log line before forwarding

being on Ubuntu 16.04.5 LTS with rsyslogd. We have the following situation: (1) An appliance forwards syslog to the Ubuntu host. (2) Ubuntu Host stores those forwarded messages in a separate logfile ...
1
vote
1answer
77 views

My attempts to use rsyslog to route messages to a log file

In myapp.service, I have : StandardOutput=syslog StandardErr=syslog When I do : $ journalctl -e -u myapp I can see each line of log contains "myapp[PID]". I've tried to set up /etc/rsyslog.d/...
-1
votes
1answer
114 views

Could I disable syslog.service after installing rsyslog on Ubuntu 18.04 server?

I am making a minimal Ubuntu for embedded system starting from Ubuntu base. Our samba-related script code relies on rsyslog so I installed this package. systemctl shows there is also a syslog.service,...
0
votes
1answer
86 views

journald socket buffering for option ForwardToSyslog

I have a configuration in which journald is set with ForwardToSyslog=yes. Quote from the documentation: If forwarding to syslog is enabled but nothing reads messages from the socket, ...
0
votes
1answer
45 views

How does systemd provide data to the service triggered by a socket?

The concept behind systemd sockets is to provide a "cheap listener service" that will start the "service that would normally bind that socket but we don't want to run it all the time" once data on the ...
0
votes
1answer
422 views

What is the correct syntax for rsyslog's re_match()?

I'm trying to filter unwanted messages from a cron job (systemd) from rsyslog output. However rsyslog always complains about the second argument of re_match(). The filter rule I have is: if $...
1
vote
1answer
126 views

journald - resent archived logs to logging socket

I have an embedded device that has both systemd and rsyslog. journald is the main mechanism for local logging and rsyslog for remote logging. rsyslog isn't always running and is started only when ...
1
vote
2answers
300 views

Rsyslog - How to disable udp syslog?

Currently rsyslog is listening on both UDP socket and UNIX socket, as shown below: [root@machine ~]# netstat -ap | grep rsyslog udp 0 0 0.0.0.0:59018 0.0.0.0:* ...
1
vote
1answer
979 views

rsyslog server template consideration for multiple remote hosts

Linux Destro is : Centos 6.8 Below is what the rsyslog.conf looks like: # cat /etc/rsyslog.conf $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad ...
1
vote
1answer
149 views

Encryption of syslog & auditd in local disk? [closed]

We need to use encrypted syslog and auditd in local disk. Is it possible to save syslog and auditd message encrypted in disk ?
1
vote
1answer
198 views

Message forwarding with de-duplication - SyslogNG

Based on the advice from answer that says: Simply adding both servers and always write to both is the easiest one, we have setup syslog-NG server on two machines that receive same syslog message and ...
1
vote
1answer
394 views

Remove formatting from specific rsyslog configuration

I'm building an application that will have quite a few moving parts. Some of them will be scheduled by cron, others are triggered by a service using inotify to listen for file arrivals. Because I ...
1
vote
1answer
1k views

Can I use regexp captured string into rsyslog paths?

Say I want to filter logs to use different files per user ID, I can write one rule per uid as here : if $msg contains 'uid=500' then /var/log/uid/500 if $msg contains 'uid=501' then /var/log/uid/501 ...
1
vote
0answers
50 views

rsyslog to stop forwarding logs if recover/destination server is unavailable

I'm forwarding the logs with rsyslog (tcp) from 10 servers to a log collector. RHEL 6.9. If the network between log collector and the servers is down, I'm hitting login issues. Known issue: https://...
1
vote
0answers
98 views

Rsyslogd - remove timestamp on certain logs

I'm trying to achieve the questioned here, but I need to discard the timestamp only on a specific log file. I.e. only /var/log/mylog.log should have no timestamps. Is that possible with rsyslogd?
0
votes
0answers
154 views

LogStash Json ParserError

I need to send a log with JSON format from rsyslog to logsatsh and then from logstash to graylog. All the steps I have done. step 1 : config /etc/rsyslog.conf *.* action(type="omfwd" target="192....
1
vote
1answer
156 views

rsyslog only making log files in /var/logs

Running centos 7, my rsyslog.conf looks like this: 59 # Log all the mail messages in one place. 60 mail.* /var/log/maillog 61 mail.* /var/log/logtest1 62 mail.* /root/logtest Then I use the ...
1
vote
0answers
65 views

journald to rsyslog paging issues

I'm using rsyslog to dump journald entries to a log file so that they can be sent to Logstash. The issue I'm having is that some of the log lines are getting split across two lines. When viewing ...
1
vote
0answers
40 views

Where do Logrotate files end up?

I've got a Graylog server that I configured logrotating on. /var/lib/graylog-server/journal/messagejournal-0/000*.log { size 2G create 550 ubuntu ubuntu rotate 5 } I came in one morning ...
1
vote
0answers
206 views

Why might rsyslog %syslogtag% display “(none)”?

Given the following lines in an instance of /etc/rsyslog.conf: $template MyFmt, "%timereported:::date-year%%timereported:::date-month%%timereported:::date-day%_%timereported:::date-hour%%timereported:...
0
votes
1answer
27 views

Why is 'logger' always executed as the same user?

I'm using rsyslog 8.24 on debian. Each time I trigger logger "some message" the syslog refers to the same and only system user - it does not matter if I switch user (even as root), the messages are ...
1
vote
1answer
249 views

How can I find the configuration file for rsyslog if it's not the default?

By default, rsyslog's config file is in /etc/rsyslog.conf. You can set the config file path on startup with the -f /path/to/file option. My question is: how can you find the config file if it's been ...