Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsyslog]

rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.

0
votes
1answer
42 views

Rsyslog alter log line before forwarding

being on Ubuntu 16.04.5 LTS with rsyslogd. We have the following situation: (1) An appliance forwards syslog to the Ubuntu host. (2) Ubuntu Host stores those forwarded messages in a separate logfile ...
1
vote
1answer
25 views

My attempts to use rsyslog to route messages to a log file

In myapp.service, I have : StandardOutput=syslog StandardErr=syslog When I do : $ journalctl -e -u myapp I can see each line of log contains "myapp[PID]". I've tried to set up /etc/rsyslog.d/...
-1
votes
0answers
23 views

Parsing non standard rsyslog messages into separate MySQL tables

I am receiving comma-seperated values in the :msg section of rsyslog and need to be able to send them to separate fields in mysql tables based on one of the value types. I've tried writing a template ...
0
votes
0answers
30 views

how to send only specific files to remote server using rsyslog

I using rsyslog. I have multiple servers(rsyslog servers) sending syslog to remote server(syslog-ng server). Right now, I am sending everything to remote server. I want to filter out and send logs ...
-1
votes
0answers
12 views

How do I create exception in rsyslog configuration?

I have a Pfsense gateway which is sending log events to a CentOS 7 rsyslog server. I have various configuration lines like this to filter log events from Pfsense if $fromhost == 'gateway' and $...
-1
votes
1answer
17 views

Could I disable syslog.service after installing rsyslog on Ubuntu 18.04 server?

I am making a minimal Ubuntu for embedded system starting from Ubuntu base. Our samba-related script code relies on rsyslog so I installed this package. systemctl shows there is also a syslog.service,...
0
votes
1answer
28 views

journald socket buffering for option ForwardToSyslog

I have a configuration in which journald is set with ForwardToSyslog=yes. Quote from the documentation: If forwarding to syslog is enabled but nothing reads messages from the socket, ...
0
votes
1answer
28 views

How does systemd provide data to the service triggered by a socket?

The concept behind systemd sockets is to provide a "cheap listener service" that will start the "service that would normally bind that socket but we don't want to run it all the time" once data on the ...
0
votes
1answer
36 views

What is the correct syntax for rsyslog's re_match()?

I'm trying to filter unwanted messages from a cron job (systemd) from rsyslog output. However rsyslog always complains about the second argument of re_match(). The filter rule I have is: if $...
1
vote
1answer
26 views

journald - resent archived logs to logging socket

I have an embedded device that has both systemd and rsyslog. journald is the main mechanism for local logging and rsyslog for remote logging. rsyslog isn't always running and is started only when ...
1
vote
2answers
44 views

Rsyslog - How to disable udp syslog?

Currently rsyslog is listening on both UDP socket and UNIX socket, as shown below: [root@machine ~]# netstat -ap | grep rsyslog udp 0 0 0.0.0.0:59018 0.0.0.0:* ...
0
votes
1answer
87 views

rsyslog server template consideration for multiple remote hosts

Linux Destro is : Centos 6.8 Below is what the rsyslog.conf looks like: # cat /etc/rsyslog.conf $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad ...
1
vote
1answer
50 views

Encryption of syslog & auditd in local disk? [closed]

We need to use encrypted syslog and auditd in local disk. Is it possible to save syslog and auditd message encrypted in disk ?
0
votes
0answers
52 views

rsyslog filtering on syslog server

I have below relevant logs in default file /var/log/messages: 1 2018-10-07T01:32:20.898Z TestFW2 RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="idle Timeout" source-address="100.73.10....
1
vote
1answer
74 views

Message forwarding with de-duplication - SyslogNG

Based on the advice from answer that says: Simply adding both servers and always write to both is the easiest one, we have setup syslog-NG server on two machines that receive same syslog message and ...
1
vote
1answer
37 views

Remove formatting from specific rsyslog configuration

I'm building an application that will have quite a few moving parts. Some of them will be scheduled by cron, others are triggered by a service using inotify to listen for file arrivals. Because I ...
1
vote
1answer
57 views

Can I use regexp captured string into rsyslog paths?

Say I want to filter logs to use different files per user ID, I can write one rule per uid as here : if $msg contains 'uid=500' then /var/log/uid/500 if $msg contains 'uid=501' then /var/log/uid/501 ...
0
votes
0answers
25 views

Filter rsyslog based on custom data (CentOS version)

I am sending to a central rsyslog server from CentOS 6 and 7 clients. I would like to do some special filtering, so that a ruleset is only called for the CentOS 6 boxes. This is what I tried, but ...
0
votes
0answers
18 views

delete csv file by rsyslog after transfer

We have two expectations from the rsyslog. we config : module (load=imfile) input (type="imfile" file="/opt/reports/*.csv") tag="send_csv" ruleset="test") ruleset(name="test") { action (type="omfwd"...
1
vote
0answers
33 views

rsyslog to stop forwarding logs if recover/destination server is unavailable

I'm forwarding the logs with rsyslog (tcp) from 10 servers to a log collector. RHEL 6.9. If the network between log collector and the servers is down, I'm hitting login issues. Known issue: https://...
1
vote
0answers
59 views

Rsyslogd - remove timestamp on certain logs

I'm trying to achieve the questioned here, but I need to discard the timestamp only on a specific log file. I.e. only /var/log/mylog.log should have no timestamps. Is that possible with rsyslogd?
0
votes
0answers
75 views

LogStash Json ParserError

I need to send a log with JSON format from rsyslog to logsatsh and then from logstash to graylog. All the steps I have done. step 1 : config /etc/rsyslog.conf *.* action(type="omfwd" target="192....
1
vote
1answer
66 views

rsyslog only making log files in /var/logs

Running centos 7, my rsyslog.conf looks like this: 59 # Log all the mail messages in one place. 60 mail.* /var/log/maillog 61 mail.* /var/log/logtest1 62 mail.* /root/logtest Then I use the ...
1
vote
0answers
22 views

journald to rsyslog paging issues

I'm using rsyslog to dump journald entries to a log file so that they can be sent to Logstash. The issue I'm having is that some of the log lines are getting split across two lines. When viewing ...
1
vote
0answers
33 views

Where do Logrotate files end up?

I've got a Graylog server that I configured logrotating on. /var/lib/graylog-server/journal/messagejournal-0/000*.log { size 2G create 550 ubuntu ubuntu rotate 5 } I came in one morning ...
1
vote
0answers
68 views

Why might rsyslog %syslogtag% display “(none)”?

Given the following lines in an instance of /etc/rsyslog.conf: $template MyFmt, "%timereported:::date-year%%timereported:::date-month%%timereported:::date-day%_%timereported:::date-hour%%timereported:...
0
votes
1answer
27 views

Why is 'logger' always executed as the same user?

I'm using rsyslog 8.24 on debian. Each time I trigger logger "some message" the syslog refers to the same and only system user - it does not matter if I switch user (even as root), the messages are ...
1
vote
1answer
51 views

How can I find the configuration file for rsyslog if it's not the default?

By default, rsyslog's config file is in /etc/rsyslog.conf. You can set the config file path on startup with the -f /path/to/file option. My question is: how can you find the config file if it's been ...
1
vote
0answers
242 views

user configuration of rsyslog does not work

I am trying to provide the option to user to add their user configuration option for rsyslog. The default rsyslog is working fine for me. The main or default configuration for rsyslog file looks ...
0
votes
1answer
33 views

How do I write a rsyslog rule to forward conditional on facility and fromhost?

This rsyslog rule forwards syslog and auth facilities to another host: syslog,auth.* @another-host The following (taken from here) forwards syslogs conditional on ...
0
votes
0answers
26 views

Why does rsyslog only infinitely recurse when listening with UDP?

This is a follow-up to this question. I'm trying to understand recursion potential with rsyslog. I have a simple rsyslog configuration that sends syslogs to a named pipe as well as to 127.0.0.1 (i.e. ...
1
vote
1answer
126 views

Pass kernel and boot logs to syslog

I have a systemd based system and for some services I had to set up remote logging. The simplest way to set this was to use rsyslog and set the StandardOutput=syslog+console in the unit file. Now I ...
0
votes
1answer
32 views

Why doesn't this rsyslog conf file cause recursion?

I'm studying rsyslog by a combination of man pages, online reading, and experimenting. I'd like to understand why the following does not result in infinite recursion: From terminal 1: $ cat /etc/...
0
votes
1answer
515 views

SFTP not logging to /var/log/sftp.log

This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that! However, for some reason, my logs ...
0
votes
0answers
24 views

rsyslog to log file Redahat Linux, works at boot not on system to start

I have a couple apps that start and log properly to files. This is controlled via conf files for rsyslog. But this logging only works when the system is booted. If I use systemctl to stop//start these ...
0
votes
0answers
27 views

React to a writing error

Hi there, I'm curently working on a debian system, this system (under Jessie) write datas to an SDcard really often, sometimes (i'm working on it but it is not the question here) the system is unable ...
0
votes
0answers
82 views

Hostname in the audit reports not shown

I'm creating a nfs share. Also i configured auditd to combine the logs to a centralized server. I configured audisp-remote as per the instructions in the link: https://luppeng.wordpress.com/2016/08/...
0
votes
1answer
61 views

Which one should I choose for log management, systemd-journald or rsyslog?

We have both systemd-journald and rsyslog running on our linux box, and we have to make a decision bewteen these two for managing our application logs. From what we've known (please correct me if I'm ...
1
vote
1answer
49 views

Dash Slash Meaning vs just Slash -/var vs /var [duplicate]

Working with Centos 7 In the rsyslog.conf file there are some rules that place logs in directories that start with a -/ (Dash slash) before stating which directory to place the logs, while others ...
0
votes
0answers
317 views

rsyslog with TLS error peer did not provide a certificate, not permitted to talk to it

I am getting the following error message. I went over and over on my configs looks ok. I tried different StreamDriver.authmode, x509/name or x509/certvalid but the same error. any help greatly ...
1
vote
1answer
502 views

rsyslog with TLS

I need to disable TLS 1.2 and make sure connection accept TLS version 1.1 cipher suite SHA: AES128 & SHA: AES256. I do not find any supporting documentation to where to define TLS version. I ...
0
votes
0answers
151 views

How to log severity to syslog/rsyslog from docker?

I'm writing an application that needs to be able to log stuff. I run a scala application in docker and use the syslog driver to log to /var/log/syslog and from there i use rsyslog to send my logs to ...
0
votes
2answers
1k views

Why is kill -HUP used in logrotate in RHEL? Is it necessary in all cases?

I see for syslog logging, kill -HUP is used. /var/log/cron /var/log/maillog /var/log/messages /var/log/secure /var/log/spooler { sharedscripts postrotate /bin/kill -HUP `cat /var/run/...
1
vote
1answer
406 views

How to set and use constants in rsyslog (RainerScript)?

I'm writing an application which includes an rsyslog configuration which gets placed in /etc/rsyslog.d/. Certain logmessages should be redirected to a named pipe, like so: template (name="my_fmt" ...
0
votes
0answers
181 views

rsyslog template for Suricata/Snort fast log

I'm trying to understand if it's possible to create a template for a custom imfile configuration that I have in my rsyslog and apply it to forwarded syslog messages. I'm monitoring a file that ...
1
vote
0answers
280 views

rsyslog.conf file stopped receiving logs

I am working on a school project to get logs from a printer sent to splunk. This is a project done by a few batches of students. I initially used the original copy of the rsyslog.conf file done by the ...
0
votes
2answers
353 views

syslog message format & syslog-ng

Case 1: For the below incoming message of syslog, <14>Mar 22 11:12:06 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.2.3.4/62963->23.58.169.35/443 0x0 junos-https 6.7.8.9/32359->23....
0
votes
0answers
56 views

Easy to use iptables log analyzer

For example, I have the following 3 records in an iptables log file (.log). Mar 9 17:05:22 xxx-ThinkPad kernel: [ 9554.663838] A-Prefix-NAME: IN=br0 OUT=br0 PHYSIN=enx00051ba2d1e4 PHYSOUT=enp0s25 ...
0
votes
0answers
221 views

How to confirm if rsyslog transmit only UDP mode

We have rsyslog conifigured and configured is as below $ grep -vE '^#|^$' /etc/rsyslog.conf $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imklog #...
0
votes
0answers
407 views

Bypass systemd-journald to send messages directly to ryslog daemon

As a follow-up of my earlier question Prevent syslogs from being logged under journalctl, and this wonderful JdeBP's answer I want to know how do I bypass systemd-journald to send syslog messages ...