Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsyslogd]

The tag has no usage guidance.

0
votes
1answer
42 views

Rsyslog alter log line before forwarding

being on Ubuntu 16.04.5 LTS with rsyslogd. We have the following situation: (1) An appliance forwards syslog to the Ubuntu host. (2) Ubuntu Host stores those forwarded messages in a separate logfile ...
1
vote
2answers
44 views

Rsyslog - How to disable udp syslog?

Currently rsyslog is listening on both UDP socket and UNIX socket, as shown below: [root@machine ~]# netstat -ap | grep rsyslog udp 0 0 0.0.0.0:59018 0.0.0.0:* ...
0
votes
0answers
18 views

delete csv file by rsyslog after transfer

We have two expectations from the rsyslog. we config : module (load=imfile) input (type="imfile" file="/opt/reports/*.csv") tag="send_csv" ruleset="test") ruleset(name="test") { action (type="omfwd"...
1
vote
0answers
59 views

Rsyslogd - remove timestamp on certain logs

I'm trying to achieve the questioned here, but I need to discard the timestamp only on a specific log file. I.e. only /var/log/mylog.log should have no timestamps. Is that possible with rsyslogd?
0
votes
0answers
75 views

LogStash Json ParserError

I need to send a log with JSON format from rsyslog to logsatsh and then from logstash to graylog. All the steps I have done. step 1 : config /etc/rsyslog.conf *.* action(type="omfwd" target="192....
1
vote
0answers
68 views

Why might rsyslog %syslogtag% display “(none)”?

Given the following lines in an instance of /etc/rsyslog.conf: $template MyFmt, "%timereported:::date-year%%timereported:::date-month%%timereported:::date-day%_%timereported:::date-hour%%timereported:...
1
vote
0answers
242 views

user configuration of rsyslog does not work

I am trying to provide the option to user to add their user configuration option for rsyslog. The default rsyslog is working fine for me. The main or default configuration for rsyslog file looks ...
0
votes
0answers
26 views

Why does rsyslog only infinitely recurse when listening with UDP?

This is a follow-up to this question. I'm trying to understand recursion potential with rsyslog. I have a simple rsyslog configuration that sends syslogs to a named pipe as well as to 127.0.0.1 (i.e. ...
0
votes
1answer
32 views

Why doesn't this rsyslog conf file cause recursion?

I'm studying rsyslog by a combination of man pages, online reading, and experimenting. I'd like to understand why the following does not result in infinite recursion: From terminal 1: $ cat /etc/...
0
votes
2answers
353 views

syslog message format & syslog-ng

Case 1: For the below incoming message of syslog, <14>Mar 22 11:12:06 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.2.3.4/62963->23.58.169.35/443 0x0 junos-https 6.7.8.9/32359->23....
1
vote
0answers
30 views

rsyslog cron.daily warning message

I am running Ubuntu 16.04 and cron is emailing me the following message /etc/cron.daily/logrotate: Warning: Stopping rsyslog.service, but it can still be activated by: syslog.socket I have not made ...
1
vote
1answer
48 views

Use filter rule to redirect _and_ remove from syslogd

Adding this to /etc/rsyslog.d/myapp.conf helpfully sends messages to a dedicated log file. :programname, isequal, "myapp" /var/log/myapp.log The log messages go in my new log file, but they are also ...
1
vote
1answer
292 views

rsyslog: How can I ensure that rsyslog gives an error/debug message whenever the messages are being dropped?

I am using rsyslog to read the logs from an input file (using imfile module) and to send the logs to a remote server using RELP (module omrelp). I am using an action queue for this. It is a disk-...
0
votes
0answers
148 views

How simulate messages to syslog with specific severity and from specific application

I want simulate messages to syslog that contain specific severity ( less than 4) and come from specific application. For example : My syslog row : 3,1,18/07/2017 11:29:57.344065,SCR-172D27,BSERV[...
3
votes
1answer
450 views

syslog duplicate all content

I have a problem that anything that printed to syslog file is appear as duplicate. My search on network show me that /etc/rsyslog.conf contain attribute that should avoid such ...
1
vote
1answer
253 views

Why is rsyslog not listed when I run service?

I'm trying to learn about rsyslog. On one of my linux boxes, I think that rsyslog has been configured to run through systemd based on this output: >systemctl status rsyslog rsyslog.service - ...
1
vote
0answers
306 views

Writing logs on remote server with rsyslog

I am trying to configure my firewall to write logs on a Virtual machine (Debian, bridged adapter). I've managed it to work, however, all messages going to /var/log/messages, if I don't explicitly ...
0
votes
1answer
741 views

Error restarting rsyslog

When restarting rsyslogd in Debian, it gives me the rather cryptic error: rsyslogd: error reading pid file, cannot start up rsyslogd: run failed with error -3000 (see rsyslog.h or try http://www....
1
vote
0answers
262 views

rsyslogd stuck on rotated messages file (and /var/log/messages is empty)

Yesterday /var/log/messages on one server was found empty. Looking into /var/ shows: messages messages-20161125 messages-20161127 But trying to access messages-20161127 hangs the process. tail, ...
8
votes
2answers
6k views

How do I restore `/dev/log` in systemd+rsyslog host?

On RHEL7, systemd-journald takes over many of the responsibilites of what was once done by rsyslogd. Whether by bug or conflict between these two daemons, sometimes /dev/log will go missing. As a ...
0
votes
1answer
471 views

error in rsyslogd after upgrading to Debian9/Stretch Debian 8 without Jessie backports

After upgrading a Debian 8 without backports to Debian 9, when restarting rsyslogd, it trows the following error: rsyslogd: the -4 command line option will go away soon. Please use the global(net....