Questions tagged [rsyslogd]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
10 views

Configuring rsyslog for sending log files to diffrerent remote machines

I am newbie in using rsyslog - I have a scenario where in I want to send file1.log, file2.log to remote machine say 10.10.10.123 , and file3.log to a remote machine say 10.11.11.123. Is it possible ...
0
votes
1answer
17 views

Troubleshooting rsyslog 8.32 on Ubuntu writing to MariaDB

I am trying to get LogAnalyzer running and setup the system based on How to setup loganalyzer with rsyslog on Ubuntu 16.04 LTS / Ubuntu 18.04 LTS. It went smoothly up until the first of LogAnalyzer ...
1
vote
1answer
46 views

rsyslog logs are not stored in queue files

I’m using rsyslog 8.40 and I’m trying to setup logforwarding with queues. I was able to send logs to the forwarding servers using the following configurations. action(type="omfwd" target="host1" ...
2
votes
0answers
16 views

secure log file data not up to date, behind a few hours

When I tail -f my /var/secure log file the data in it is about 3 hours behind the current time. This only happens when someone attacks this particular server and the secure log files blows up with ...
1
vote
0answers
33 views

Slow login, logout and su on Centos

It's been weeks that ssh login, logout and using su to other users on a CentOS 6.8 server been very slow, it takes around 20 seconds to 45 seconds for the login or logout or su to take effect. All my ...
0
votes
0answers
129 views

add module omfwd and omkafka to rsyslog

I install rsyslog latest version, but without omfwd and omkafka module! how can I add these modules? thanks.
2
votes
2answers
321 views

How to split logs into monthly, daily and hourly folders when bringing in syslog events?

I am bringing in log files via rsyslog and my config looks like the following: root@rhel:/etc/rsyslog.d# head mail_prod_logs.conf if $fromhost-ip=="10.10.10.10" and $programname=="AMP_Logs" then -/...
1
vote
2answers
118 views

How to get rid of number suffix in rsyslog's own 'programname' ang 'syslogtag' property

I'm forwarding logs from local rsyslogs to central rsyslog and then to Elasticsearch. Everything works fine, but entries with severity error generated by rsyslog itself have property programname like ...
1
vote
0answers
52 views

switching rsyslog destination file if a directory exists

I have configured rsyslog server to send logs from some remote hosts to specific files in my application directory like that: $template TmplApplication, "/whatever/jboss/logs/%fromhost-ip%/sum.log" ...
0
votes
1answer
311 views

rsyslogd as a syslog forwarder over TLS (certificate based authentication required)

I want to configure a machines rsyslogd (redhat OS7 in this case) to connect via TLS to a central log collector. The resyslogd needs to authenticate with a client certificate. I already have the key, ...
2
votes
1answer
2k views

How to disable messages from syslogd for my own user?

I am using a Centos Linux OS with ssh tools. I get these messages every minute. Message from syslogd@rakhsh4 at May 6 17:48:34 ... kernel:[Hardware Error]: Corrected error, no action required. ...
0
votes
0answers
2k views

rsyslog template with multiple filters and condition

This just in continuation of my previous post While working with the rsyslog configuration i have came across many challenges and got to know many caveats of it while most of my config is working now ...
0
votes
1answer
887 views

rsyslog conditional forwarding for remote logs de-formatting the date and time in the log file

I've another question about the conditional forwarding of logs via rsyslog.conf, i have below configuration. # cat /etc/rsyslog.conf ##################################################################...
0
votes
1answer
359 views

Rsyslog alter log line before forwarding

being on Ubuntu 16.04.5 LTS with rsyslogd. We have the following situation: (1) An appliance forwards syslog to the Ubuntu host. (2) Ubuntu Host stores those forwarded messages in a separate logfile ...
1
vote
2answers
1k views

Rsyslog - How to disable udp syslog?

Currently rsyslog is listening on both UDP socket and UNIX socket, as shown below: [root@machine ~]# netstat -ap | grep rsyslog udp 0 0 0.0.0.0:59018 0.0.0.0:* ...
1
vote
0answers
200 views

Rsyslogd - remove timestamp on certain logs

I'm trying to achieve the questioned here, but I need to discard the timestamp only on a specific log file. I.e. only /var/log/mylog.log should have no timestamps. Is that possible with rsyslogd?
2
votes
0answers
381 views

Why might rsyslog %syslogtag% display “(none)”?

Given the following lines in an instance of /etc/rsyslog.conf: $template MyFmt, "%timereported:::date-year%%timereported:::date-month%%timereported:::date-day%_%timereported:::date-hour%%timereported:...
1
vote
0answers
864 views

user configuration of rsyslog does not work

I am trying to provide the option to user to add their user configuration option for rsyslog. The default rsyslog is working fine for me. The main or default configuration for rsyslog file looks ...
0
votes
1answer
114 views

Why doesn't this rsyslog conf file cause recursion?

I'm studying rsyslog by a combination of man pages, online reading, and experimenting. I'd like to understand why the following does not result in infinite recursion: From terminal 1: $ cat /etc/...
0
votes
2answers
602 views

syslog message format & syslog-ng

Case 1: For the below incoming message of syslog, <14>Mar 22 11:12:06 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.2.3.4/62963->23.58.169.35/443 0x0 junos-https 6.7.8.9/32359->23....
1
vote
0answers
80 views

rsyslog cron.daily warning message

I am running Ubuntu 16.04 and cron is emailing me the following message /etc/cron.daily/logrotate: Warning: Stopping rsyslog.service, but it can still be activated by: syslog.socket I have not made ...
1
vote
1answer
183 views

Use filter rule to redirect _and_ remove from syslogd

Adding this to /etc/rsyslog.d/myapp.conf helpfully sends messages to a dedicated log file. :programname, isequal, "myapp" /var/log/myapp.log The log messages go in my new log file, but they are also ...
2
votes
1answer
777 views

rsyslog: How can I ensure that rsyslog gives an error/debug message whenever the messages are being dropped?

I am using rsyslog to read the logs from an input file (using imfile module) and to send the logs to a remote server using RELP (module omrelp). I am using an action queue for this. It is a disk-...
3
votes
1answer
2k views

syslog duplicate all content

I have a problem that anything that printed to syslog file is appear as duplicate. My search on network show me that /etc/rsyslog.conf contain attribute that should avoid such ...
1
vote
1answer
546 views

Why is rsyslog not listed when I run service?

I'm trying to learn about rsyslog. On one of my linux boxes, I think that rsyslog has been configured to run through systemd based on this output: >systemctl status rsyslog rsyslog.service - ...
1
vote
0answers
492 views

Writing logs on remote server with rsyslog

I am trying to configure my firewall to write logs on a Virtual machine (Debian, bridged adapter). I've managed it to work, however, all messages going to /var/log/messages, if I don't explicitly ...
0
votes
1answer
2k views

Error restarting rsyslog

When restarting rsyslogd in Debian, it gives me the rather cryptic error: rsyslogd: error reading pid file, cannot start up rsyslogd: run failed with error -3000 (see rsyslog.h or try http://www....
1
vote
0answers
419 views

rsyslogd stuck on rotated messages file (and /var/log/messages is empty)

Yesterday /var/log/messages on one server was found empty. Looking into /var/ shows: messages messages-20161125 messages-20161127 But trying to access messages-20161127 hangs the process. tail, ...
10
votes
3answers
14k views

How do I restore `/dev/log` in systemd+rsyslog host?

On RHEL7, systemd-journald takes over many of the responsibilites of what was once done by rsyslogd. Whether by bug or conflict between these two daemons, sometimes /dev/log will go missing. As a ...
1
vote
1answer
611 views

error in rsyslogd after upgrading to Debian9/Stretch Debian 8 without Jessie backports

After upgrading a Debian 8 without backports to Debian 9, when restarting rsyslogd, it trows the following error: rsyslogd: the -4 command line option will go away soon. Please use the global(net....