Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsyslogd]

The tag has no usage guidance.

0
votes
0answers
44 views

How to disable messages from syslogd for my own user?

I am using a Centos Linux OS with ssh tools. I get these messages every minute. Message from syslogd@rakhsh4 at May 6 17:48:34 ... kernel:[Hardware Error]: Corrected error, no action required. ...
0
votes
0answers
216 views

rsyslog template with multiple filters and condition

This just in continuation of my previous post While working with the rsyslog configuration i have came across many challenges and got to know many caveats of it while most of my config is working now ...
0
votes
1answer
276 views

rsyslog conditional forwarding for remote logs de-formatting the date and time in the log file

I've another question about the conditional forwarding of logs via rsyslog.conf, i have below configuration. # cat /etc/rsyslog.conf ##################################################################...
0
votes
1answer
59 views

Rsyslog alter log line before forwarding

being on Ubuntu 16.04.5 LTS with rsyslogd. We have the following situation: (1) An appliance forwards syslog to the Ubuntu host. (2) Ubuntu Host stores those forwarded messages in a separate logfile ...
1
vote
2answers
258 views

Rsyslog - How to disable udp syslog?

Currently rsyslog is listening on both UDP socket and UNIX socket, as shown below: [root@machine ~]# netstat -ap | grep rsyslog udp 0 0 0.0.0.0:59018 0.0.0.0:* ...
1
vote
0answers
93 views

Rsyslogd - remove timestamp on certain logs

I'm trying to achieve the questioned here, but I need to discard the timestamp only on a specific log file. I.e. only /var/log/mylog.log should have no timestamps. Is that possible with rsyslogd?
0
votes
0answers
145 views

LogStash Json ParserError

I need to send a log with JSON format from rsyslog to logsatsh and then from logstash to graylog. All the steps I have done. step 1 : config /etc/rsyslog.conf *.* action(type="omfwd" target="192....
1
vote
0answers
193 views

Why might rsyslog %syslogtag% display “(none)”?

Given the following lines in an instance of /etc/rsyslog.conf: $template MyFmt, "%timereported:::date-year%%timereported:::date-month%%timereported:::date-day%_%timereported:::date-hour%%timereported:...
1
vote
0answers
439 views

user configuration of rsyslog does not work

I am trying to provide the option to user to add their user configuration option for rsyslog. The default rsyslog is working fine for me. The main or default configuration for rsyslog file looks ...
0
votes
0answers
29 views

Why does rsyslog only infinitely recurse when listening with UDP?

This is a follow-up to this question. I'm trying to understand recursion potential with rsyslog. I have a simple rsyslog configuration that sends syslogs to a named pipe as well as to 127.0.0.1 (i.e. ...
0
votes
1answer
46 views

Why doesn't this rsyslog conf file cause recursion?

I'm studying rsyslog by a combination of man pages, online reading, and experimenting. I'd like to understand why the following does not result in infinite recursion: From terminal 1: $ cat /etc/...
0
votes
2answers
430 views

syslog message format & syslog-ng

Case 1: For the below incoming message of syslog, <14>Mar 22 11:12:06 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.2.3.4/62963->23.58.169.35/443 0x0 junos-https 6.7.8.9/32359->23....
1
vote
0answers
40 views

rsyslog cron.daily warning message

I am running Ubuntu 16.04 and cron is emailing me the following message /etc/cron.daily/logrotate: Warning: Stopping rsyslog.service, but it can still be activated by: syslog.socket I have not made ...
1
vote
1answer
86 views

Use filter rule to redirect _and_ remove from syslogd

Adding this to /etc/rsyslog.d/myapp.conf helpfully sends messages to a dedicated log file. :programname, isequal, "myapp" /var/log/myapp.log The log messages go in my new log file, but they are also ...
1
vote
1answer
397 views

rsyslog: How can I ensure that rsyslog gives an error/debug message whenever the messages are being dropped?

I am using rsyslog to read the logs from an input file (using imfile module) and to send the logs to a remote server using RELP (module omrelp). I am using an action queue for this. It is a disk-...
3
votes
1answer
811 views

syslog duplicate all content

I have a problem that anything that printed to syslog file is appear as duplicate. My search on network show me that /etc/rsyslog.conf contain attribute that should avoid such ...
1
vote
1answer
304 views

Why is rsyslog not listed when I run service?

I'm trying to learn about rsyslog. On one of my linux boxes, I think that rsyslog has been configured to run through systemd based on this output: >systemctl status rsyslog rsyslog.service - ...
1
vote
0answers
386 views

Writing logs on remote server with rsyslog

I am trying to configure my firewall to write logs on a Virtual machine (Debian, bridged adapter). I've managed it to work, however, all messages going to /var/log/messages, if I don't explicitly ...
0
votes
1answer
1k views

Error restarting rsyslog

When restarting rsyslogd in Debian, it gives me the rather cryptic error: rsyslogd: error reading pid file, cannot start up rsyslogd: run failed with error -3000 (see rsyslog.h or try http://www....
1
vote
0answers
327 views

rsyslogd stuck on rotated messages file (and /var/log/messages is empty)

Yesterday /var/log/messages on one server was found empty. Looking into /var/ shows: messages messages-20161125 messages-20161127 But trying to access messages-20161127 hangs the process. tail, ...
9
votes
2answers
8k views

How do I restore `/dev/log` in systemd+rsyslog host?

On RHEL7, systemd-journald takes over many of the responsibilites of what was once done by rsyslogd. Whether by bug or conflict between these two daemons, sometimes /dev/log will go missing. As a ...
0
votes
1answer
538 views

error in rsyslogd after upgrading to Debian9/Stretch Debian 8 without Jessie backports

After upgrading a Debian 8 without backports to Debian 9, when restarting rsyslogd, it trows the following error: rsyslogd: the -4 command line option will go away soon. Please use the global(net....