Questions tagged [rsyslog]

Questions regarding rsyslog, a multi-threaded system and kernel logging daemon.

Filter by
Sorted by
Tagged with
4
votes
0answers
39 views

Syslog full of spam, slowing down PC

I recently upgraded my Desktop and Laptop to Ubuntu 21.04 and my logs are completely filled with message from gnome-shell, kernel and other programs. I have appropriate filers in /etc/rsyslog.d/30-...
0
votes
0answers
33 views

syslog errors and apache2

This is a follow-on to this question... So I can change the ownership of the log file, and the errors stop. I changed the ownership from root:adm to syslog:adm and the errors cease. But when the ...
0
votes
1answer
58 views

How do I squelch specific messages from being logged in syslog?

I'm troubleshooting a problem of system hangs and want to know what's being logged just before the system freeze occurs. This effort is being hampered because my VPN provider (PIA) is logging gobs of ...
0
votes
0answers
95 views

Setting a size limit for current syslog

Based on other threads, the only way to set a size limit on current syslog (/var/log/syslog) seems to be via rsyslog which is a bit tricky. I ended up replacing the line below in /etc/rsyslog.d/50-...
0
votes
0answers
103 views

Massive problems with dpkg and apt-get upgrade

After several attempts to update, upgrade, reconfigure dpkg things and clean or install -f, I am quite desperate, since error messages persist, and I cannot quite find a solution. But let's focus on ...
0
votes
0answers
39 views

Errors “unexpected GnuTLS “ and “netstream session 0x7f149427b840”

Experiencing issues with the Logs ingestion from the firewall to Syslog running with RSyslog (Version: 8.32.0). It’s a Linux Ubuntu machine (Ubuntu 18.04.4 LTS ). We are getting below two errors “...
0
votes
0answers
234 views

'rsyslogd' Process High CPU Usage Problem

We have recently set up RSyslog (On Ubuntu 18.04.4 LTS VM) receiving logs from our Firewalls and then forwarding them to SIEM. The problem with Syslog is after a few hours the CPU starts reaching max ...
0
votes
0answers
350 views

/var/log/syslog not getting rotated

I have a fresh install of ubuntu 20.04. I have set daily rotation in /etc/logrotate.d/rsyslog file with a maxsize of 1M but the /var/log/syslog and kern.log file keeps increasing. Here is the rsyslog ...
0
votes
0answers
59 views

In which file of the Linux registry (/var/log) is access to /etc/shadow stored?

I tried to cat, using a non-root user, the /etc/shadow file. Access has been denied due to lack of permissions, but here's the thing: In which file in the Linux registry (/var/log) is this attempt to ...
0
votes
0answers
99 views

How to rotate a log file in ubuntu 18.04

I am using metabase on a digital ocean droplet with ubuntu 18.04. I followed metabase documentation for debian, but the problem is that after a while, I ended up with a 11GB log file in /var/logs/...
0
votes
1answer
92 views

Why syslog.1 growing?

I see that only syslog.1 is growing in size (Gbs). and rest of the logrotation process is working as usual. I do see compressed syslog2.gz, syslog.3.gz, etc. Why only SYSLOG.1 is growing? Please help #...
0
votes
1answer
243 views

how to change the log level to ERROR for systemd-resolved

I am using ubuntu 20.04, I configured rsyslog to send/forward logs to a remote syslog-ng but I am getting to many WARNING message like this: Server returned error NXDOMAIN, mitigating potential DNS ...
0
votes
0answers
80 views

Howto block wifi-messages flooding syslog?

I'm Martin. I am using Ubuntu "Xenial". lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 16.04.7 LTS Release: 16.04 Codename: xenial For Wifi ...
1
vote
0answers
704 views

How to enable /var/log/debug in Ubuntu 20.04?

The question is: How to enable debug logging that will be written to /var/log/debug? There is a piece of configuration related to debug in /etc/rsyslog.d/50-default.conf: # # Some "catch-all"...
0
votes
0answers
127 views

rsyslog start stop every full hour

I'm using Ubuntu 18.04.4 LTS. I looked at syslog at /var/log/syslog and it seems that every hour rsyslog is being stopped and started again. I'm not really sure what rsyslog does or if it is really ...
0
votes
0answers
103 views

No log files are getting updated on Ubuntu Server

Log files are not being updated on Ubuntu 18.04 Server. My system information is: Distributor ID: Ubuntu Description: Ubuntu 18.04.4 LTS Release: 18.04 Codename: bionic I tried sudo service ...
1
vote
0answers
45 views

traps being sent to rsyslog not in local2 where is conf to set this

We have APC gear sending traps to Ubuntu 18.04. trapd is forwarding these to rsyslog AOK (in same host). But unlike Cisco syslogs (from remote Cisco gear) no usable "Facility" is written ...
6
votes
1answer
2k views

What does the minus sign at the beginning of a log file directory mean?

I just started to learn linux with Ubuntu 18.04. When I was reading the config file for rsyslog: /etc/rsyslog.d/50-default.conf , I found that some of the log file directories are having minus signs ...
1
vote
1answer
416 views

Kern.log and Syslog Growing Uncontrollably (with details)

Similar to other questions about uncontrollable bloat in kern.log and syslog, but in my case I can’t figure out what in the kernel is causing it because I don’t recognize the process and my google ...
1
vote
1answer
338 views

rsyslog stopped creating pid file after upgrade from 18.04 to 20.04

After upgrading from 18.04 LTS to 20.04 LTS rsyslog stopped writing its PID into /(var/)run/rsyslogd.pid file.
3
votes
1answer
2k views

Moving log location for Tomcat 9 on Ubuntu 18.04

On a fresh instance in AWS of Ubuntu 18.04, I have installed tomcat9 through apt. I'm replacing a 14.04 Ubuntu install where i was running tomcat7. Due to the nature of my application, I have a very ...
0
votes
1answer
1k views

rsyslog errors flooding log

Ubuntu 18.04LTS server, My log is suddenly flooded with rsyslog errors: Jan 5 19:17:01 servername rsyslogd: action 'action 13' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/...
1
vote
0answers
628 views

rsyslog suspending while creating directories and files

I'm using Ubuntu 18.04.3 LTS (Bionic Beaver) for details click here. rsyslog version used rsyslogd 8.2001.0.aeabf0e9703b for details click here. /etc/rsyslog.conf file click here. I copied the ...
6
votes
1answer
3k views

Where do log messages go with journald and rsyslog

On Ubuntu 18.04 both journald and rsyslog are installed. Both serve the same purpose of collecting log messages and storing them. So we have two programs doing the same work here. What I could find ...
2
votes
0answers
504 views

Logrotate not doing his job, hdd full because of logs

I have a small microSD ( 3GB ) on a ARM Samsung Artik, with Ubuntu installed. I have installed syslog-ng and Logrotate to manage my logs, because otherwise my memory get filled quickly. My problem ...
0
votes
1answer
1k views

Should I reboot after set new timezone using timedatectl

I am on a 1604 system with timezone A, after I set the timezone to B using timedatectl set-timezone B, everything work fine.('timedatectl status' is B, 'date' command showing the right time, file time ...
6
votes
2answers
2k views

Rewriting logs received via syslog from another machine

I have Machine A, which is a pfsense installation, that sends logs via syslog to a Ubuntu box. The Ubuntu Box will have to rewrite the logs, to replace for instance host names and change format a bit. ...
0
votes
0answers
2k views

Unable to restart rsyslog service using “sudo systemctl restart rsyslogd”

I am not able to restart rsyslog service using systemctl: sudo systemctl restart rsyslogd. I keep getting the time out error message.
0
votes
1answer
483 views

How we can monitor the network traffic of logs transferred through the rsyslog

I'm consolidating the client logs to a centralized server in Ubuntu using the rsyslog deamon. While consolidating the logs, how can i see the amount of network traffic or file size transferred from ...
3
votes
1answer
4k views

How to set size for system log

My server dumps because of huge system log files. I've heard that we could limit the size of system log by adding such a line size 100m into the file /etc/logrotate.d/rsyslog to do so. Now my /etc/...
0
votes
0answers
244 views

GPSD logs on ubuntu (syslog)

I am debugging gpsd in ubuntu. gpsd uses syslog. However I don't know where the log is getting stored. Any clues please?
4
votes
3answers
8k views

rsyslog template date/time format with seconds

My current template configuration of rsyslog looks like this: /etc/rsyslog.d/00-samba-audit.conf template(name="sambalog" type="string" string="%$year%-%$month%-%$day% %$hour%:%$minute% %HOSTNAME% %...
5
votes
1answer
14k views

Every few minutes rsyslog outputs - rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]

Since my update to 18.04.1 last week from 16.04.5 I've been seeing this in my syslog every few minutes: Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32....
0
votes
0answers
67 views

rsyslog big data 44 terabytes of storage yearly on ubuntu 18.04

I have tried rsyslog Remote for Mikrotik user log tcp and udp Everything was working very well But there are some problems that I need to attend If the size of the log is up to 120 GB daily, I need ...
0
votes
1answer
256 views

User creation remote logging

I am trying to centralize logs from different server to one server. I can centralize logging information via adding auth.* @server_ip:port in /etc/rsyslog.conf from the clients, but now I don't ...
0
votes
1answer
425 views

Rsyslog rate-limiting ubuntu 16.04

I'm testing rsyslog 8.16 on Ubuntu 16.04, and I have this message on my suyslog file rsyslogd[internal_messages]: 39340 messages lost due to rate-limiting This is my configuration on /etc/resolv....
0
votes
2answers
2k views

How to stop Dovecot from logging to syslog

I'm running Ubuntu 16.04 with the packaged Dovecot for imap and Roundcube for its web interface. Everything's working dandy except I can't get Dovecot to stop logging imap logins and imap logouts to ...
1
vote
1answer
4k views

Cannot separate DHCPD logs for syslog

I'm trying to separate DHCPD log from syslog file in Ubuntu 16.4 LTS. In my dhcpd.conf file I have added: log-facility local7; And in rsyslog.conf file: #Logging for DHCP service local7 /var/log/...
2
votes
1answer
1k views

Systemd service script not logging during shutdown

Background NetworkManager doesn't run dispatcher.d/pre-down.d scripts, so I have created a systemd-service script. It is working well during startup and shutdown, but during shutdown it doesn't write ...
2
votes
1answer
872 views

Setup an extra, non-root syslog server as a systemd service

I want to create a systemd service, which would start an extra instance of syslog (I assume rsyslogd, as this seems to be what's installed on my Xenial?). I want it to listen on specified socket (...
0
votes
0answers
529 views

Nginx logging per site to syslog

I'm currently logging each site in nginx using its own access and error log configuration: access_log syslog:server=localhost,tag=nginx_access_internet,severity=info; error_log syslog:...
0
votes
1answer
476 views

how to configure rsyslog to receive log from specic IP addresses?

I want to configure rsyslog on a server so that receive logs from specific IP addresses and drop the others.is it possible?
0
votes
0answers
2k views

rsyslog: log message from remote host to specific file

I am trying to log messages from a specific remote host to a separate log file (and only to that file). I tried this: # cat /etc/rsyslog.d/avs110door.conf if $fromhost == 'avs110' then /var/log/...
2
votes
1answer
10k views

How can I configure logrotate without having `/etc/logrotate.d/rsyslog`?

I am trying to configure log rotation on my Ubuntu machine so that logs are rotated every day and kept for 14 days. Most tutorials I find, such as this one, mention that I should modify /etc/logrotate....
0
votes
1answer
282 views

Has `/etc/logrotate.d/rsyslog` moved?

I am trying to configure log rotation on my Ubuntu machine so that logs are rotated every day and kept for 14 days. Most tutorials I find, such as this one, mention that I should modify /etc/logrotate....
26
votes
2answers
15k views

Relationship of rsyslog and journald on Ubuntu 16.04

I am running what is a vanilla Ubuntu 16.04 server, and I'm trying to wrap my head around how logging is set up by default. I can see that both journald and rsyslog are installed and running, but it's ...
0
votes
1answer
6k views

How to change path of syslog file from /var/log to /opt/log?

I am using ubuntu 14.04. I have to change the path of syslog file from /var/log to /opt/log. I have changed the path in 50-default.conf file from /var/log to /opt/log. I have restarted the rsyslog ...
0
votes
1answer
2k views

Avoid app logging to syslog

I am trying to setup logging for an app with a new custom conf file under /etc/rsyslog.d as below & name the file as 30-custom.conf $template DailyPerHostLogs, "/var/log/rsyslog/<new_folder>...
1
vote
0answers
420 views

Hdd never spins down in Debian or Ubuntu

I am currently using Debian because I have an old computer. I am running xfce4 as DKE. I only want to use it as a print server, nothing else but the hdd keeps running hot to 59Celsius and its not ...
1
vote
0answers
263 views

rsyslog does not foward mail authentication records to remote server

rsyslog forwards auth.log sshd login records to a remote server but not mail authentication attempt records (dovecot:auth) or sudo command records. All mail.log records are forwarded as expected. 10-...