Questions tagged [rsyslog]
Questions regarding rsyslog, a multi-threaded system and kernel logging daemon.
104 questions
6
votes
2answers
100 views
Rewriting logs received via syslog from another machine
I have Machine A, which is a pfsense installation, that sends logs via syslog to a Ubuntu box. The Ubuntu Box will have to rewrite the logs, to replace for instance host names and change format a bit. ...
0
votes
0answers
25 views
Unable to restart rsyslog service using “sudo systemctl restart rsyslogd”
I am not able to restart rsyslog service using systemctl:
sudo systemctl restart rsyslogd.
I keep getting the time out error message.
0
votes
0answers
31 views
action 'action 7' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
keep getting this :
action 'action 7' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
and cant update this rsyslog when updating getting this:
Reading package lists...
...
0
votes
0answers
25 views
+50
Rsyslog Output to libdbi (MSSQL/FreeTDS) - unable to get the omlibdbi module files
am trying to setup my rsyslog server (Ubuntu, tried 14.04 LTS, 16.04LTS and 18.04 LTS) to write directly to SQL Server, from what I've read this can be done with omlibdbi's freeTDS library.
libdbi ...
0
votes
0answers
30 views
How to set Rsyslog specific IP based logs permission?
I have added the template dynamic file to create syslog based on client IP address in the following file
/etc/rsyslog.conf
$template DynaFile,"/var/log/%FROMHOST-IP%/%syslogfacility-text%.log"
*.* -?...
0
votes
1answer
70 views
How we can monitor the network traffic of logs transferred through the rsyslog
I'm consolidating the client logs to a centralized server in Ubuntu using the rsyslog deamon. While consolidating the logs, how can i see the amount of network traffic or file size transferred from ...
2
votes
1answer
294 views
How to set size for system log
My server dumps because of huge system log files. I've heard that we could limit the size of system log by adding such a line size 100m into the file /etc/logrotate.d/rsyslog to do so.
Now my /etc/...
0
votes
0answers
28 views
GPSD logs on ubuntu (syslog)
I am debugging gpsd in ubuntu. gpsd uses syslog. However I don't know where the log is getting stored. Any clues please?
2
votes
2answers
431 views
rsyslog template date/time format with seconds
My current template configuration of rsyslog looks like this:
/etc/rsyslog.d/00-samba-audit.conf
template(name="sambalog" type="string"
string="%$year%-%$month%-%$day% %$hour%:%$minute% %HOSTNAME% %...
0
votes
1answer
1k views
Every few minutes rsyslog outputs - rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Since my update to 18.04.1 last week from 16.04.5 I've been seeing this in my syslog every few minutes:
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32....
0
votes
0answers
126 views
Using both rsyslog and syslog-ng on 16.04
Our corporate standard for syslog on our Linux systems is rsyslog which is installed by puppet. I have an application that uses syslog-ng parsing, so I also need syslog-ng which I bind to a different ...
0
votes
0answers
40 views
rsyslog big data 44 terabytes of storage yearly on ubuntu 18.04
I have tried rsyslog Remote for Mikrotik user log tcp and udp
Everything was working very well
But there are some problems that I need to attend
If the size of the log is up to 120 GB daily, I need ...
0
votes
1answer
76 views
User creation remote logging
I am trying to centralize logs from different server to one server.
I can centralize logging information via adding auth.* @server_ip:port in /etc/rsyslog.conf from the clients, but now I don't ...
0
votes
1answer
143 views
Rsyslog rate-limiting ubuntu 16.04
I'm testing rsyslog 8.16 on Ubuntu 16.04, and I have this message on my suyslog file
rsyslogd[internal_messages]: 39340 messages lost due to rate-limiting
This is my configuration on /etc/resolv....
0
votes
1answer
933 views
How to stop Dovecot from logging to syslog
I'm running Ubuntu 16.04 with the packaged Dovecot for imap and Roundcube for its web interface. Everything's working dandy except I can't get Dovecot to stop logging imap logins and imap logouts to ...
0
votes
1answer
1k views
Can not seperate DHCPD logs for syslog
I'm trying to separate DHCPD log from syslog file in Ubuntu 16.4 LTS.
In my dhcpd.conf file I have added:
log-facility local7;
And rsyslog.conf file:
#Logging for DHCP service
local7 /var/log/dhcp/...
2
votes
1answer
396 views
Systemd service script not logging during shutdown
Background
NetworkManager doesn't run dispatcher.d/pre-down.d scripts, so I have created a systemd-service script. It is working well during startup and shutdown, but during shutdown it doesn't write ...
0
votes
1answer
463 views
Setup an extra, non-root syslog server as a systemd service
I want to create a systemd service, which would start an extra instance of syslog (I assume rsyslogd, as this seems to be what's installed on my Xenial?). I want it to listen on specified socket (...
0
votes
0answers
351 views
Nginx logging per site to syslog
I'm currently logging each site in nginx using its own access and error log configuration:
access_log syslog:server=localhost,tag=nginx_access_internet,severity=info;
error_log syslog:...
0
votes
1answer
293 views
how to configure rsyslog to receive log from specic IP addresses?
I want to configure rsyslog on a server so that receive logs from specific IP addresses and drop the others.is it possible?
0
votes
0answers
1k views
rsyslog: log message from remote host to specific file
I am trying to log messages from a specific remote host to a separate log file (and only to that file). I tried this:
# cat /etc/rsyslog.d/avs110door.conf
if $fromhost == 'avs110' then /var/log/...
0
votes
1answer
3k views
How can I configure logrotate without having `/etc/logrotate.d/rsyslog`?
I am trying to configure log rotation on my Ubuntu machine so that logs are rotated every day and kept for 14 days. Most tutorials I find, such as this one, mention that I should modify /etc/logrotate....
0
votes
1answer
197 views
Has `/etc/logrotate.d/rsyslog` moved?
I am trying to configure log rotation on my Ubuntu machine so that logs are rotated every day and kept for 14 days. Most tutorials I find, such as this one, mention that I should modify /etc/logrotate....
11
votes
2answers
8k views
Relationship of rsyslog and journald on Ubuntu 16.04
I am running what is a vanilla Ubuntu 16.04 server, and I'm trying to wrap my head around how logging is set up by default. I can see that both journald and rsyslog are installed and running, but it's ...
0
votes
1answer
2k views
How to change path of syslog file from /var/log to /opt/log?
I am using ubuntu 14.04. I have to change the path of syslog file from /var/log to /opt/log. I have changed the path in 50-default.conf file from /var/log to /opt/log. I have restarted the rsyslog ...
0
votes
1answer
843 views
Avoid app logging to syslog
I am trying to setup logging for an app with a new custom conf file under /etc/rsyslog.d
as below & name the file as 30-custom.conf
$template DailyPerHostLogs, "/var/log/rsyslog/<new_folder>...
1
vote
0answers
283 views
Hdd never spins down in Debian or Ubuntu
I am currently using Debian because I have an old computer. I am running xfce4 as DKE. I only want to use it as a print server, nothing else but the hdd keeps running hot to 59Celsius and its not ...
1
vote
0answers
163 views
rsyslog does not foward mail authentication records to remote server
rsyslog forwards auth.log sshd login records to a remote server but not mail authentication attempt records (dovecot:auth) or sudo command records. All mail.log records are forwarded as expected.
10-...
1
vote
1answer
401 views
Send JSON data with logger command
I am trying to use (Ubuntu) logger command to send data to Logstash. I want the data to contain JSON structured data, like:
logger -p syslog.warn "{"user":"admin", "password":"admin"}}"
I remember ...
1
vote
1answer
292 views
Sending syslog messages to storage pool instead of /var/log/
I have a centralized syslog server configured and working. It collects logs from a remote device and stores them in /var/log/<remotehostname>/<logfile>.log, as it should. The problem is, /...
2
votes
1answer
909 views
How to specific “alert” or “info” with logger command in Ubuntu 16.04?
I am using a software F, installed on PC named A (192.168.6.5) (running Windows) for receiving log (rsyslog) from a remote Ubuntu 14.04 server B (192.168.6.6). In F, I can see logs from B with types ...
1
vote
0answers
164 views
14.04.4 to 14.04.5 upgrade: rsyslog script stops working
The docker software (v1.10.2) I run on my Ubuntu 14.04.4 system is configured to save all logs to syslog. To get a specific log file for every docker container, I use the following script:
# /etc/...
0
votes
0answers
361 views
Unable to start rsyslog from cron
My server has rsyslog randomly stops
#service rsyslog status
rsyslog stop/waiting
I try using cron to start rsyslog, but nothing happens:
* * * * * service rsyslog start
So, my question is how to ...
2
votes
0answers
565 views
Rsyslog losing message when sending via TCP
I was trying to build a custom Syslog server on the Windows platform, which I, for a start, am implementing a basic TCP listener (server). I encountered problem and I have asked this on StackOverflow: ...
0
votes
1answer
1k views
rsyslogd wont start correctly on Ubuntu 14.04.4 LTS while using the Init-Script
somehow my init-script for rsyslogd does not work. I tried to enable rsyslogd to accept logging-data on udp:514.
If I start my rsyslogd via Init-Script, no logging-data is forwarded. Not even syslog! ...
0
votes
0answers
506 views
Need help on rsyslog - installation and application
Pardon me if I made a stupid question, I am very new to Linux environment, having only some very basic lessons way back about 10 years ago. I have recently joined a new project that is going to use ...
6
votes
2answers
5k views
Accidentally deleted /var/log/syslog
I accidentally deleted /var/log/syslog and now I can't get rsyslog working.
I was googling, I tried everything I found. To be precise:
I created syslog with touch.
Then I set chmod and chown ...
3
votes
1answer
2k views
Redirect iptables logging to another logfile
I have followed the recipe by @Gilles in this answer. I succeeded, but the problem is that the iptables logging now goes into 3 log files, syslog, kern.log and iptables.log.
Ideally, I want the ...
1
vote
0answers
54 views
rsyslog isolation to avoid system and app mix
I am passing my IIS app logs (log4net) files to rsyslog (/var/log/syslog) in my Ubuntu server.
I want to preserve a special place for these logs and I don't want them to be mixed with other services ...
5
votes
1answer
8k views
How to include millisecond in syslogs?
I have configured rsyslog.conf file in /etc to include my own logs as syslogs in a file at /var/logs.
But after opening the file I got this:
Jun 5 10:09:09 lab-Altos-G330-Mk2 slog[19689]: Hello1
Jun ...
1
vote
1answer
170 views
Ubuntu 14.04 server went offline all of a sudden
I see the below in syslog, not sure what went wrong, any help will be appreciated. Is this beacause of an automatic kernel update as I see a new kernel version?
May 17 10:20:36 vps rsyslogd: [origin ...
1
vote
2answers
7k views
rsyslog server saves logs from remote also in /var/syslog
I have setup my ubuntu server as syslog server to accept all my logs from my router and save them in a seperate mikrotik.log file in the /var/log/ folder.
Everything works but i notice that all ...
2
votes
0answers
287 views
how do I get the atd daemon log at commands?
On HPUX all at jobs are logged in a cron.log file. Alas I cannot find similar on Ubuntu.
I see cron is logged to syslog and I can change rsyslog to log to a cron.log. But my attempts to log at.* ...
1
vote
0answers
507 views
Postfix logs to remote server
On my Ubuntu 14.04 server, I'm using Postfix as a front-end mailserver, and I would like to send all mail related info, including email addresses, to a remote host. In the file /etc/rsyslog.d/50-...
0
votes
1answer
540 views
Difference between 49-haproxy.conf and haproxy.conf files
What is the difference between 49-haproxy.conf and the haproxy.conf files?
Now I have no idea if this is specific to Ubuntu or if this is in general. The documentation on HAProxy is astoundingly bad. ...
2
votes
0answers
77 views
Client to Server Communication for rsyslog
I have two Ubuntu OS in VMware Virtual Machine: one of them is the client ( Ubuntu 14 ) and the other one is the server ( Ubuntu 15 Mate). I want to forward apache logs (access and error logs) from ...
2
votes
1answer
2k views
Replacing rsyslog with syslog-ng depends sylog-ng-core
I am trying to replace the default syslog by syslog-ng.
syslog-ng is our standard and we want to use that syslog agent.
root@VirtualBox:~# apt-get install syslog-ng
Reading package lists... Done
...
2
votes
1answer
65 views
Sporadic messages output to console after logging in
Coming right from a fresh install of Ubuntu 14.04 Minimal/Netboot (plus some small utilities like acpid, wicd-curses, etc.), after logging in, I occasionally get floating messages (the kind typically ...
1
vote
2answers
338 views
syslog still receiving entries after filter to seperate file
First time posting. Trying to get remote devices to into separate log files and not in the main syslog file.
Have created a filter for remote devices to go to a separate file per host, but still ...
2
votes
1answer
577 views
Both journald and rsyslog are running
Since the migration to Ubuntu 15.04 both journald and rsyslog are installed and running.
I'm wondering if this is by design or if rsyslog might not have been uninstalled by accident?
Can I uninstall ...
