Questions tagged [rsyslog]
Questions regarding rsyslog, a multi-threaded system and kernel logging daemon.
139
questions
1
vote
0
answers
36
views
rsyslog not printing emergency logs to the console
I use Ubuntu 24.04 with rsyslogd 8.2312.0.
I am creating a brand new rsyslog server based on Ubuntu 24, and wanted to write it all in RainerScript. I wrote the following:
if ($syslogseverity == 3) ...
- 449
0
votes
0
answers
101
views
Logging user commands
So I am working on this fun project and I've been trying to setup logging for user commands for the past 3 days but nothing seems to work. So for the starters I use Ubuntu 22.04 which runs inside of a ...
0
votes
1
answer
517
views
Is it expected to not have `rsyslog` installed after a fresh install of ubuntu server?
Is it expected to not have rsyslog installed after a fresh install of ubuntu server?
If yes, where do logs that go to /var/log/auth.log actually go then?
Here is what happened: I was looking for /var/...
- 103
0
votes
0
answers
90
views
Avoid logging empty commands in Bash
I am using the following lines at the end of my .bashrc file to log entered bash commands to Syslog:
export PROMPT_COMMAND='
RETRN_VAL=$?;
if [ -f /tmp/lastoutput.tmp ]; then
LAST_OUTPUT=$(cat /...
- 11
0
votes
0
answers
63
views
Auditctl. Auditd. Monitor Link creation. Ubuntu 20.04
Is it possible to monitor creation of link of file? For example, I create file audit_file, so I want to create the rule which triggers when such a command is executed ln -s /home/user/audit_file ...
- 13
0
votes
0
answers
87
views
How to forward remote trap data to a local folder other than var/log/syslog?
My ubuntu receives snmmptrap data from a remote server and it goes to var/log/syslog but I wanted to forward that traffic to a different folder inside /var/log using rsyslog.conf or is there a another ...
- 1
0
votes
0
answers
110
views
Auditd to capture user runing command
I have a audit watch/rule that logs every command executed, but it dose not mention/logs which user executed the command!
Do we have any workaround for that?
- 23
0
votes
1
answer
233
views
rsyslog - how to install rsyslog-imdocker module?
How to install rsyslog-imdocker module for ubuntu 22.04? Tried different things but still with no luck :(
Besides tried to search for the same package on Centos 8 Stream and still the same results,
...
1
vote
1
answer
1k
views
Why does UFW keep logging to syslog even when I turn it off through rsyslog settings?
I've uncommented
& stop
in /etc/rsyslog.d/20-ufw.conf.
I've set
StandardOutput=null
by using
systemctl edit ufw
which shouldnt help anyway because the syslog messages are sent by a "kernel&...
1
vote
0
answers
209
views
Why would a user created systemd service stop forwarding to syslog?
TLDR: I have a centralized syslog server that suddenly stopped receiving syslog message from applications servers. Messages only resumed when I restarted each individual service running on every app ...
- 123
0
votes
0
answers
575
views
xconsole causing rsyslog to fail startup
I am trying to verify that a cronjob ran on WSL2. Sources have told me to check /var/log/syslog. When I navigated there, syslog did not exist. Sources then told me to run service rsyslog start to ...
0
votes
0
answers
125
views
Forwarding historic (old) syslog to syslog server
We can forward syslogs to syslog server by making the below entry in syslog.conf/rsyslog.conf
*.*<space/tab>@<syslog_server_name>:<port_no>
However, this only sends new syslogs, ...
- 1
1
vote
0
answers
1k
views
rsyslogd: action 'action-3-builtin:omfwd' suspended
I want to send MongoDB logs to a Graylog server, and the related rsyslog configuration is as follows:
$InputFileName /var/log/mongodb/mongod_27017.log
$InputFileTag mongodb
$InputFileStateFile mongodb-...
1
vote
1
answer
9k
views
How to disable logging to /var/log/syslog and use only systemd logs
My last question What are the options to manage the size of /var/log/syslog of an embedded system was not answered so I am asking this question to see if it is possible to stop using /var/log/syslog ...
- 133
1
vote
0
answers
936
views
RSyslog CPU usage > 100%
We currently have RSyslog Server (On Linux Ubuntu 18.04 VM LTA with Size: Standard D4s v3 4 vcpus, 16 GiB memory) receiving logs from ZScaler Proxy & FortiGate Firewalls and ingesting them into ...
- 11
1
vote
0
answers
889
views
Change `sshd` log file with `rsyslog`
I want to change the location of sshd logging to an external volume in order to prevent filling up the boot volume. What I thought would work – create /etc/rsyslog.d/sshd.conf with a directive to use ...
- 243
1
vote
0
answers
952
views
Logrotate syslog and mysql error
OS version: 20.04
When trying to manually logrotate, there are errors rotating syslog and mysql.
~$ sudo logrotate -f /etc/logrotate.conf
error: rsyslog:4 unknown unit 'e'
error: found error in /var/...
- 63
1
vote
0
answers
2k
views
How do I prevent broadcast messages to console for specific application?
I am running NUT UPS Tools server on Ubuntu 20.04.3 LTS system. I have to resart the NUT driver every 15 minutes, and each time it restarts the upsmon application broadcasts a message to the console:
...
- 123
0
votes
0
answers
235
views
Can I use an alterative port for syslog if 514 is already taken?
I'm looking to send our Load Balancer's logs to a syslog server. We already have an existing Ubuntu 20.04 syslog server and would like to use this rather than request to stand up a new server. However,...
- 101
4
votes
0
answers
460
views
Syslog full of spam, slowing down PC
I recently upgraded my Desktop and Laptop to Ubuntu 21.04 and my logs are completely filled with message from gnome-shell, kernel and other programs.
I have appropriate filers in /etc/rsyslog.d/30-...
0
votes
0
answers
131
views
syslog errors and apache2
This is a follow-on to this question...
So I can change the ownership of the log file, and the errors stop. I changed the ownership from root:adm to syslog:adm and the errors cease. But when the ...
- 435
0
votes
1
answer
187
views
How do I squelch specific messages from being logged in syslog?
I'm troubleshooting a problem of system hangs and want to know what's being logged just before the system freeze occurs. This effort is being hampered because my VPN provider (PIA) is logging gobs of ...
- 2,257
2
votes
2
answers
4k
views
Setting a size limit for current syslog
Based on other threads, the only way to set a size limit on current syslog (/var/log/syslog) seems to be via rsyslog which is a bit tricky. I ended up replacing the line below in /etc/rsyslog.d/50-...
- 21
0
votes
0
answers
879
views
Massive problems with dpkg and apt-get upgrade [duplicate]
After several attempts to update, upgrade, reconfigure dpkg things and clean or install -f, I am quite desperate, since error messages persist, and I cannot quite find a solution. But let's focus on ...
- 1
1
vote
1
answer
5k
views
/var/log/syslog not getting rotated
I have a fresh install of ubuntu 20.04. I have set daily rotation in /etc/logrotate.d/rsyslog file with a maxsize of 1M but the /var/log/syslog and kern.log file keeps increasing. Here is the rsyslog ...
- 408
0
votes
0
answers
241
views
In which file of the Linux registry (/var/log) is access to /etc/shadow stored?
I tried to cat, using a non-root user, the /etc/shadow file. Access has been denied due to lack of permissions, but here's the thing:
In which file in the Linux registry (/var/log) is this attempt to ...
0
votes
0
answers
385
views
How to rotate a log file in ubuntu 18.04
I am using metabase on a digital ocean droplet with ubuntu 18.04. I followed metabase documentation for debian, but the problem is that after a while, I ended up with a 11GB log file in /var/logs/...
- 111
0
votes
1
answer
2k
views
Why syslog.1 growing?
I see that only syslog.1 is growing in size (Gbs). and rest of the logrotation process is working as usual. I do see compressed syslog2.gz, syslog.3.gz, etc.
Why only SYSLOG.1 is growing? Please help
#...
1
vote
2
answers
3k
views
how to change the log level to ERROR for systemd-resolved
I am using ubuntu 20.04, I configured rsyslog to send/forward logs to a remote syslog-ng but I am getting to many WARNING message like this:
Server returned error NXDOMAIN, mitigating potential DNS ...
- 196
0
votes
0
answers
186
views
Howto block wifi-messages flooding syslog?
I'm Martin.
I am using Ubuntu "Xenial".
lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.7 LTS
Release: 16.04
Codename: xenial
For Wifi ...
- 121
2
votes
0
answers
3k
views
How to enable /var/log/debug in Ubuntu 20.04?
How to enable debug logging that will be written to in /var/log/debug?
There is a piece of configuration related to debug in /etc/rsyslog.d/50-default.conf:
#
# Some "catch-all" log files.
#
...
- 21
1
vote
0
answers
148
views
traps being sent to rsyslog not in local2 where is conf to set this
We have APC gear sending traps to Ubuntu 18.04. trapd is forwarding these to rsyslog AOK (in same host). But unlike Cisco syslogs (from remote Cisco gear) no usable "Facility" is written ...
- 11
11
votes
1
answer
4k
views
What does the minus sign at the beginning of a log file directory mean?
I just started to learn linux with Ubuntu 18.04. When I was reading the config file for rsyslog: /etc/rsyslog.d/50-default.conf , I found that some of the log file directories are having minus signs ...
- 121
1
vote
1
answer
987
views
Kern.log and Syslog Growing Uncontrollably (with details)
Similar to other questions about uncontrollable bloat in kern.log and syslog, but in my case I can’t figure out what in the kernel is causing it because I don’t recognize the process and my google ...
- 13
1
vote
1
answer
3k
views
rsyslog stopped creating pid file after upgrade from 18.04 to 20.04
After upgrading from 18.04 LTS to 20.04 LTS rsyslog stopped writing its PID into /(var/)run/rsyslogd.pid file.
- 503
3
votes
1
answer
4k
views
Moving log location for Tomcat 9 on Ubuntu 18.04
On a fresh instance in AWS of Ubuntu 18.04, I have installed tomcat9 through apt. I'm replacing a 14.04 Ubuntu install where i was running tomcat7. Due to the nature of my application, I have a very ...
- 171
1
vote
1
answer
3k
views
rsyslog errors flooding log
Ubuntu 18.04LTS server, My log is suddenly flooded with rsyslog errors:
Jan 5 19:17:01 servername rsyslogd: action 'action 13' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/...
- 435
1
vote
0
answers
1k
views
rsyslog suspending while creating directories and files
I'm using Ubuntu 18.04.3 LTS (Bionic Beaver) for details click here.
rsyslog version used rsyslogd 8.2001.0.aeabf0e9703b for details click here.
/etc/rsyslog.conf file click here.
I copied the ...
- 2,349
11
votes
2
answers
11k
views
Where do log messages go with journald and rsyslog
On Ubuntu 18.04 both journald and rsyslog are installed. Both serve the same purpose of collecting log messages and storing them. So we have two programs doing the same work here.
What I could find ...
- 1,018
2
votes
0
answers
677
views
Logrotate not doing his job, hdd full because of logs
I have a small microSD ( 3GB ) on a ARM Samsung Artik, with Ubuntu installed.
I have installed syslog-ng and Logrotate to manage my logs, because otherwise my memory get filled quickly.
My problem ...
1
vote
2
answers
6k
views
Should I reboot after set new timezone using timedatectl
I am on a 1604 system with timezone A, after I set the timezone to B using timedatectl set-timezone B, everything work fine.('timedatectl status' is B, 'date' command showing the right time, file time ...
- 131
6
votes
2
answers
3k
views
Rewriting logs received via syslog from another machine
I have Machine A, which is a pfsense installation, that sends logs via syslog to a Ubuntu box. The Ubuntu Box will have to rewrite the logs, to replace for instance host names and change format a bit. ...
- 22.8k
0
votes
0
answers
5k
views
Unable to restart rsyslog service using "sudo systemctl restart rsyslogd"
I am not able to restart rsyslog service using systemctl:
sudo systemctl restart rsyslogd.
I keep getting the time out error message.
0
votes
1
answer
1k
views
How we can monitor the network traffic of logs transferred through the rsyslog
I'm consolidating the client logs to a centralized server in Ubuntu using the rsyslog deamon. While consolidating the logs, how can i see the amount of network traffic or file size transferred from ...
5
votes
1
answer
12k
views
How to set size for system log
My server dumps because of huge system log files. I've heard that we could limit the size of system log by adding such a line size 100m into the file /etc/logrotate.d/rsyslog to do so.
Now my /etc/...
- 1,318
0
votes
0
answers
603
views
GPSD logs on ubuntu (syslog)
I am debugging gpsd in ubuntu. gpsd uses syslog. However I don't know where the log is getting stored. Any clues please?
- 206
4
votes
3
answers
16k
views
rsyslog template date/time format with seconds
My current template configuration of rsyslog looks like this:
/etc/rsyslog.d/00-samba-audit.conf
template(name="sambalog" type="string"
string="%$year%-%$month%-%$day% %$hour%:%$minute% %HOSTNAME% %...
- 361
10
votes
2
answers
24k
views
Every few minutes rsyslog outputs - rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Since my update to 18.04.1 last week from 16.04.5 I've been seeing this in my syslog every few minutes:
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32....
- 511
0
votes
0
answers
97
views
rsyslog big data 44 terabytes of storage yearly on ubuntu 18.04
I have tried rsyslog Remote for Mikrotik user log tcp and udp
Everything was working very well
But there are some problems that I need to attend
If the size of the log is up to 120 GB daily, I need ...
- 11
0
votes
1
answer
875
views
User creation remote logging
I am trying to centralize logs from different server to one server.
I can centralize logging information via adding auth.* @server_ip:port in /etc/rsyslog.conf from the clients, but now I don't ...
- 3