Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [rsyslog]

rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

rsyslog is an enterprise-ready replacement for the syslog daemon on Linux and other UNIX operating systems.

It consists of an open source project with commercial addons such as the ability to log Windows events, as well as available support contracts.

681 questions
0
votes
1 answer

rsyslog nested rules for snoopy

I currently have a rsyslog rule to split up all logging from snoopy into a file for each user ~$ cat /etc/rsyslog.d/10-snoopy.conf $template DYNsnoopy,"/var/log/snoopy/uid.%msg:R,ERE,1,BLANK:uid:([0-9]*)--end%.log" :programname, isequal, "snoopy"…
Thermionix
  • 917
  • 2
  • 15
  • 28
0
votes
3 answers

How to configure JBoss AS 7 to log to syslog?

How do i configure jboss to log to syslog?
Carl Hörberg
  • 620
  • 4
  • 9
  • 21
0
votes
2 answers

log forwarding performance and OS bottleneck

How many logs/second can usually be handled by syslog servers? By syslog servers, I am referring to rsyslog, syslog-ng, splunk etc. The intent of the question is to find out at what logs/second rate the OS (Linux kernel >=3.0) becomes bottle-neck. …
user837208
  • 105
  • 3
0
votes
2 answers

Redirecting Syslog events from RHEL 6 to RHEL 5: is it possible to provide with the same event format?

For some reasons, we redirect syslog events from RHEL 6 (with rsyslog) to RHEL 5 (with syslogd). On RHEL 6 in rsyslog.conf: *.* @10.30.46.211 On RHEL 5 in /etc/sysconfig/syslog: SYSLOGD_OPTIONS="-r -m 0" On RHEL 6, the event looks…
user54614
  • 379
  • 2
  • 6
  • 18
0
votes
1 answer

Logging MySQL events to file in addition to syslog on Debian

By default, Debian uses rsyslog to handle MySQL error logging. I like this behavior and do not want to change it. However, I would like rsyslog to write MySQL events to /var/log/mysqld.log in addition to the already functional /var/log/syslog. I…
Gregyski
  • 205
  • 1
  • 3
  • 8
0
votes
1 answer

Sending multiple loglines (mysql-slow.log, php5-fpm.log.slow) to syslog

I'm trying to aggregate several sources of error messages into one place, to easier put things into context. I'm currently looking at rsyslog, but I can change this - if it's preventing me from doing what I want to do. My problem is, how can I best…
Kvisle
  • 4,193
  • 24
  • 25
0
votes
1 answer

Send data from rsyslog to a application/script

So I currently have a rsyslog server running on ubuntu that is inserting into a db , this is all fine but I want to do some processing before the insert , I have a script that can do the formatting me but im not sure how to i direct rsyslog to send…
RC1140
  • 185
  • 1
  • 1
  • 8
0
votes
1 answer

how do you convert this syslog-ng cfg to rsyslog?

How do I convert the following to rsyslog syntax? filter local2 { facility(local2); }; filter not_local2 { not facility(local2); }; destination server2 { tcp("server2" port(1111)); }; destination localhost { file ("/var/log/local2.log");…
user30199
  • 139
  • 1
  • 7
0
votes
0 answers

Issue Getting Rsyslog TLS Configuration Working

Overview I have a server that receives Syslog data from external clients, and I do not have administrative access to these clients. The goal is to move the existing configuration to data in transit encryption by implementing TLS for Syslog on TCP…
g9s0x1
  • 1
  • 1
0
votes
0 answers

Split logging on rsyslogd

My goal is to send all logs to one source remote and still log local but then send all the AuditD logs to its own source on port 20002. But for some reason, my auditd logs are still ending up with my syslogs going to port…
Jason
  • 3,931
  • 19
  • 66
  • 107
0
votes
0 answers

Forwarding log of a specific cPanel user from rsyslog.conf to an IP address using TCP

Server is on CloudLinux, cPanel, LiteSpeed, imunify and CSF as firewall. i have multiple domains hosted on my server. I only want to forward one user (all) logs to an specific IP address. Using this code *.*@@:514 it forward all logs to…
Mishael Khan
  • 1
  • 1
0
votes
1 answer

postfix logging no the known defaults

Actually i overtook the administration of a mail cluster which uses postfix. And i was really confused when i saw the different loggings: one of the servers logs to a custom logfile, instead there is no maillog_file defined another server of the…
germebl
  • 11
  • 2
0
votes
0 answers

Add mac address in rsyslog template

I am trying to add system/device mac address in syslog. No solution is working for me. Following command gives me mac address, just wanted to use in rsyslog template. mac_addr=$(ifconfig en0 | awk '/ether/ {print $2}') template template(name="tpl3"…
sandip karanjekar
  • 101
  • 1
0
votes
1 answer

Write path for logging is problematic

My config for my template is as follows. template (name="macfilter" type="string" string="/home/pi/nas/f/remotelogs/%programname:R,ERE,0,FIELD:(([0-9A-fa-f][0-9A-fa-f]: ?[0-9A-fa-f][0-9A-fa-f]: ?[0-9A-fa-f][0-9A-fa-f]: ?[0-9A-fa-f][0-9A-fa-f]:…
David Conway
  • 1
  • 1
0
votes
1 answer

For rsyslog - to what facility do ssh and scp belong to?

I am trying to send all the ssh and scp error messages to a pipe and to configure this in the rsyslog.conf I need to know the facility for these services. Does anybody know this or a resource where there are exemples for the list of facilities? In…
A Mere
  • 3
  • 1
1 2 3
…
45 46