Skip to main content
Filter by
Sorted by
Tagged with
-1 votes
0 answers
12 views

Delete part of message in rsyslog configuration [migrated]

I've configured to receive logs in my rsyslog, and then, it is being sent to a wazuh manager. The problem is that the log has this part: ....audit_level":"Metadata","message":...
Matheo Cáneva's user avatar
0 votes
0 answers
16 views

rsyslog imfile module, keep creating new log file

module(load="imfile" PollingInterval="10") input(type="imfile" tag="existing" File="/remotelogs//.log" Severity="info" ...
ven's user avatar
  • 1
0 votes
0 answers
23 views

Rsyslog Client hello message showing Too many ciphers when used tls connection

I have configured rsyslog over tls. My client hello message sending too many ciphers: Tried using debian machines and Redhat 8 Machines both resulted in same way. rsyslog version: 8.2404 gnutls - 3.7....
Chandra Teja's user avatar
0 votes
0 answers
19 views

Can't send auditd log on RHEL 8 Linux to Qradar

I configured on RHEL 8 Server with auditd and rsyslog /etc/audisp/plugins.d/syslog.conf active = yes direction = out path = builtin_syslog type = builtin args = LOG_INFO LOG_LOCAL6 format = string /...
Huy Lê's user avatar
1 vote
1 answer
74 views

How to catch if-then (and optional else) block from rsyslog config file?

I'd like to catch the following conditional blocks from rsyslog conf file: if (($fromhost-ip == '127.0.0.1') and ($syslogfacility-text == "local7")) then { if (re_match($msg, "^[...
ibt23sec5's user avatar
  • 407
0 votes
1 answer
43 views

How to configure TLS programmatically with librelp for a relp server

I am creating a relp server using the librelp headers to receive messages from a client I am also creating. The documentation for this library is extremely sparse, and as such I cannot seem to ...
TheRamblingLank's user avatar
0 votes
1 answer
29 views

How to write DRY rsyslog rules?

Using rsyslog and specifically liblognorm is it possible to have DRY rules by referencing other rules? Example: having the following 2 rules which are exactly matching except for the first 3 fields ...
weshouman's user avatar
  • 883
0 votes
0 answers
85 views

CentOS not updating syslog messages to /var/log/messages

Team, Below is the shell code, which should send events to syslog and when I ran below code, it does not appear any error but when I check /var/log/messages it does not show up. #!/bin/bash # Iterate ...
GoneCase123's user avatar
0 votes
0 answers
52 views

RSYSLOG not picking up files named as dates yymmdd

Rsyslog on older OS nodes of Ubuntu 14.04 not picking up logs located on NFS generated as date. rsyslogd 7.4.4, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No ...
RMT's user avatar
  • 1
0 votes
0 answers
44 views

Python logging to Syslog: only ERROR level messages appear in syslog

I'm encountering an issue with python’s logging module. Although I've configured it to log messages at various levels, only logs with the ERROR level are being recorded in the syslog. Logs at the INFO ...
Rohit's user avatar
  • 1,184
0 votes
0 answers
41 views

rsyslog - Turning $RepeatedMsgReduction off completely

Currently, $RepeatedMsgReduction is set to on in my Docker image. This image acts as a base image for several other Docker images. What would be the impacts of turning this off, especially in a loaded ...
Kevin Niland's user avatar
0 votes
0 answers
26 views

Unable to build rsyslog with static libz.a (zlib) file

unable to build rsyslog v8.2208.0 with static libz.a library in aix 6.1. libz.a contains object files. so there is no shared object file. while building i'm exporting ZLIB_LIBS to the directory where ...
Revanth's user avatar
  • 13
0 votes
0 answers
92 views

nginx logs (rsyslog) not going through vector.dev

I've got the nginx access_log set up to syslog. The syslog in docker is rsyslog docker appliance alpine (https://hub.docker.com/r/rsyslog/syslog_appliance_alpine). From rsyslog docker, I could see the ...
Undefined Identity's user avatar
0 votes
0 answers
49 views

Rsyslog cannot parse escaped JSON log record?

I have following log record that my app is generating: { "msg": " {\"Timestamp\":\"2024-02-23T12:37:32.183981314Z\",\"ID\":\"common\/command.Done\&...
armaka's user avatar
  • 264
1 vote
1 answer
106 views

Intermittent Syslog Messages Missing with Log4j2

I am currently working on a project where I have to manage logging using Log4j2. I am facing a specific issue related to updating log levels in the log4j2.xml file via a PUT API call. While the API ...
Parth's user avatar
  • 13
0 votes
0 answers
39 views

Rsyslog stop working when output destination (rabbitmq) is unavialable

I have rsyslog (8.2310.0) in docker container from latest alpine image as a syslog collector with forwarding to logstash.local and rabbitmq.local Rsyslog stops working when rabbitmq is unavialable and ...
Alex's user avatar
  • 1
0 votes
0 answers
67 views

Not getting event data from windows 10 in rsyslog, using NXLog-CE as log forwarding agent

I have generated an event by installing an msi from the web using msiexec command. msiexec command screenshot And when i checked the event viewer, there was a event generated, with the url inside ...
Ankur Gangwar's user avatar
0 votes
0 answers
68 views

How to send Window Events using NXLOG to RSYSLOG server

I am trying to send window logs to rsyslog server which is deployed on Azure Cloud. I have configured on both "nxlog" and "rsyslog". But the nxlog does not send any log to the ...
martinix's user avatar
0 votes
0 answers
85 views

Rsyslog - How do you use stop in the control structure without affecting other rules?

How can I apply many control flows without interfering with each other? For example, many network devices will send messages to that port. I want to create rulesets that will drop logs according to ...
Leonardo 's user avatar
0 votes
0 answers
123 views

In rsyslog, how to add TAG to message by condition?

i wish to add a tag to rsyslog message by condition. For example, if message contains the string "ids-alerts" then add to it the tag "MYTAG". Expected to the message to appear in ...
MTZ4's user avatar
  • 2,316
0 votes
0 answers
309 views

rsyslogd - cannot create '/dev/log': permission denied as non-root user in Kubernetes pod

I am trying to cutover a pod/container to a non-root user - rsyslogd runs as a process in this container. I am intending to use supercronic as the cron-like process in my container and I am trying to ...
Kevin Niland's user avatar
0 votes
1 answer
342 views

Docker Service not starting when trying to set max-size in /etc/docker/daemon.json

The docker service does not seem to recognize the max-size log-opts setting in the daemon.json file and thus fails to start. /etc/docker/daemon.json { "log-driver": "syslog", ...
NickP's user avatar
  • 65
0 votes
1 answer
265 views

Can't attach a ruleset for imuxsock in rsyslog

I use rsyslog 8.23 together with systemd-journald so I use the following configuration in rsyslog.conf (relevant portions of it) and it works this way with no problem - I can see all messages in my-...
Mirimat's user avatar
  • 13
0 votes
0 answers
266 views

How to configure rsyslog to use the imfile module?

I have Red Hat 9.2 with rsyslog v8.2102.0-113.el9_2.1. I use default /etc/rsyslog.conf and a custom configuration called vums.conf located in /etc/rsyslog.d/. module(load="imfile") input(...
Ondřej Žižka's user avatar
0 votes
0 answers
36 views

What happens to syslog if i lock /var/log/messages with fcntl. Will the logs be permanently lost or rsyslog will wait for fcntl to unlock messages?

I am writing a python daemon for a RHEL VM. I want to check some logs in /var/log/messages every 5 mins and move them to another log location if they match certain criteria. While my custom python ...
Fahad Khan's user avatar
0 votes
0 answers
16 views

rsyslog: rsyslog mailing list still active, otherwise where to ask for rsyslog advanced syntax experts

rsyslog aficionados, Is the rsyslog mailing list still active? I signed up for this mailing list over a week ago at https://lists.adiscon.net/mailman/listinfo/rsyslog, never heard back. I'm on a few ...
spike's user avatar
  • 61
0 votes
0 answers
54 views

rsyslog: Add sequential counter to log messages

Due to unreliable protocol some log messages could be lost on the way to syslog server. In our case, syslog server persist messages to a DB. We need a reliable way to see if there are messages lost ...
Renuka Manavalan's user avatar
0 votes
0 answers
76 views

Rsyslog behind a proxy

I am using a monitoring software to monitor my infrastructure and I'd like to use rsyslog to forward logs of my database server to it. But my problem is the following, I am behind a proxy. And I didn'...
Julianit0w's user avatar
0 votes
0 answers
64 views

Configure Vertica DB log to send syslog server

I am very new to Vertica DB. I want to send the vertica.log to remotehost through syslog. I need the steps to with respect to DB and OS. Please help me to complete my task. I need the complete steps ...
user183298's user avatar
0 votes
0 answers
97 views

rsyslog templates with custom variables doesnt work

# The imjournal module bellow is now used as a message source instead of imuxsock. $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imjournal # provides ...
seylul's user avatar
  • 61
0 votes
0 answers
47 views

Logrotate is not showing logs from 12AM to 6AM UTC

We are using logrotate tool for our AWS ec2 instances. Following is the script I am using in rsyslog file: /opt/solr-6.5.0/server/logs/solr.log { daily rotate 1 missingok ...
Shrottam Nayan's user avatar
-1 votes
2 answers
232 views

Kibana dashboard not rendred

I'm running a dockerized elastic cluster composed of 3 master and 3 data nodes on AWS instances, using rsyslog and logstash, i collect and store syslog events on elasticsearch index. till now ...
Chawki's user avatar
  • 347
0 votes
0 answers
193 views

syslog-ng secure TLS connection establish with wrong certificate or without certificate at all

I am trying to configure my syslog-ng client to allow only secure TLS connection to servers. as a server I am using rsyslog. I created a self signed CA certificate and distributed it to server and ...
guy1010's user avatar
  • 11
0 votes
0 answers
99 views

Rsyslog not writing any logs from Cisco network devices - all other remote syslog works fine

tcpdump confirms valid syslog is coming in from multiple remote systems - servers and Cisco network equipment. The servers all come in fine and write to disk, and are shown as being local1:info, but ...
mkramer317's user avatar
0 votes
0 answers
155 views

Logs not going to centralized Rsyslog server

I have set up my spring application to send the logs to the centralized Rsyslog server which is running on an AWS EC2 instance. For this, I have the following: Spring boot application running on my ...
Gurucharan Sharma's user avatar
0 votes
0 answers
107 views

Rsyslogd with TCP remote input doesn't write local operating system logs

I configured a rsyslog daemon to accept remote logs via TCP from a Cisco device on Ubuntu 22.04. Unfortunately, it then doesn't write the local OS logs anymore to files like /var/log/auth.log or /var/...
absld's user avatar
  • 1
0 votes
0 answers
55 views

Why logs are not syncing to syslogs server from tcp endpoint

I am creating TCP endpoints for syslogs server and forwarding logs to NewRelic as per rsyslogs configuration $ModLoad imuxsock module(load="imudp" threads="8" timeRequery="8&...
PPShein's user avatar
  • 13.7k
0 votes
1 answer
136 views

rsyslog mmextenal logstash json output with escaped quotations and additional quotations

I'm having an issue with getting rsyslog to generate the correct format for logstash. I'm receiving remote rsyslog messages (using RELP) and I'm then processing those messages using some bespoke code ...
Sean Lennon's user avatar
0 votes
1 answer
166 views

Rsyslog - RainerScript control structures not working

I am trying to separate rsyslog 8.24 logs from xCAT based on the presence of the string "nagios". I have following conf file in /etc/rsyslog.d/config_file.conf with the /etc/rsyslog.conf ...
Marek Štekláč's user avatar
0 votes
0 answers
663 views

Rsyslog not forwarding log messages to Loki (Grafana)

I have set up a Loki server (part of Grafana's monitoring stack) to aggregate and query log data. However, I am experiencing issues with log forwarding from rsyslog to Loki. It seems that the log ...
Šimon Kováč's user avatar
0 votes
0 answers
130 views

could not load mongodb module for rsyslog

I am trying to configure rsyslog to directly log into MongoDB using the ommongodb module. I added following code to the rsyslog.conf file: module(load="ommongodb") action(type="...
Siddharth909's user avatar
0 votes
0 answers
24 views

output of the most important and frequently encountered logs

I have rsyslog + loganalyzer, it simply displays events that are sent by devices on the network. Is it possible to make the most popular events for the day displayed and not disappear?
user21402031's user avatar
0 votes
0 answers
217 views

How do I configure rsyslog mmfields to split an oddly formatted syslog message from an outgoing TACACS server?

I have a valid Rsyslog configuration which generally is working well. RSyslog version 8.2102.0-10.el8 However I am receiving an oddly formatted (and rather obsolete) "syslog" message from an ...
ols's user avatar
  • 13
0 votes
0 answers
160 views

rsyslog | Queue overflow: 4789 events lost

I have the following configuration in my rsyslog.conf and I have increased the nodes that send logs to the server, and now I can see this type of message below in the logs: 2023-05-23T13:09:32+01:00 ...
letakeda's user avatar
  • 155
0 votes
0 answers
1k views

Getting this error while validating tls certificates x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs

i am looking to implement TLS in rsyslog using golang . I also found library https://github.com/RackSec/ . func main() { w, err := syslog.DialWithTLSCertPath("tcp+tls", &...
Ashutosh Kumar Pandey's user avatar
0 votes
1 answer
319 views

how to send logs to remote Rsyslog server with desired file name with python

I want to send log messages in my scripts in python with logging module in desired file name to remote rsyslog server...but with environment variable in rsyslog server couldn't be done hear is the ...
Poori's user avatar
  • 31
-1 votes
1 answer
108 views

rSyslog stopped sending only SOME data

I have configured a remote logging from one of my servers to the central log server via rsyslog TCP/SSL Everything worked fine until yesterday where most of the files just stop being transmitted while ...
Mr.P's user avatar
  • 1,323
0 votes
1 answer
22 views

Reasoning behind duplicate facility values in RFC5424

Could someone please clarify why there are duplicate entries in RFC5424 Facility values for the following values: security/authorization messages clock daemon Following is the documentation referred ...
Anshul Singhal's user avatar
0 votes
0 answers
1k views

Getting rsyslog to write remote logs to a specific file based on the port

I am setting up a simple rsyslog server for 4 different application logs. What I would like to achieve is that each application will send logs to a specific port and it will be written to a specific ...
raid996's user avatar

1
2 3 4 5
15