742
questions
-1
votes
0
answers
12
views
Delete part of message in rsyslog configuration [migrated]
I've configured to receive logs in my rsyslog, and then, it is being sent to a wazuh manager.
The problem is that the log has this part:
....audit_level":"Metadata","message":...
0
votes
0
answers
16
views
rsyslog imfile module, keep creating new log file
module(load="imfile" PollingInterval="10")
input(type="imfile"
tag="existing"
File="/remotelogs//.log"
Severity="info"
...
0
votes
0
answers
23
views
Rsyslog Client hello message showing Too many ciphers when used tls connection
I have configured rsyslog over tls. My client hello message sending too many ciphers:
Tried using debian machines and Redhat 8 Machines both resulted in same way.
rsyslog version: 8.2404 gnutls - 3.7....
0
votes
0
answers
19
views
Can't send auditd log on RHEL 8 Linux to Qradar
I configured on RHEL 8 Server with auditd and rsyslog
/etc/audisp/plugins.d/syslog.conf
active = yes
direction = out
path = builtin_syslog
type = builtin
args = LOG_INFO LOG_LOCAL6
format = string
/...
1
vote
1
answer
74
views
How to catch if-then (and optional else) block from rsyslog config file?
I'd like to catch the following conditional blocks from rsyslog conf file:
if (($fromhost-ip == '127.0.0.1') and ($syslogfacility-text == "local7")) then {
if (re_match($msg, "^[...
0
votes
1
answer
43
views
How to configure TLS programmatically with librelp for a relp server
I am creating a relp server using the librelp headers to receive messages from a client I am also creating. The documentation for this library is extremely sparse, and as such I cannot seem to ...
0
votes
1
answer
29
views
How to write DRY rsyslog rules?
Using rsyslog and specifically liblognorm is it possible to have DRY rules by referencing other rules?
Example: having the following 2 rules which are exactly matching except for the first 3 fields
...
0
votes
0
answers
85
views
CentOS not updating syslog messages to /var/log/messages
Team,
Below is the shell code, which should send events to syslog and when I ran below code, it does not appear any error but when I check /var/log/messages it does not show up.
#!/bin/bash
# Iterate ...
0
votes
0
answers
52
views
RSYSLOG not picking up files named as dates yymmdd
Rsyslog on older OS nodes of Ubuntu 14.04 not picking up logs located on NFS generated as date.
rsyslogd 7.4.4, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
...
0
votes
0
answers
44
views
Python logging to Syslog: only ERROR level messages appear in syslog
I'm encountering an issue with python’s logging module. Although I've configured it to log messages at various levels, only logs with the ERROR level are being recorded in the syslog. Logs at the INFO ...
0
votes
0
answers
41
views
rsyslog - Turning $RepeatedMsgReduction off completely
Currently, $RepeatedMsgReduction is set to on in my Docker image. This image acts as a base image for several other Docker images.
What would be the impacts of turning this off, especially in a loaded ...
0
votes
0
answers
26
views
Unable to build rsyslog with static libz.a (zlib) file
unable to build rsyslog v8.2208.0 with static libz.a library in aix 6.1. libz.a contains object files. so there is no shared object file. while building i'm exporting ZLIB_LIBS to the directory where ...
0
votes
0
answers
92
views
nginx logs (rsyslog) not going through vector.dev
I've got the nginx access_log set up to syslog. The syslog in docker is rsyslog docker appliance alpine (https://hub.docker.com/r/rsyslog/syslog_appliance_alpine).
From rsyslog docker, I could see the ...
0
votes
0
answers
49
views
Rsyslog cannot parse escaped JSON log record?
I have following log record that my app is generating:
{ "msg": " {\"Timestamp\":\"2024-02-23T12:37:32.183981314Z\",\"ID\":\"common\/command.Done\&...
1
vote
1
answer
106
views
Intermittent Syslog Messages Missing with Log4j2
I am currently working on a project where I have to manage logging using Log4j2. I am facing a specific issue related to updating log levels in the log4j2.xml file via a PUT API call.
While the API ...
0
votes
0
answers
39
views
Rsyslog stop working when output destination (rabbitmq) is unavialable
I have rsyslog (8.2310.0) in docker container from latest alpine image as a syslog collector with forwarding to logstash.local and rabbitmq.local
Rsyslog stops working when rabbitmq is unavialable and ...
0
votes
0
answers
67
views
Not getting event data from windows 10 in rsyslog, using NXLog-CE as log forwarding agent
I have generated an event by installing an msi from the web using msiexec command.
msiexec command screenshot
And when i checked the event viewer, there was a event generated, with the url inside ...
0
votes
0
answers
68
views
How to send Window Events using NXLOG to RSYSLOG server
I am trying to send window logs to rsyslog server which is deployed on Azure Cloud. I have configured on both "nxlog" and "rsyslog". But the nxlog does not send any log to the ...
0
votes
0
answers
85
views
Rsyslog - How do you use stop in the control structure without affecting other rules?
How can I apply many control flows without interfering with each other?
For example, many network devices will send messages to that port. I want to create rulesets that will drop logs according to ...
0
votes
0
answers
123
views
In rsyslog, how to add TAG to message by condition?
i wish to add a tag to rsyslog message by condition. For example, if message contains the string "ids-alerts" then add to it the tag "MYTAG". Expected to the message to appear in ...
0
votes
0
answers
309
views
rsyslogd - cannot create '/dev/log': permission denied as non-root user in Kubernetes pod
I am trying to cutover a pod/container to a non-root user - rsyslogd runs as a process in this container.
I am intending to use supercronic as the cron-like process in my container and I am trying to ...
0
votes
1
answer
342
views
Docker Service not starting when trying to set max-size in /etc/docker/daemon.json
The docker service does not seem to recognize the max-size log-opts setting in the daemon.json file and thus fails to start.
/etc/docker/daemon.json
{
"log-driver": "syslog",
...
0
votes
1
answer
265
views
Can't attach a ruleset for imuxsock in rsyslog
I use rsyslog 8.23 together with systemd-journald so I use the following configuration in rsyslog.conf (relevant portions of it) and it works this way with no problem - I can see all messages in my-...
0
votes
0
answers
266
views
How to configure rsyslog to use the imfile module?
I have Red Hat 9.2 with rsyslog v8.2102.0-113.el9_2.1.
I use default /etc/rsyslog.conf and a custom configuration called vums.conf located in /etc/rsyslog.d/.
module(load="imfile")
input(...
0
votes
0
answers
36
views
What happens to syslog if i lock /var/log/messages with fcntl. Will the logs be permanently lost or rsyslog will wait for fcntl to unlock messages?
I am writing a python daemon for a RHEL VM. I want to check some logs in /var/log/messages every 5 mins and move them to another log location if they match certain criteria. While my custom python ...
0
votes
0
answers
16
views
rsyslog: rsyslog mailing list still active, otherwise where to ask for rsyslog advanced syntax experts
rsyslog aficionados,
Is the rsyslog mailing list still active? I signed up for this mailing list over a week ago at
https://lists.adiscon.net/mailman/listinfo/rsyslog, never heard back.
I'm on a few ...
0
votes
0
answers
54
views
rsyslog: Add sequential counter to log messages
Due to unreliable protocol some log messages could be lost on the way to syslog server. In our case, syslog server persist messages to a DB.
We need a reliable way to see if there are messages lost ...
0
votes
0
answers
76
views
Rsyslog behind a proxy
I am using a monitoring software to monitor my infrastructure and I'd like to use rsyslog to forward logs of my database server to it.
But my problem is the following, I am behind a proxy. And I didn'...
0
votes
0
answers
64
views
Configure Vertica DB log to send syslog server
I am very new to Vertica DB. I want to send the vertica.log to remotehost through syslog. I need the steps to with respect to DB and OS.
Please help me to complete my task.
I need the complete steps ...
0
votes
0
answers
97
views
rsyslog templates with custom variables doesnt work
# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides ...
0
votes
0
answers
47
views
Logrotate is not showing logs from 12AM to 6AM UTC
We are using logrotate tool for our AWS ec2 instances. Following is the script I am using in rsyslog file:
/opt/solr-6.5.0/server/logs/solr.log
{
daily
rotate 1
missingok
...
-1
votes
2
answers
232
views
Kibana dashboard not rendred
I'm running a dockerized elastic cluster composed of 3 master and 3 data nodes on AWS instances, using rsyslog and logstash, i collect and store syslog events on elasticsearch index.
till now ...
0
votes
0
answers
193
views
syslog-ng secure TLS connection establish with wrong certificate or without certificate at all
I am trying to configure my syslog-ng client to allow only secure TLS connection to servers.
as a server I am using rsyslog.
I created a self signed CA certificate and distributed it to server and ...
0
votes
0
answers
99
views
Rsyslog not writing any logs from Cisco network devices - all other remote syslog works fine
tcpdump confirms valid syslog is coming in from multiple remote systems - servers and Cisco network equipment.
The servers all come in fine and write to disk, and are shown as being local1:info, but ...
0
votes
0
answers
155
views
Logs not going to centralized Rsyslog server
I have set up my spring application to send the logs to the centralized Rsyslog server which is running on an AWS EC2 instance.
For this, I have the following:
Spring boot application running on my ...
0
votes
0
answers
107
views
Rsyslogd with TCP remote input doesn't write local operating system logs
I configured a rsyslog daemon to accept remote logs via TCP from a Cisco device on Ubuntu 22.04.
Unfortunately, it then doesn't write the local OS logs anymore to files like /var/log/auth.log or /var/...
0
votes
0
answers
55
views
Why logs are not syncing to syslogs server from tcp endpoint
I am creating TCP endpoints for syslogs server and forwarding logs to NewRelic as per rsyslogs configuration
$ModLoad imuxsock
module(load="imudp" threads="8" timeRequery="8&...
0
votes
1
answer
136
views
rsyslog mmextenal logstash json output with escaped quotations and additional quotations
I'm having an issue with getting rsyslog to generate the correct format for logstash. I'm receiving remote rsyslog messages (using RELP) and I'm then processing those messages using some bespoke code ...
0
votes
1
answer
166
views
Rsyslog - RainerScript control structures not working
I am trying to separate rsyslog 8.24 logs from xCAT based on the presence of the string "nagios".
I have following conf file in /etc/rsyslog.d/config_file.conf with the /etc/rsyslog.conf ...
0
votes
0
answers
663
views
Rsyslog not forwarding log messages to Loki (Grafana)
I have set up a Loki server (part of Grafana's monitoring stack) to aggregate and query log data. However, I am experiencing issues with log forwarding from rsyslog to Loki. It seems that the log ...
0
votes
0
answers
130
views
could not load mongodb module for rsyslog
I am trying to configure rsyslog to directly log into MongoDB using the ommongodb module.
I added following code to the rsyslog.conf file:
module(load="ommongodb")
action(type="...
0
votes
0
answers
24
views
output of the most important and frequently encountered logs
I have rsyslog + loganalyzer, it simply displays events that are sent by devices on the network. Is it possible to make the most popular events for the day displayed and not disappear?
0
votes
0
answers
217
views
How do I configure rsyslog mmfields to split an oddly formatted syslog message from an outgoing TACACS server?
I have a valid Rsyslog configuration which generally is working well.
RSyslog version 8.2102.0-10.el8
However I am receiving an oddly formatted (and rather obsolete) "syslog" message from an ...
0
votes
0
answers
160
views
rsyslog | Queue overflow: 4789 events lost
I have the following configuration in my rsyslog.conf and I have increased the nodes that send logs to the server, and now I can see this type of message below in the logs:
2023-05-23T13:09:32+01:00 ...
0
votes
0
answers
1k
views
Getting this error while validating tls certificates x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs
i am looking to implement TLS in rsyslog using golang . I also found library https://github.com/RackSec/ .
func main() {
w, err := syslog.DialWithTLSCertPath("tcp+tls", &...
0
votes
1
answer
319
views
how to send logs to remote Rsyslog server with desired file name with python
I want to send log messages in my scripts in python with logging module in desired file name to remote rsyslog server...but with environment variable in rsyslog server couldn't be done
hear is the ...
-1
votes
1
answer
108
views
rSyslog stopped sending only SOME data
I have configured a remote logging from one of my servers to the central log server via rsyslog TCP/SSL
Everything worked fine until yesterday where most of the files just stop being transmitted while ...
0
votes
1
answer
22
views
Reasoning behind duplicate facility values in RFC5424
Could someone please clarify why there are duplicate entries in RFC5424 Facility values for the following values:
security/authorization messages
clock daemon
Following is the documentation referred ...
0
votes
0
answers
1k
views
Getting rsyslog to write remote logs to a specific file based on the port
I am setting up a simple rsyslog server for 4 different application logs. What I would like to achieve is that each application will send logs to a specific port and it will be written to a specific ...