Questions tagged [rsyslog]
rsyslog is a popular syslog daemon implementation commonly used on many Linux distributions, e.g. it is the default syslog daemon on Debian.
450 questions
1 vote
1 answer
44 views
rsyslog holds on to dirty pages and does not flush pages to disk
We have kernel dirty bytes settings configured as below. vm.dirty_background_bytes = 262144000 vm.dirty_background_ratio = 0 vm.dirty_bytes = 0 vm.dirty_expire_centisecs = 0 vm.dirty_ratio = 10 vm....
- 11
2 votes
1 answer
101 views
How to disable Journald's ForwardToSyslog=yes on Ubuntu 24.04?
I have Ubuntu 24.04 servers with this Journald config by default: user@server:~$ systemd-analyze cat-config systemd/journald.conf # /etc/systemd/journald.conf # This file is part of systemd. ... [...
- 302
1 vote
0 answers
131 views
SSH logging to external syslog server
I am using CentOS 10, and I am trying to send the SSH logs to an external syslog server listening on port UDP 514. I changed the default logging facility of sshd to local2 and tested it locally and it ...
0 votes
1 answer
65 views
rsyslog dynaFile file name from part of received message
I'm using python logging library to write to log file. Currently It write to a static file, and contain: myapp; 2025-06-25 05:44:38 INFO builtins <module> Hello world I'm new to rsyslog. How to ...
- 103
0 votes
2 answers
135 views
How do I write a rsyslog.d rule to send lines to a file?
I tried # cat /etc/rsyslog.d/foo.sh :msg, contains, "foo" /var/log/foo.log # systemctl restart rsyslog # logger -t foo -p local0.info foo But nothing appears in /var/log/foo.log. Even if I ...
1 vote
0 answers
94 views
Should systemctl restart be equivalent to stop + start?
Today, while trying to debug some rsyslog issues, I changed the rsyslog configuration files and then ran systemctl restart rsyslog A sytemctl status showed that rsyslog was running, but its log files ...
- 930
0 votes
1 answer
150 views
rsyslogd both does and doesn't log in real time
rsyslogd is acting strangely and I don't know why. Sometimes it writes messages to the relevant log files immediately; sometimes it treasures them up in a buffer somewhere and writes them some time ...
- 930
1 vote
3 answers
123 views
Extracting "devname" from log message with re_extract
Can anyone help? I've exhausted my knowledge and troubleshooting skills trying to get this working. Here is the example data from "msg": date=2025-03-26 time=12:45:57 devname="this-is-...
- 11
0 votes
0 answers
69 views
Excessive Log Writing in rsyslog After Module Configuration
After adding the following modules to the /etc/rsyslog.d/ directory, the rsyslog keeps rapidly writing logs to the disk, causing the messages and command.log files to grow quickly with extensive logs. ...
- 1
1 vote
1 answer
113 views
Logging Cisco logs on remote linux syslog
Good evening, I am running multiple cisco routers/switches and a virtualized debian install. In order to have proper forensic capabilities in cse of attack/breach/malfunction I wish to have remote ...
- 11
1 vote
1 answer
116 views
using backticks in rsyslog config - unable to access file
rsyslog 8.2312.0 on Ubuntu 24.04.1 LTS I need to include a license number in a rsyslog record. The license number exists in the file /mydir/license.txt. Using backticks seem to fit the bill, but I can'...
- 131
-1 votes
1 answer
498 views
syslog logging driver giving the error protocol wrong type for socket
I have a service defined via docker compose (see definition below). When I tried to start this service via docker-compose -f up --wait -d my_service, I get the error Error response from daemon: ...
- 3
1 vote
1 answer
1k views
Ubuntu Rsyslog cannot read certificates because permission denies
I am setting up a syslog serer that will listen for logs from a Fortigate firewall. Rsyslog gets error '/home/syslog_cert/ACDC_CA.pem' could not be accessed: Permission denied" This is my rsyslog ...
- 113
-1 votes
1 answer
73 views
logrotate not working as per configuration provided
I am working on a java application running in Ubuntu Server (16.04) which copies log files from certain folders and consolidate then when user closes the session. In ubuntu server rsyslog filters and ...
0 votes
2 answers
672 views
How do I check which conf file was loaded by syslog-ng when starting?
I am running syslog-ng on debian. How do I check which conf file was loaded upon startup? Neither systemctl status syslog-ng nor systemctl show syslog-ng tell me.
- 159