Ask Ubuntu
Ask Ubuntu

Questions tagged [rsyslog]

Questions regarding rsyslog, a multi-threaded system and kernel logging daemon.

144 questions
47
votes
6 answers

Is there a way to keep UFW logging out of dmesg?

There are comments in the /etc/rsyslog.d/20-ufw.conf file that give you the option to keep UFW-events from being logged to the kernel and message logs, which i have done. I would really like to get UFW-events out of the dmesg as well, but how to…
3dinfluence
  • 973
28
votes
2 answers

Relationship of rsyslog and journald on Ubuntu 16.04

I am running what is a vanilla Ubuntu 16.04 server, and I'm trying to wrap my head around how logging is set up by default. I can see that both journald and rsyslog are installed and running, but it's not at all clear to me how log messages are…
motns
  • 383
19
votes
2 answers

difference between rsyslogd and syslogd

I was trying to implement some changes to syslogd on Ubuntu 10.04.02 LTS (Server edition). I found /etc/syslog.conf is not present on system, instead I have /etc/rsyslogd.d/*.conf. syslogd can be installed by installing inetutils-syslogd, but I am…
Jamess
  • 3,143
19
votes
2 answers

How do I configure rsyslog to send logs from a specific program to a remote syslog server?

I have a program which outputs to syslog with a given tag/program name. I'd like to be able to filter syslog traffic from that program and send it to a remote syslog server, leaving all other syslog traffic local. I can send all traffic to the…
Simmo
  • 293
17
votes
1 answer

syslog not showing log levels in messages

Here is sample output of my syslog messages in /var/log/syslog: Nov 15 20:20:48 ubuntu winbindd[915]: [2011/11/15 20:20:48.940063, 0] winbindd/idmap_tdb.c:287(idmap_tdb_open_db) Nov 15 20:20:48 ubuntu winbindd[915]: Upgrade of IDMAP_VERSION from…
user837208
  • 325
  • 1
  • 3
  • 6
14
votes
2 answers

Accidentally deleted /var/log/syslog

I accidentally deleted /var/log/syslog and now I can't get rsyslog working. I was googling, I tried everything I found. To be precise: I created syslog with touch. Then I set chmod and chown correctly. Now ls -al gives this result: -rw-r----- 1…
balping
  • 453
13
votes
7 answers

UFW is not logging how do I troubleshoot?

I have set logging to high. I am not seeing any log messages. I do see the empty ufw.log file. No messages in dmesg
sureshvv
  • 596
12
votes
1 answer

rsyslogd using 100% cpu on ubuntu 14.04

On my ubuntu 14.04 rsyslogd is using 100% of my CPU (both cores). Even after some google searching I were not able to figure out why rsyslogd is using all of the cpu capacity all the time. The solution I came up with was this: service rsyslog…
daniel451
  • 7,613
12
votes
1 answer

Missing /dev/xconsole causes rsyslog to stop as well as all other services

I'm running Ubuntu-10.04.04LTS in Hyper-V environments. I found that SSH, HTTP or any other service else stopped because the rsyslog daemon had died with the message unable to find the /dev/xconsole file. I fixed it temporarily with the…
George Van Tuyl
  • 121
11
votes
3 answers

could not load module rsyslog lmnsd_gtls.so

The rsyslog module is showing up in system log /var/log/syslog as message repeated. rsyslog was also showing 99% cpu use in top at one point, possibly unrelated. tail /var/log/syslog Dec 1 22:18:16 here rsyslogd-2066: could not load module…
here
  • 1,282
  • 1
  • 11
  • 18
11
votes
1 answer

What does the minus sign at the beginning of a log file directory mean?

I just started to learn linux with Ubuntu 18.04. When I was reading the config file for rsyslog: /etc/rsyslog.d/50-default.conf , I found that some of the log file directories are having minus signs at their beginning, like the one I pasted…
Chaozy
  • 121
11
votes
2 answers

Where do log messages go with journald and rsyslog

On Ubuntu 18.04 both journald and rsyslog are installed. Both serve the same purpose of collecting log messages and storing them. So we have two programs doing the same work here. What I could find out is that journald only saves log messages in its…
ygoe
  • 1,058
10
votes
2 answers

Every few minutes rsyslog outputs - rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]

Since my update to 18.04.1 last week from 16.04.5 I've been seeing this in my syslog every few minutes: Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ] Aug 19…
Chris Pollock
  • 511
  • 2
  • 5
  • 15
9
votes
2 answers

asynchronous logging via rsyslogd(8) and write buffer increase

On a pretty high traffic web site running in virtual containers (VMware) and lacking local storage, we've managed to increase throughput (requests per second) significantly by switching from logging directly into log-files (which reside on remote…
arielf
  • 2,883
8
votes
2 answers

Purpose of "postrotate invoke-rc.d rsyslog rotate" when logrotating, and is this command outdated?

When using logrotate to keep log files rotating, I have seen postrotate invoke-rc.d rsyslog rotate > /dev/null endscript I know postrotate makes bash execute the following command after the log file is rotated, but what is the…
fpghost
  • 1,659
  • 4
  • 24
  • 35
1
2 3
…
9 10