Rsyslog

From Wikipedia, the free encyclopedia: ''Rsyslog is an open source software used on UNIX and Unix-like computer systems for forwarding log messages in an IP network. It implements the basic syslog protocol, extends it with content-based filtering, rich filtering capabilities, flexible configuration options and adds important features such as using TCP for transport.''

Installation
emerge rsyslog

Add rsyslog to default startup level

After emerge has finished, rsyslog should work out of the box with the shipped default configuration, at least for local logging. Start rsyslog

Check file for syslog entries

Successful startup notifcation 2011-07-24T00:31:06.268926+02:00 server kernel: imklog 5.8.1, log source = /proc/kmsg started. 2011-07-24T00:31:06.269053+02:00 server rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="19116" x-info="http://www.rsyslog.com"] start

Configuration
Basic rsyslog configuration.

Typically messages are logged to files, the file has to be specified with full pathname. Rsyslog uses a a simple syntax to filter incoming messages. Syslog messages are classified by facility and severity. According to rfc3164 following severity groups have been defined:

Facility
List of facilities used by rsyslog. Most facilities names are self explanatory. Facilities local0 - local7 common usage is f.e. as network logs facilities for nodes and network equipment. Generally it depends on the situation how to classify logs and put them to facilities. See facilities more as a tool rather than a directive to follow. You can configure it to your own needs.

Filtering
List of filtering examples *.* -/var/log/syslog *.crit -/var/log/critical mail.none;authpriv.none;cron.none -/var/log/messages
 * Redirect all incoming messages from all facilities and with all severeties to
 * Filter out messages with severity critical and save to file
 * Do NOT redirect facilities mail, authentication and cron and mail to, look for the keyword ''none}}

Local Logging
Enable local logging from all facilities, to see local events at all. $ModLoad imuxsock.so

Remote Logging
To use remote logging to a syslog server you need to specify a client to log to a specific server or servers. And a server to receive messages sent by clients. Before configuring you have to chose the protocol. Syslog messages can be sent with UDP or with TCP. UDP is the default protocol and supported on most platforms. Not all platforms support TCP for syslog.

Client
To enable syslog UDP messages sending add following line to your file. In this example rsyslog sends all facilities and all priorities *.* using protocol UDP @ to remote server 192.168.20.254 *.*      @192.168.20.254 To enable TCP support for syslog messages, put following line to the rsyslog configuraton file, TCP is enabled by adding @@. *.*      @@192.168.20.254 You can use also a hostname instead of a IP address.

Below a example syslog client configuration sending UDP log messages to a remote server.

Server
To Provide UDP Log reception and run the server on port 514. Running syslog with UDP is the default configuration. $ModLoad imudp $UDPServerRun 514 UDP is not a reliable protocol, you could run the server with TCP logging support. $ModLoad imtcp $InputTCPServerRun 10514 A simple configuration would look like this one:

Database Logging
Rsyslog supports logging to following databases
 * MySQL
 * MariaDB
 * PostgreSQL
 * Oracle

The package ships a the file with a SQL script named createDB.sql to create the database layout.

Import the file to create the "Syslog" database.

Create a datebase user for the Syslog database

To provide SQL database logging support, enable the needed module in $ModLoad ommysql.so Tell rsyslog to forward all data to the database, add following to the end of the file: *.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword Finally Restart the rsyslog server to adapt new settings

Templates
If your network equipment logs into a central rsyslog server you will notice many vendors format its syslog messages differently. So it will be difficult after some time to for you filter the syslog server messages for a certain as they arrive at your own syslog server. To unify syslog messages to a certain or preferred format, Rsyslog uses templates which parse arriving messages and "rewrites" them to the desired format.
 * Date
 * Facility
 * Severity
 * Host
 * Syslogtag
 * ProcessID
 * MessageType
 * Message

To maintain a simple and modular configuration, templates are stored within the directory. To include files stored within the rsyslog.d directory add following line to /etc/rsyslog.conf file: $IncludeConfig /etc/rsyslog.d/*.conf Change to directory

Here a simple template for a cisco IOS host which logs to rsyslogd:

Here a simple template for a ScreenOS host which logs to rsyslogd:

Here a simple template for Linux host which logs to rsyslogd:

Configure rsyslogd which predefined template to apply to which facility, add following template references to the end of the file: All messages arriving at facility local4, are Cisco IOS messages: local4.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_cisco All messages arriving at facility local5, are ScreenOS messages: local5.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_netscreen All messages arriving syslog but NOT local4 and NOT local5 are Linux messages: *.*;local4.none;local5.none :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_linux Reload rsyslog server to apply new changes.

Below a short example how the file could look on your own syslog server to get templates working:

Read following article to understand template definitions and usage in rsyslog.

Troubleshooting
Check if a syslog process is running

root    9161  0.0  0.0 1323652  3424 ? Sl  00:51   0:00 /usr/sbin/rsyslogd -c5 -i /var/run/rsyslogd.pid -f /etc/rsyslog.conf Verify network configuration

udp       0      0 0.0.0.0:514             0.0.0.0:*                           0          33472286   9161/rsyslogd udp6      0      0 :::514                  :::*                                0          33472287   9161/rsyslogd Verify with the command logger, messages are arriving in at the syslogserver

Following message should appear in the file if rsyslog is working properly: 2011-11-23T00:47:05+01:00 Rsyslogserver test: my syslog-test-message