rsyslog

From Gentoo Wiki
Jump to: navigation, search

From Wikipedia, the free encyclopedia:

Rsyslog is an open source software used on UNIX and Unix-like computer systems for forwarding log messages in an IP network. It implements the basic syslog protocol, extends it with content-based filtering, rich filtering capabilities, flexible configuration options and adds important features such as using TCP for transport.

Installation

USE flags

USE flags for app-admin/rsyslog An enhanced multi-threaded syslogd with database support and more

dbi Build the general database output module (requires dev-db/libdbi) local
debug Enable extra debug codepaths, like asserts and extra output. If you want to get meaningful backtraces see https://wiki.gentoo.org/wiki/Project:Quality_Assurance/Backtraces global
doc Add extra documentation (API, Javadoc, etc). It is recommended to enable per package instead of globally global
elasticsearch Build the Elasticsearch output module (requires net-misc/curl) local
gcrypt Add support for encrypted log files using dev-libs/libgcrypt local
grok Build the grok modify module (requires dev-libs/grok) local
jemalloc Use dev-libs/jemalloc for allocations. local
kafka Build the Apache Kafka output module (requires dev-libs/librdkafka) local
kerberos Build the GSSAPI input and output module (requires virtual/krb5) local
libressl Use dev-libs/libressl for building the rfc5424hmac modify module (requires rfc5424hmac USE flag) local
mongodb Build the MongoDB output module (requires dev-libs/libmongo-client) local
mysql Build the MySQL database output module (requires virtual/mysql) local
normalize Build the normalize modify module (requires dev-libs/libee and dev-libs/liblognorm) local
omhttpfs Build the httpfs output module (requires net-misc/curl) local
omudpspoof Build the udpspoof output module (requires net-libs/libnet) local
postgres Build the PostgreSQL database output module (requires dev-db/postgresql) local
rabbitmq Build the RabbitMQ output module (requires net-libs/rabbitmq-c) local
redis Build the Redis output module using (requires dev-libs/hiredis) local
relp Build the Reliable Event Logging Protocol (RELP) output module (requires dev-libs/librelp) local
rfc3195 Build the rfc3195 input module (requires dev-libs/liblogging) local
rfc5424hmac Build the rfc5424hmac modify module (requires dev-libs/openssl or dev-libs/libressl) local
snmp Build the snmp modify and output module (requires net-analyzer/net-snmp) local
ssl Add support for encrypted client/server communication (requires net-libs/gnutls) local
systemd Build the journal input and output module (requires sys-apps/systemd) local
test Workaround to pull in packages needed to run with FEATURES=test. Portage-2.1.2 handles this internally, so don't set it in make.conf/package.use anymore global
usertools Installs the user tools (rsgtutil, rscryutil...) corresponding to the set USE flags local
zeromq Build the ZeroMQ input and output modules (requires net-libs/czmq) local

Emerge

Install app-admin/rsyslog:

root #emerge --ask app-admin/rsyslog
Note
It is a bad idea to run more than one system logger on a physical host. Other local loggers should be removed or disabled.

Configuration

Services

OpenRC

Add rsyslog to default run level:

root #rc-update add rsyslog default

After the emerge has finished, rsyslog should work out of the box with the default configuration; at least for local logging.

Start rsyslog by running:

root #/etc/init.d/rsyslog start

Check file /var/log/messages for syslog entries:

root #tail -f /var/log/messages
2011-07-24T00:31:06.268926+02:00 server kernel: imklog 5.8.1, log source = /proc/kmsg started.
2011-07-24T00:31:06.269053+02:00 server rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="19116" x-info="http://www.rsyslog.com"] start

Files

Basic rsyslog configuration:

FILE /etc/rsyslog.conf
# Support for Local System Logging
$ModLoad imuxsock.so
$IncludeConfig /etc/rsyslog.d/*
*.info;mail.none;authpriv.none;cron.none                -/var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  -/var/log/cron
*.emerg                                                 *
uucp,news.crit                                          -/var/log/spooler
local7.*                                                /var/log/boot.log

Typically messages are logged to files, the file has to be specified with full pathname. Rsyslog uses a simple syntax to filter incoming messages. Syslog messages are classified by facility and severity. According to RFC5424 following severity groups have been defined:

Severity

Numerical Code Severity Description
0 emerg system is unusable
1 alert action must be taken immediately
2 crit critical conditions
3 error error conditions
4 warning warning conditions
5 notice normal but significant condition
6 info informational messages
7 debug debug-level messages

Facility

List of facilities used by rsyslog. Most facilities names are self explanatory. Facilities local0 - local7 common usage is f.e. as network logs facilities for nodes and network equipment. Generally it depends on the situation how to classify logs and put them to facilities. See facilities more as a tool rather than a directive to follow.

Facilities can be adjusted to meet the needs of the user:

Facility
Numerical Code Facility Description
0 kern kernel messages
1 user user-level messages
2 mail mail system
3 daemon system daemons
4 auth security/authorization messages
5 syslog messages generated internally by syslogd
6 lpr line printer subsystem
7 news network news subsystem
8 uucp UUCP subsystem
9 cron clock daemon
10 security security/authorization messages
11 ftp FTP daemon
12 ntp NTP subsystem
13 logaudit log audit
14 logalert log alert
15 clock clock daemon (note 2)
16 local0 local use 0 (local0)
17 local1 local use 1 (local1)
18 local2 local use 2 (local2)
19 local3 local use 3 (local3)
20 local4 local use 4 (local4)
21 local5 local use 5 (local5)
22 local6 local use 6 (local6)
23 local7 local use 7 (local7)

Filtering

List of filtering examples:

  • Redirect all incoming messages from all facilities and with all severeties to /var/log/syslog

*.* -/var/log/syslog

  • Filter out messages with severity critical and save to file /var/log/critical

*.crit -/var/log/critical

  • Do NOT redirect facilities mail, authentication and cron and mail to /var/log/messages, look for the keyword none

mail.none;authpriv.none;cron.none -/var/log/messages

Local logging

Enable local logging from all facilities, to see local events at all.

$ModLoad imuxsock.so

Remote logging

To use remote logging to a syslog server, specify a client to log to a specific server or servers. And a server to receive messages sent by clients. Before configuring choose the protocol. Syslog messages can be sent using UDP or TCP. UDP is the default protocol and supported on most platforms. Not all platforms support TCP for syslog.

Client

To enable syslog UDP messages sending add following line to the /etc/rsyslog.conf file. In this example rsyslog sends all facilities and all priorities *.* using protocol UDP @ to remote server 192.168.20.254

*.* @192.168.20.254

To enable TCP support for syslog messages, put following line to the rsyslog configuraton file, TCP is enabled by adding @@.

*.* @@192.168.20.254

If desired, hostnames can be substituted in for IP addresses.

Important
Substitute 192.168.20.254 with the IP address of the rsyslog server.

Below a example syslog client configuration to send syslog messages to a remote server via TCP.

FILE /etc/rsyslog.conf
$ModLoad imuxsock.so
*.*   @@192.168.20.254:10514
*.info;mail.none;authpriv.none;cron.none      /var/log/messages
authpriv.*                                    /var/log/secure
mail.*                                        /var/log/maillog
cron.*                                        /var/log/cron
*.emerg                                       *
uucp,news.crit                                /var/log/spooler
local7.*                                      /var/log/boot.log

Server

To Provide UDP log reception and run the server on port 514. Running syslog with UDP is the default configuration.

$ModLoad imudp $UDPServerRun 514

UDP is not a reliable protocol. For more reliability run the server with TCP logging support.

$ModLoad imtcp $InputTCPServerRun 10514

A simple configuration would look like this one:

FILE /etc/rsyslog.conf
$ModLoad imuxsock.so
$ModLoad imtcp.so
$InputTCPServerRun 10514
$ModLoad imudp.so
$UDPServerRun 514
*.info;mail.none;authpriv.none;cron.none      /var/log/messages
authpriv.*                                    /var/log/secure
mail.*                                        /var/log/maillog
cron.*                                        /var/log/cron
*.emerg                                       *
uucp,news.crit                                /var/log/spooler
local7.*                                      /var/log/boot.log

Database logging

Rsyslog supports logging to following databases:

After choosing the database logs will be stored to a proper USE flag needs to be enabled and rsyslog has to be rebuild before continuing. This example uses a MySQL database.

Note
Next steps assume a working MySQL database server running on localhost, for installation details follow the MySQL article.

The package ships a SQL script named createDB.sql to create the database layout.

FILE /usr/share/doc/rsyslog-5.8.1/scripts/mysql/createDB.sql
CREATE DATABASE Syslog;
USE Syslog;
CREATE TABLE SystemEvents
(
        ID int unsigned not null auto_increment primary key,
        CustomerID bigint,
        ReceivedAt datetime NULL,
        DeviceReportedTime datetime NULL,
        Facility smallint NULL,
        Priority smallint NULL,
        FromHost varchar(60) NULL,
        Message text,
        NTSeverity int NULL,
        Importance int NULL,
        EventSource varchar(60),
        EventUser varchar(60) NULL,
        EventCategory int NULL,
        EventID int NULL,
        EventBinaryData text NULL,
        MaxAvailable int NULL,
        CurrUsage int NULL,
        MinUsage int NULL,
        MaxUsage int NULL,
        InfoUnitID int NULL ,
        SysLogTag varchar(60),
        EventLogType varchar(60),
        GenericFileName VarChar(60),
        SystemID int NULL
);
CREATE TABLE SystemEventsProperties
(
        ID int unsigned not null auto_increment primary key,
        SystemEventID int NULL ,
        ParamName varchar(255) NULL ,
        ParamValue text NULL
);

Import the /usr/share/doc/rsyslog-5.8.1/scripts/mysql/createDB.sql file to create the "Syslog" database.

user $mysql -u root -p < /usr/share/doc/rsyslog-5.8.1/scripts/mysql/createDB.sql

Create a datebase user for the Syslog database:

mysql> grant ALL ON Syslog.* to rsyslog-user@localhost identified by - 'MySecretPassword'; flush privileges;

To provide SQL database logging support, enable the needed module in /etc/rsyslog.conf

$ModLoad ommysql.so

Tell rsyslog to forward all data to the database, add following to the end of the /etc/rsyslog.conf file:

*.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword

Finally Restart the rsyslog server to adapt new settings

root #/etc/init.d/rsyslog restart

Templates

Many vendors format their syslog messages differently. If the network equipment logs to a central rsyslog server the difference in logging will be easy to notice. After some time of log dumping it will be difficult to filter the syslog server messages for a certain

  • Date
  • Facility
  • Severity
  • Host
  • Syslogtag
  • ProcessID
  • MessageType
  • Message

To unify syslog messages to a certain or preferred format, Rsyslog uses templates which parse arriving messages and "rewrites" them to the desired format.

To maintain a simple and modular configuration, templates are stored within the /etc/rsyslog.d/ directory. To include files stored within the rsyslog.d directory add following line to /etc/rsyslog.conf file:

$IncludeConfig /etc/rsyslog.d/*.conf

Templates should be stored to the /etc/rsyslog.d/ directory.

root #cd /etc/rsyslog.d/
Important
Following templates are working very good, but are not perfect.

Here a simple template for a cisco IOS host which logs to rsyslogd:

FILE /etc/rsyslog.d/template_cisco.conf
$template mysql_cisco, "insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg:R,ERE,1,DFLT:%[A-Z0-9_-]+: (.*)--end%', %syslogfacility%, '%fromhost%', %syslog
priority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%msg:R,ERE,0,DFLT:%[A-Z0-9_-]+:--end%')",SQL

Here a simple template for a ScreenOS host which logs to rsyslogd:

FILE /etc/rsyslog.d/template_netscreen.conf
$template mysql_netscreen, "insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg:R,ERE,1,DFLT:[a-zA-Z0-9-]+: (.*)--end%', %syslogfacility%, '%fromhost%', %s
yslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%msg:R,ERE,0,DFLT:[a-zA-Z0-9-]+:--end%')",SQL

Here a simple template for Linux host which logs to rsyslogd:

{{FileBox|filename=/etc/rsyslog.d/template_linux.conf|1= $template mysql_linux,"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag, ProcessID) values ('%msg%', %syslogfacility%, '%HOSTNAME%',%syslogpriority%, '%timereported::: date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag:R,ERE,1,FIELD:(.+)(\[[0-9]{1,5}\]).*--end%', '%syslogtag:R,ERE,1,BLANK:\[([0-9]{1,5})\]--end%')",SQL }}

Configure rsyslogd which predefined template to apply to which facility, add following template references to the end of the /etc/rsyslog.conf file:

  • All messages arriving at facility local4, are Cisco IOS messages:

local4.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_cisco

  • All messages arriving at facility local5 , are ScreenOS messages:

local5.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_netscreen

  • All messages arriving at syslog consider as Linux messages, and ignore local4 and local5 facilities which have their own templates.

*.*;local4.none;local5.none :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_linux

The following is an example of how the /etc/rsyslog.conf file could look on a syslog server with working templates:

FILE /etc/rsyslog.conf
$ModLoad imudp
$UDPServerRun 514
$ModLoad ommysql.so
$IncludeConfig /etc/rsyslog.d/*.conf

*.info;mail.none;authpriv.none;cron.none	-/var/log/messages
authpriv.*					/var/log/secure
mail.*						-/var/log/maillog
cron.*						-/var/log/cron
*.emerg						*
uucp,news.crit					-/var/log/spooler
local7.*					/var/log/boot.log

local4.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_cisco
local5.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_netscreen
*.*;local4.none;local5.none :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_linux

Reload rsyslog server to apply new changes:

root #/etc/init.d/rsyslog reload

Further examples can be found here.

Troubleshooting

Check if a syslog process is running :

root #ps ux | grep rsyslog
root     9161  0.0  0.0 1323652  3424 ?        Sl   00:51   0:00 /usr/sbin/rsyslogd -c5 -i /var/run/rsyslogd.pid -f /etc/rsyslog.conf

Verify network configuration:

root #netstat -tulpen | grep rsyslog
udp        0      0 0.0.0.0:514             0.0.0.0:*                           0          33472286   9161/rsyslogd
udp6       0      0 :::514                  :::*                                0          33472287   9161/rsyslogd

Verify with the command logger, if messages are arriving in at the syslogserver:

user $logger -t test my syslog-test-message

Following message should appear in the /var/log/messages file if rsyslog is working properly:

root #tail /var/log/messages
...
2011-11-23T00:47:05+01:00 Rsyslogserver test: my syslog-test-message

See also

  • Syslog-ng - A powerful, massively configurable monitoring and logging daemon.

External resources