rsyslog

From Gentoo Wiki
Jump to:navigation Jump to:search

Resources
This article has some todo items:
  • add simple IPv6 example
  • wikify
  • add systemd

Rsyslog is an open source system for high performance log processing. More than a regular system logger, it is a versatile tool that can take input from many sources and output to many destinations.

Rsyslog supports forwarding log messages over an IP network, to databases, email, etc. and extends the basic syslog protocol with powerful filtering capabilities. It provides powerful configuration options to adapt to specific needs.

Installation

USE flags

USE flags for app-admin/rsyslog An enhanced multi-threaded syslogd with database support and more

clickhouse Build the ClickHouse output module (requires net-misc/curl)
curl Enable http_request() function in RainerScript (requires net-misc/curl)
dbi Build the general database output module (requires dev-db/libdbi)
debug Enable extra debug codepaths, like asserts and extra output. If you want to get meaningful backtraces see https://wiki.gentoo.org/wiki/Project:Quality_Assurance/Backtraces
doc Add extra documentation (API, Javadoc, etc). It is recommended to enable per package instead of globally
elasticsearch Build the Elasticsearch output module (requires net-misc/curl)
gcrypt Add support for encrypted log files using dev-libs/libgcrypt
gnutls Build the GnuTLS network stream driver (requires net-libs/gnutls)
imhttp Build the http input module (requires www-servers/civetweb)
impcap Build the pcap input module (requires net-libs/libpcap)
jemalloc Use dev-libs/jemalloc for memory management
kafka Build the Apache Kafka input/output module (requires dev-libs/librdkafka)
kerberos Build the GSSAPI input and output module (requires virtual/krb5)
kubernetes Build the kubernetes modify plugin (requires net-misc/curl)
mdblookup Build the MaxMind DB lookup message modify plugin using dev-libs/libmaxminddb
mongodb Build the MongoDB output module (requires dev-libs/mongo-c-driver)
mysql Build the MySQL database output module (requires virtual/mysql)
normalize Build the normalize modify module (requires dev-libs/libee and dev-libs/liblognorm)
omhttp Build the http output module (requires net-misc/curl)
omhttpfs Build the httpfs output module (requires net-misc/curl)
omudpspoof Build the udpspoof output module (requires net-libs/libnet)
openssl Build the OpenSSL network stream driver (requires dev-libs/openssl)
postgres Build the PostgreSQL database output module (requires dev-db/postgresql)
rabbitmq Build the RabbitMQ output module (requires net-libs/rabbitmq-c)
redis Build the Redis output module using (requires dev-libs/hiredis)
relp Build the Reliable Event Logging Protocol (RELP) output module (requires dev-libs/librelp)
rfc3195 Build the rfc3195 input module (requires dev-libs/liblogging)
rfc5424hmac Build the rfc5424hmac modify module (requires dev-libs/openssl)
snmp Build the snmp modify and output module (requires net-analyzer/net-snmp)
ssl Add support for encrypted client/server communication (requires net-libs/gnutls)
systemd Build the journal input and output module (requires sys-apps/systemd)
test Enable dependencies and/or preparations necessary to run tests (usually controlled by FEATURES=test but can be toggled independently)
usertools Installs the user tools (rsgtutil, rscryutil...) corresponding to the set USE flags
uuid Include UUIDs in messages (requires sys-apps/util-linux)
xxhash Enable xxHash support in fmhash module (requires dev-libs/xxhash)
zeromq Build the ZeroMQ input and output modules (requires net-libs/czmq)
Data provided by the Gentoo Package Database · Last update: 2024-07-26 03:39 More information about USE flags

Emerge

Install app-admin/rsyslog:

root #emerge --ask app-admin/rsyslog
Warning
It is a bad idea to run more than one system logger on a physical host. Other local loggers should be removed or disabled.

Configuration

Environment Variables

A list of all environment variables that are read and checked by the rsyslogd command:

  • RSYSLOG_DEBUG - CSV-options are debug, debugondemand, lologtimestamp, nostdout, outputtidtostderr. Use RSYSLOG_DEBUG=help for more options.
  • RSYSLOG_MODDIR - full directory path to modules used (defaults to /usr/lib/<GNU-trigraph>/rsyslog)
  • RSYSLOG_DEBUGLOG - full file specification to debug log file (no default)
  • RSYSLOG_DEBUG_TIMEOUTS_TO_STDERR - Timeout interval for debug output (in seconds).
  • RSYSLOG_DFLT_LOG_INTERNAL - Used by testbench and certain startup sequences. `1` is equivalent to $processInternalMessage=on
  • LISTEN_PID - full file specification to the process ID (PID) file


/etc/rsyslog.conf may contain environment parameter keyword(s) that creates an additional environment variable.

Modules may also use other environment variables to modify its processing characteristics. See source code of specific modules for any getenv() system calls.

Files

Files that are read by rsyslogd command:

  • /etc/rsyslog.conf - rsyslogd configuration file
  • /usr/lib/x86_64-linux-gnu/rsyslog/ - module library for rsyslogd
  • /proc/self/ns/net
  • /var/run/netns/%s
  • /dev/urandom - kernel random number source device


Files that are written by rsyslogd command:

  • (various log files)
  • /dev/console
  • /run/rsyslog.pid%s


Configuration File

There are three formats of /etc/rsyslog.conf: advanced, basic, legacy(obsoleted).

Format type Versions used Description
advanced 7.0 to 8.2338+
basic 5.0 to 6.9999
legacy(obsoleted) before 4.999

This wiki page only covers both basic and advanced.

Basic rsyslog configuration:

FILE /etc/rsyslog.conf
$IncludeConfig /etc/rsyslog.d/
$FileCreateMode 0640

*.info;mail.none;authpriv.none;cron.none                -/var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  -/var/log/cron
*.emerg                                                 .*

Typically messages are logged to files, the file has to be specified with full pathname. Rsyslog uses a simple syntax to filter incoming messages. Syslog messages are classified by facility and severity. According to RFC5424 following severity groups have been defined:

Severity

Numerical Code Severity Description
0 emerg system is unusable
1 alert action must be taken immediately
2 crit critical conditions
3 error error conditions
4 warning warning conditions
5 notice normal but significant condition
6 info informational messages
7 debug debug-level messages

Facility

List of facilities used by rsyslog. Most facilities names are self explanatory. Facilities local0 - local7 common usage is f.e. as network logs facilities for nodes and network equipment. Generally it depends on the situation how to classify logs and put them to facilities. See facilities more as a tool rather than a directive to follow.

Facilities can be adjusted to meet the needs of the user:

Facility
Numerical Code Facility Description
0 kern kernel messages
1 user user-level messages
2 mail mail system
3 daemon system daemons
4 auth security/authorization messages
5 syslog messages generated internally by syslogd
6 lpr line printer subsystem
7 news network news subsystem
8 uucp UUCP subsystem
9 cron clock daemon
10 security security/authorization messages
11 ftp FTP daemon
12 ntp NTP subsystem
13 logaudit log audit
14 logalert log alert
15 clock clock daemon (note 2)
16 local0 local use 0 (local0)
17 local1 local use 1 (local1)
18 local2 local use 2 (local2)
19 local3 local use 3 (local3)
20 local4 local use 4 (local4)
21 local5 local use 5 (local5)
22 local6 local use 6 (local6)
23 local7 local use 7 (local7)

Filtering

List of filtering examples:

  • Redirect all incoming messages from all facilities and with all severeties to /var/log/syslog
 *.* -/var/log/syslog
  • Filter out messages with severity critical and save to file /var/log/critical
 *.crit -/var/log/critical
  • Do NOT redirect facilities mail, authentication and cron and mail to /var/log/messages, look for the keyword none
 mail.none;authpriv.none;cron.none -/var/log/messages

Local logging

Enable local logging from all facilities, to see local events at all. 

 $ModLoad imuxsock.so

Remote logging

To use remote logging to a syslog server, specify a client to log to a specific server or servers. And a server to receive messages sent by clients. Before configuring choose the protocol. Syslog messages can be sent using UDP or TCP. UDP is the default protocol and supported on most platforms. Not all platforms support TCP for syslog.

Client

To enable syslog UDP messages sending add following line to the /etc/rsyslog.conf file. In this example rsyslog sends all facilities and all priorities *.* using protocol UDP @ to remote server 192.0.2.1 

 *.*       @192.0.2.1

To enable TCP support for syslog messages, put following line to the rsyslog configuraton file, TCP is enabled by adding @@. 

 *.*       @@192.0.2.1

If desired, hostnames can be substituted in for IP addresses.

Important
Substitute 192.0.2.1 with the IP address of the rsyslog server.

Below a example syslog client configuration to send syslog messages to a remote server via TCP.

FILE /etc/rsyslog.conf
$ModLoad imuxsock.so
*.*   @@192.0.2.1:10514

*.info;mail.none;authpriv.none;cron.none      /var/log/messages
authpriv.*                                    /var/log/secure
mail.*                                        /var/log/maillog
cron.*                                        /var/log/cron
*.emerg                                       *
uucp,news.crit                                /var/log/spooler
local7.*                                      /var/log/boot.log

Server

To Provide UDP log reception and run the server on port 514. Running syslog with UDP is the default configuration. 

 $ModLoad imudp
 $UDPServerRun 514

UDP is not a reliable protocol. For more reliability run the server with TCP logging support. 

 $ModLoad imtcp
 $InputTCPServerRun 10514

To bind the UDP Port to an IP interface configure following entry, ensure the right sequence of definitions if binding to an interface: 

 $ModLoad imudp
 $UDPServerAddress 192.0.2.1 # this entry MUST be before the $UDPServerRun directive
 $UDPServerRun 514

A simple configuration would look like this one:

FILE /etc/rsyslog.conf
$ModLoad imuxsock.so
$ModLoad imtcp.so
$InputTCPServerAddress 192.0.2.1
$InputTCPServerRun 10514
$ModLoad imudp.so
$UDPServerAddress 192.0.2.1
$UDPServerRun 514
*.info;mail.none;authpriv.none;cron.none      /var/log/messages
authpriv.*                                    /var/log/secure
mail.*                                        /var/log/maillog
cron.*                                        /var/log/cron
*.emerg                                       *
uucp,news.crit                                /var/log/spooler
local7.*                                      /var/log/boot.log

Database logging

Rsyslog supports logging to following databases:

After choosing the database logs will be stored to a proper USE flag needs to be enabled and rsyslog has to be rebuild before continuing. This example uses a MySQL database.

Note
Next steps assume a working MySQL database server running on localhost, for installation details follow the MySQL article.

The package ships a SQL script named createDB.sql to create the database layout.

FILE /usr/share/rsyslog/scripts/mysql/createDB.sql
CREATE DATABASE Syslog;
USE Syslog;
CREATE TABLE SystemEvents
(
        ID int unsigned not null auto_increment primary key,
        CustomerID bigint,
        ReceivedAt datetime NULL,
        DeviceReportedTime datetime NULL,
        Facility smallint NULL,
        Priority smallint NULL,
        FromHost varchar(60) NULL,
        Message text,
        NTSeverity int NULL,
        Importance int NULL,
        EventSource varchar(60),
        EventUser varchar(60) NULL,
        EventCategory int NULL,
        EventID int NULL,
        EventBinaryData text NULL,
        MaxAvailable int NULL,
        CurrUsage int NULL,
        MinUsage int NULL,
        MaxUsage int NULL,
        InfoUnitID int NULL ,
        SysLogTag varchar(60),
        EventLogType varchar(60),
        GenericFileName VarChar(60),
        SystemID int NULL
);
CREATE TABLE SystemEventsProperties
(
        ID int unsigned not null auto_increment primary key,
        SystemEventID int NULL ,
        ParamName varchar(255) NULL ,
        ParamValue text NULL
);

Import the /usr/share/rsyslog/scripts/mysql/createDB.sql file to create the Syslog database.

user $mysql -u root -p < /usr/share/rsyslog/scripts/mysql/createDB.sql

Create a datebase user for the Syslog database:

mysql>GRANT ALL ON Syslog.* TO rsyslog-user@localhost IDENTIFIED BY - 'MySecretPassword';
mysql>FLUSH PRIVILEGES;

To provide SQL database logging support, enable the needed module in /etc/rsyslog.conf 

 $ModLoad ommysql.so

Tell rsyslog to forward all data to the database, add following to the end of the /etc/rsyslog.conf file: 

 *.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword

Finally Restart the rsyslog server to adapt new settings

root #/etc/init.d/rsyslog restart

Services

Warning
There is considerably conflict between systemd and rsyslogd: try not to mix them both, or worse configure both to report to each other (100% CPU). For maximum flexibility and secureness, use rsyslogd.

OpenRC

To add the rsyslogd daemon to the default runlevel, so that logging starts with the system:

root #rc-update add rsyslog default

After the emerge has finished, rsyslog should work out of the box with the default configuration; at least for local logging.

To start the rsyslogd daemon:

root #rc-service rsyslog start

Check file /var/log/messages for syslog entries:

root #tail -f /var/log/messages
2024-01-30T23:24:27.462647+01:00 server rsyslogd: [origin software="rsyslogd" swVersion="8.2212.0" x-pid="2404" x-info="https://www.rsyslog.com"] start

Templates

Many vendors format their syslog messages differently. If the network equipment logs to a central rsyslog server the difference in logging will be easy to notice. After some time of log dumping it will be difficult to filter the syslog server messages for a certain

  • Date
  • Facility
  • Severity
  • Host
  • Syslogtag
  • ProcessID
  • MessageType
  • Message

To unify syslog messages to a certain or preferred format, Rsyslog uses templates which parse arriving messages and "rewrites" them to the desired format.

To maintain a simple and modular configuration, templates are stored within the /etc/rsyslog.d/ directory. To include files stored within the rsyslog.d directory add following line to /etc/rsyslog.conf file: 

 $IncludeConfig /etc/rsyslog.d/*.conf

Templates should be stored to the /etc/rsyslog.d/ directory.

root #cd /etc/rsyslog.d/
Important
Following templates are working very good, but are not perfect.

Here a simple template for a cisco IOS host which logs to rsyslogd:

FILE /etc/rsyslog.d/template_cisco.conf
$template mysql_cisco, "insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg:R,ERE,1,DFLT:%[A-Z0-9_-]+: (.*)--end%', %syslogfacility%, '%fromhost%', %syslog
priority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%msg:R,ERE,0,DFLT:%[A-Z0-9_-]+:--end%')",SQL

Here a simple template for a ScreenOS host which logs to rsyslogd:

FILE /etc/rsyslog.d/template_netscreen.conf
$template mysql_netscreen, "insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg:R,ERE,1,DFLT:[a-zA-Z0-9-]+: (.*)--end%', %syslogfacility%, '%fromhost%', %s
yslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%msg:R,ERE,0,DFLT:[a-zA-Z0-9-]+:--end%')",SQL

Here a simple template for Linux host which logs to rsyslogd:

FILE /etc/rsyslog.d/template_linux.conf
$template mysql_linux, "insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, IntoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::
date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag:R,ERE,1,FIELD:(.+)(\[[0-9]{1,5}\]).*--end%')" ,SQL

Configure rsyslogd which predefined template to apply to which facility, add following template references to the end of the /etc/rsyslog.conf file:

  • All messages arriving at facility local4, are Cisco IOS messages:
 local4.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_cisco
  • All messages arriving at facility local5 , are ScreenOS messages:
 local5.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_netscreen
  • All messages arriving at syslog consider as Linux messages, and ignore local4 and local5 facilities which have their own templates.
 *.*;local4.none;local5.none :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_linux

The following is an example of how the /etc/rsyslog.conf file could look on a syslog server with working templates:

FILE /etc/rsyslog.conf
$ModLoad imudp
$UDPServerRun 514
$ModLoad ommysql.so
$IncludeConfig /etc/rsyslog.d/*.conf

*.info;mail.none;authpriv.none;cron.none	-/var/log/messages
authpriv.*					/var/log/secure
mail.*						-/var/log/maillog
cron.*						-/var/log/cron
*.emerg						*
uucp,news.crit					-/var/log/spooler
local7.*					/var/log/boot.log

local4.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_cisco
local5.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_netscreen
*.*;local4.none;local5.none :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_linux

Reload rsyslog server to apply new changes:

root #/etc/init.d/rsyslog reload

Further examples can be found here.

Usage

There is only one executable, a daemon called rsyslogd.

Invocation

Command line options are NOT embedded into the rsyslogd. For that, execute man page:

user $man rsyslogd
RSYSLOGD(8)                                      Linux System Administration                                      RSYSLOGD(8)

NAME
       rsyslogd - reliable and extended syslogd

SYNOPSIS
       rsyslogd [ -d ] [ -D ] [ -f config file ] [ -i pid file ] [ -n ] [ -N level ] [ -o fullconf ] [ -C ] [ -v ]

DESCRIPTION
       Rsyslogd  is a system utility providing support for message logging.  Support of both internet and unix domain sockets
       enables this utility to support both local and remote logging.

       Note that this version of rsyslog ships with extensive documentation in HTML format.  This is provided  in  the  ./doc
       subdirectory and probably in a separate package if you installed rsyslog via a packaging system.  To use rsyslog's ad‐
       vanced features, you need to look at the HTML documentation, because the man pages only covers basic aspects of opera‐
       tion.   For  details  and  configuration  examples,  see the rsyslog.conf (5) man page and the online documentation at
       https://www.rsyslog.com/doc/

       Rsyslogd(8) is derived from the sysklogd package which in turn is derived from the stock BSD sources.

       Rsyslogd provides a kind of logging that many modern programs use.  Every logged message contains at least a time  and
       a hostname field, normally a program name field, too, but that depends on how trusty the logging program is. The rsys‐
       log package supports free definition of output formats via templates. It also supports precise timestamps and  writing
       directly to databases. If the database option is used, tools like phpLogCon can be used to view the log data.

       While  the  rsyslogd sources have been heavily modified a couple of notes are in order.  First of all there has been a
       systematic attempt to ensure that rsyslogd follows its default, standard BSD behavior. Of course,  some  configuration
       file changes are necessary in order to support the template system. However, rsyslogd should be able to use a standard
       syslog.conf and act like the original syslogd. However, an original syslogd will not work correctly with a rsyslog-en‐
       hanced  configuration  file. At best, it will generate funny looking file names.  The second important concept to note
       is that this version of rsyslogd interacts transparently with the version of syslog found in the  standard  libraries.
       If a binary linked to the standard shared libraries fails to function correctly we would like an example of the anoma‐
       lous behavior.

       The main configuration file /etc/rsyslog.conf or an alternative file, given with the -f option, is  read  at  startup.
       Any  lines  that  begin with the hash mark (``#'') and empty lines are ignored.  If an error occurs during parsing the
       error element is ignored. It is tried to parse the rest of the line.

OPTIONS
       -D     Runs the Bison config parser in debug mode. This may help when hard to find syntax errors are reported.  Please
              note that the output generated is deeply technical and orignally targeted towards developers.

       -d     Turns on debug mode. See the DEBUGGING section for more information.

       -f config file
              Specify an alternative configuration file instead of /etc/rsyslog.conf, which is the default.

       -i pid file
              Specify  an alternative pid file instead of the default one.  This option must be used if multiple instances of
              rsyslogd should run on a single machine. To disable writing a pid file, use the reserved name "NONE" (all upper
              case!), so "-iNONE".

       -n     Avoid auto-backgrounding.  This is needed especially if the rsyslogd is started and controlled by init(8).

       -N  level
              Do a config check. Do NOT run in regular mode, just check configuration file correctness.  This option is meant
              to verify a config file. To do so, run rsyslogd interactively in foreground, specifying -f <config-file> and -N
              level.   The level argument modifies behaviour. Currently, 0 is the same as not specifying the -N option at all
              (so this makes limited sense) and 1 actually activates the code. Later, higher levels will mean more  verbosity
              (this is a forward-compatibility option).

       -o  fullconf
              Generates  a  consolidated  config file fullconf that contains all of rsyslog's configuration in a single file.
              Include files are exploded into that file in exactly the way rsyslog sees them.   This  option  is  useful  for
              troubleshooting,  especially  if problems with the order of action processing is suspected. It may also be used
              to check for "unexepectedly" included config content.

       -C     This prevents rsyslogd from changing to the root directory. This is almost never a good idea in production use.
              This option was introduced in support of the internal testbed.

       -v     Print version and exit.

SIGNALS
       Rsyslogd reacts to a set of signals.  You may easily send a signal to rsyslogd using the following:

              kill -SIGNAL $(cat /var/run/rsyslogd.pid)

       Note that -SIGNAL must be replaced with the actual signal you are trying to send, e.g. with HUP. So it then becomes:

              kill -HUP $(cat /var/run/rsyslogd.pid)

       HUP    This lets rsyslogd perform close all open files.

       TERM ,  INT ,  QUIT
              Rsyslogd will die.

       USR1   Switch debugging on/off.  This option can only be used if rsyslogd is started with the -d debug option.

       CHLD   Wait for children if some were born, because of wall'ing messages.

SECURITY THREATS
       There  is  the potential for the rsyslogd daemon to be used as a conduit for a denial of service attack.  A rogue pro‐
       gram(mer) could very easily flood the rsyslogd daemon with syslog messages resulting in the log  files  consuming  all
       the remaining space on the filesystem.  Activating logging over the inet domain sockets will of course expose a system
       to risks outside of programs or individuals on the local machine.

       There are a number of methods of protecting a machine:

       1.     Implement kernel firewalling to limit which hosts or networks have access to the 514/UDP socket.

       2.     Logging can be directed to an isolated or non-root filesystem which, if filled, will not impair the machine.

       3.     The ext2 filesystem can be used which can be configured to limit a certain percentage of a filesystem to  usage
              by  root only.  NOTE that this will require rsyslogd to be run as a non-root process.  ALSO NOTE that this will
              prevent usage of remote logging on the default port since rsyslogd will  be  unable  to  bind  to  the  514/UDP
              socket.

       4.     Disabling inet domain sockets will limit risk to the local machine.

   Message replay and spoofing
       If  remote logging is enabled, messages can easily be spoofed and replayed.  As the messages are transmitted in clear-
       text, an attacker might use the information obtained from the packets for malicious things. Also,  an  attacker  might
       replay  recorded  messages  or spoof a sender's IP address, which could lead to a wrong perception of system activity.
       These can be prevented by using GSS-API authentication and encryption. Be sure to think about syslog network  security
       before enabling it.

DEBUGGING
       When  debugging is turned on using the -d option, rsyslogd produces debugging information according to the RSYSLOG_DE‐
       BUG environment variable and the signals received. When run in foreground, the information is written  to  stdout.  An
       additional output file can be specified using the RSYSLOG_DEBUGLOG environment variable.

FILES
       /etc/rsyslog.conf
              Configuration file for rsyslogd.  See rsyslog.conf(5) for exact information.
       /dev/log
              The Unix domain socket to from where local syslog messages are read.
       /var/run/rsyslogd.pid
              The file containing the process id of rsyslogd.
       prefix/lib/rsyslog
              Default directory for rsyslogd modules. The prefix is specified during compilation (e.g. /usr/local).
ENVIRONMENT
       RSYSLOG_DEBUG
              Controls  runtime debug support. It contains an option string with the following options possible (all are case
              insensitive):

              Debug  Turns on debugging and prevents forking. This is processed earlier in the startup than command line  op‐
                     tions (i.e. -d) and as such enables earlier debugging output. Mutually exclusive with DebugOnDemand.
              DebugOnDemand
                     Enables debugging but turns off debug output. The output can be toggled by sending SIGUSR1. Mutually ex‐
                     clusive with Debug.
              LogFuncFlow
                     Print out the logical flow of functions (entering and exiting them)
              FileTrace
                     Specifies which files to trace LogFuncFlow. If not set (the default), a LogFuncFlow  trace  is  provided
                     for  all  files.  Set  to limit it to the files specified.FileTrace may be specified multiple times, one
                     file each (e.g. export RSYSLOG_DEBUG="LogFuncFlow FileTrace=vm.c FileTrace=expr.c"
              PrintFuncDB
                     Print the content of the debug function database whenever  debug  information  is  printed  (e.g.  abort
                     case)!
              PrintAllDebugInfoOnExit
                     Print all debug information immediately before rsyslogd exits (currently not implemented!)
              PrintMutexAction
                     Print mutex action as it happens. Useful for finding deadlocks and such.
              NoLogTimeStamp
                     Do not prefix log lines with a timestamp (default is to do that).
              NoStdOut
                     Do  not  emit  debug  messages to stdout. If RSYSLOG_DEBUGLOG is not set, this means no messages will be
                     displayed at all.
              Help   Display a very short list of commands - hopefully a life saver if you can't access the documentation...

       RSYSLOG_DEBUGLOG
              If set, writes (almost) all debug message to the specified log file in addition to stdout.
       RSYSLOG_MODDIR
              Provides the default directory in which loadable modules reside.

BUGS
       Please review the file BUGS for up-to-date information on known bugs and annoyances.

Further Information
       Please visit https://www.rsyslog.com/doc/ for additional information, tutorials and a support forum.

SEE ALSO
       rsyslog.conf(5), logger(1), syslog(2), syslog(3), services(5), savelog(8)

COLLABORATORS
       rsyslogd is derived from sysklogd sources, which in turn was taken from  the  BSD  sources.  Special  thanks  to  Greg
       Wettstein (greg@wind.enjellic.com) and Martin Schulze (joey@linux.de) for the fine sysklogd package.

       Rainer Gerhards
       Adiscon GmbH
       Grossrinderfeld, Germany
       rgerhards@adiscon.com

Version 8.1905.0                                         28 May 2014                                              RSYSLOGD(8)

Validate Configuration Files

To syntax check the default configuration files (/etc/rsyslog.conf) for rsyslogd, validate the config file by executing:

root #rsyslogd -N1
rsyslogd: version 8.2302.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.

To validate configuration files in non-root testing environment, execute:

user $/usr/sbin/rsyslogd -N1 -f /usr/share/doc/rsyslog/examples/rsyslog.d/console.conf
rsyslogd: version 8.2302.0, config validation run (level 1), master config /usr/share/doc/rsyslog/examples/rsyslog.d/console.conf
rsyslogd: End of config validation run. Bye.

Removal

Removal of rsyslog package (toolkit & library) can be done by executing:

root #emerge --ask --depclean --verbose app-admin/rsyslog

Troubleshooting

Check if a syslog process is running :

root #ps ux | grep rsyslog
root     9161  0.0  0.0 1323652  3424 ?        Sl   00:51   0:00 /usr/sbin/rsyslogd -c5 -i /var/run/rsyslogd.pid -f /etc/rsyslog.conf

Verify network configuration:

root #ss -tulpn | grep rsyslog
udp   UNCONN 0      0            0.0.0.0:514       0.0.0.0:*    users:(("rsyslogd",pid=1710,fd=6))
udp   UNCONN 0      0            0.0.0.0:514       0.0.0.0:*    users:(("rsyslogd",pid=1710,fd=4))
udp   UNCONN 0      0               [::]:514          [::]:*    users:(("rsyslogd",pid=1710,fd=7))
udp   UNCONN 0      0               [::]:514          [::]:*    users:(("rsyslogd",pid=1710,fd=5))

Verify with the command logger, if messages are arriving in at the syslogserver:

user $logger -t test my syslog-test-message

Following message should appear in the /var/log/messages file if rsyslog is working properly:

root #tail /var/log/messages
...
2011-11-23T00:47:05+01:00 Rsyslogserver test: my syslog-test-message

See also

  • Metalog — an alternative syslog daemon.
  • Sysklogd — utility that reads and logs messages to the system console, logs files, other machines and/or users as specified by its configuration file.
  • Syslog-ng — a powerful, highly configurable monitoring and logging daemon.

External resources

Retrieved from "https://wiki.gentoo.org/index.php?title=Rsyslog&oldid=1301210"