Linux Rsyslog

Rsyslog monitoring all logs, which are available in Linux systems.

After change of configuration files is recommended to make validity check by command rsyslogd -N1.

1. Create the configuration file /etc/rsyslog.d/lm_all.conf

2. Insert the following code into it:

   $ModLoad imuxsock # local message reception
   $ActionQueueType LinkedList # use asynchronous processing
   # set file name, also enables disk mode,
   # this value must be unique inside all configs
   $ActionQueueFileName srvrfwd
   $ActionResumeRetryCount -1 # infinite retries on insert failure
   $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
   # max limit the number of messages that queue can contain
   $ActionQueueSize 10000
   $ActionQueueMaxFileSize 10M # limit the size of queue buffer on disk
   
   *.* @@<Logmanager_IP_address>:514
   

   Logmanager_IP_address is IP address of your Logmanager server.

3. Activate the configuration with command:

   service rsyslog restart
   

Rsyslog provides the ability to send any log files into Logmanager.

The following sample monitors one log file.

1. Create the configuration file /etc/rsyslog.d/file1.conf

2. Insert the following code into it:

   $ActionQueueType LinkedList # use asynchronous processing
   # set file name, also enables disk mode,
   # this value must be unique inside all configs
   $ActionQueueFileName srvrfwd
   $ActionResumeRetryCount -1 # infinite retries on insert failure
   $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
   # max limit the number of messages that queue can contain
   $ActionQueueSize 10000
   $ActionQueueMaxFileSize 10M # limit the size of queue buffer on disk
   $ModLoad imfile # needs to be done just once
   
   # File 1
   $InputFileName /var/log/file1 # path to log file
   $InputFileTag tag1: # identification of process
   $InputFileStateFile stat-file1
   
   $InputFileSeverity error # severity level
   $InputFileFacility local7 # facility level
   $InputRunFileMonitor
   
   if $programname == 'tag1' then @@<Logmanager_IP_address>:514
   

   Logmanager_IP_address is IP address of your Logmanager server.

3. Activate the configuration with command:

   service rsyslog restart
   

The following sample monitors two log files.

1. Create the configuration file /etc/rsyslog.d/files.conf

2. Insert the following code into it:

   $ActionQueueType LinkedList # use asynchronous processing
   # set file name, also enables disk mode,
   # this value must be unique inside all configs
   $ActionQueueFileName srvrfwd
   $ActionResumeRetryCount -1 # infinite retries on insert failure
   $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
   # max limit the number of messages that queue can contain
   $ActionQueueSize 10000
   $ActionQueueMaxFileSize 10M # limit the size of queue buffer on disk
   $ModLoad imfile # needs to be done just once
   
   # File 1
   $InputFileName /var/log/file1 # path to log file 1
   $InputFileTag tag1: # identification of process
   $InputFileStateFile stat-file1
   
   $InputFileSeverity error # severity level
   $InputFileFacility local7 # facility level
   $InputRunFileMonitor
   
   if $programname == 'tag1' then @@<Logmanager_IP_address>:514
   
   
   # File 2
   $InputFileName /path/to/file2 # path to log file 2
   $InputFileTag tag2: # identification of process
   $InputFileStateFile stat-file2
   
   $InputRunFileMonitor
   
   # Only entered once in case of following multiple files
   # This will poll the file every 10 seconds
   $InputFilePollingInterval 10
   
   if $programname == 'tag2' then @@<Logmanager_IP_address>:514
   

   Logmanager_IP_address is IP address of your Logmanager server.

3. Activate the configuration with command:

   service rsyslog restart
   

1. Create the configuration file /etc/rsyslog.d/lm_<program_name>.conf

2. Insert the following code into it:

   $ModLoad imuxsock # local message reception
   $ActionQueueType LinkedList # use asynchronous processing
   # set file name, also enables disk mode,
   # this value must be unique inside all configs
   $ActionQueueFileName srvrfwd
   $ActionResumeRetryCount -1 # infinite retries on insert failure
   $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
   # max limit the number of messages that queue can contain
   $ActionQueueSize 10000
   $ActionQueueMaxFileSize 10M # limit the size of queue buffer on disk
   
   if $programname == '<program_name>' then @@<Logmanager_IP_address>:514
   

   Logmanager_IP_address is IP address of your Logmanager server.

   program_name is name of service, for example sshd (SSH daemon).

3. Activate the configuration with command:

   service rsyslog restart
   

1. Create the configuration file /etc/rsyslog.d/lm_<facility>.conf

2. Insert the following code into it:

   $ModLoad imuxsock # local message reception
   $ActionQueueType LinkedList # use asynchronous processing
   # set file name, also enables disk mode,
   # this value must be unique inside all configs
   $ActionQueueFileName srvrfwd
   $ActionResumeRetryCount -1 # infinite retries on insert failure
   $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
   # max limit the number of messages that queue can contain
   $ActionQueueSize 10000
   $ActionQueueMaxFileSize 10M # limit the size of queue buffer on disk
   
   # monitor only severity info:
   *.=info     @@<Logmanager_IP_address>:514
   
   # or monitor severity info and higher
   *.info     @@<Logmanager_IP_address>:514
   
   # or monitor specific severity and facility
   mail.=info     @@<Logmanager_IP_address>:514
   

   Logmanager_IP_address is IP address of your Logmanager server.

   replace the facility with your preferred facility or severity, for example - “info” for monitoring messages with the informative character.

3. Activate the configuration with command:

   service rsyslog restart
   

RELP (Reliable Event Logging Protocol) extends the functionality of the syslog protocol to provide reliable delivery of event messages. It is highly suggested to use RELP instead of plain syslog format.

It is necessary to have a package rsyslog-relp installed for RELP support in Rsyslog.

Please also note that Rsyslog may lose a few messages if Rsyslog is shutdown while a network connection to the server is broken and could not yet be recovered.

All above stated command remain valid. Just follow these steps:

1. Add this row to the configuration files:

   $ModLoad omrelp
   

2. Replace this term in configuration:

   @@<Logmanager_IP_address>:514
   

   By a new term:

   :omrelp:<Logmanager_IP_address>:20514
   

   Logmanager_IP_address is IP address of your Logmanager server.

3. Activate the configuration with command:

   service rsyslog restart
   

$ModLoad omrelp # use RELP
$ModLoad imuxsock # local message reception
$ActionQueueType LinkedList # use asynchronous processing

# set file name, also enables disk mode,

# this value must be unique inside all configs

$ActionQueueFileName srvrfwd
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down

# max limit the number of messages that queue can contain

$ActionQueueSize 10000
$ActionQueueMaxFileSize 10M # limit the size of queue buffer on disk

*.* :omrelp:<Logmanager_IP_address>:20514

Logmanager_IP_address is IP address of your Logmanager server.

We will show you, how to use simple TLS encryption with the RELP protocol for sending syslog messages.

The configuration for the client is relatively simple, just follow these steps:

1. Add this row to the configuration files:

   $ModLoad omrelp
   

2. Replace this term in configuration:

   @@<Logmanager_IP_address>:514
   

   By a new term:

   action(type="omrelp" target="<Logmanager_IP_address>" port="20515" tls="on")
   

   Logmanager_IP_address is IP address of your Logmanager server.

3. Activate the configuration with command:

   service rsyslog restart
   

1. First you need to install the package rsyslog-gnutls, enter the command:

   Debian – sudo apt-get install rsyslog-gnutls
   CentOS – sudo yum install rsyslog-gnutls
   

2. Copy the public CA certificate to the server (in format .crt) and save it to for example /etc/ssl/certs/ca-certifikat.crt

3. Create a file /etc/rsyslog.d/lm-forward_tls.conf

4. Paste the following code into it:

   $DefaultNetstreamDriverCAFile /etc/ssl/certs/ca-certifikát.crt
   action(type="omfwd"
      protocol="tcp"
      target="<Logmanager_IP_address>"
      port="6514
      StreamDriver="gtls"
      StreamDriverMode="1"
      StreamDriverAuthMode="x509/name"
      StreamDriverPermittedPeers="<hostname/IP address in CN of certificate>"
   )
   

5. To activate the settings, restart the Rsyslog service by using the command:

   sudo service rsyslog restart