Questions Tagged With syslog

How mmpstrucdata and mmrfc5424addhmac works?

LilyChadha — Mon, 11 May 2015 05:59:31 -0400

I am trying to log messages with structured data . But it is showing null value for structured data. I am working with rsyslog 8.9.0.Can someone exlain me how these two modules mmpstrucdata and mmrfc5424addhmac will be effected?

Unable to get structured data in logged messages even after adding mmpstrucdata and mmrfc5424addhmac?(RFC5424)

LilyChadha — Mon, 11 May 2015 05:58:27 -0400

I am trying to log messages with structured data . But it is showing null value for structured data. I am working with rsyslog 8.9.0.Can someone tell me either i need to load some module or modify source to get structure data SD-IDs in logged message.

Template:

"<%PRI%>%TIMESTAMP:::daterfc3339%%HOSTNAME%%syslogtag%%APPNAME%%PROCID% %MSGID% %msg% %STRUCTURED-DATA%n”

getting message format as below: <142> 2015-01-29T06:43:53.081641-05:00 localhost login[2116]: login 2116 - [2116 : 2116 INFO]SERIAL Login from IP:127.0.0.1 user:admin -

configuration file --rsyslog.conf:

$ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging support (previously done by rklogd) $ModLoad mmpstrucdata $ModLoad mmrfc5424addhmac

GLOBAL DIRECTIVES

$ActionFileDefaultTemplate RSYSLOG_DebugFormat . /var/log/debugfmt.log;RSYSLOG_DebugFormat

After loading mmpstrucdata and mmrfc5424addhmac i am getting structured data null.

iptables and sudo not logging

Ron — Thu, 14 Apr 2011 13:53:25 -0400

I have Ubuntu 10.04.2LTS 32-bit Desktop Edition and it's the same on 3 different systems.

iptables and sudo aren't logging and I need them to be.

1) None of them have the auth.log in /etc which is used for logging sudo commands/login authorizations

2) None of them have the syslog.conf file in /etc (but one does exist under /usr/share/logwatch/default.conf/logfiles/syslog.conf)

3) I've looked in the "Log Viewer" in Gnome and in /etc

I need to enable and monitor these loggings somehow.

Logging to filesystem or database

rfelsburg — Tue, 07 Dec 2010 17:37:03 -0500

So I'm looking for best practices on logging. IO, resource consumption, etc.

Which is the better way to go from a performance perspective. Log to database, or filesystem.

Some of the applications can log straight to the database, apache being one. Some would have to be funneled from the syslog aggregation system to the database.

So on the applications that can go directly to the database should I, or should I just keep the standard, and let the aggregate do the work of putting into the database.

Thoughts?

-Rob

Syslog To RHEL From Network Devices

The Doc — Tue, 11 May 2010 01:13:16 -0400

I am building some Red Hat Syslog servers to house the syslog output of network gear. So far I have gotten the devices to send syslog data to the server and the server records it. But, it is all going to the "messages" file. How do I send the specific syslog streams to a file that is specific to the system that sent it.

Thanks...