Rsyslog

Resources

Home

Wikipedia

Official documentation

GitHub

#rsyslog

Open Hub

From Wikipedia, the free encyclopedia:

Rsyslog is Article description::an open source software used on UNIX and Unix-like computer systems for forwarding log messages in an IP network. It implements the basic syslog protocol, extends it with content-based filtering, rich filtering capabilities, flexible configuration options and adds important features such as using TCP for transport.

Installation

Configuration

2011-07-24T00:31:06.268926+02:00 server kernel: imklog 5.8.1, log source = /proc/kmsg started.
2011-07-24T00:31:06.269053+02:00 server rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="19116" x-info="http://www.rsyslog.com"] start

# Support for Local System Logging
$ModLoad imuxsock.so
$IncludeConfig /etc/rsyslog.d/*
*.info;mail.none;authpriv.none;cron.none                -/var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  -/var/log/cron
*.emerg                                                 *
uucp,news.crit                                          -/var/log/spooler
local7.*                                                /var/log/boot.log

 *.* -/var/log/syslog

 *.crit -/var/log/critical

 mail.none;authpriv.none;cron.none -/var/log/messages

 $ModLoad imuxsock.so

 *.*       @192.0.2.1

 *.*       @@192.0.2.1

$ModLoad imuxsock.so
*.*   @@192.0.2.1:10514

*.info;mail.none;authpriv.none;cron.none      /var/log/messages
authpriv.*                                    /var/log/secure
mail.*                                        /var/log/maillog
cron.*                                        /var/log/cron
*.emerg                                       *
uucp,news.crit                                /var/log/spooler
local7.*                                      /var/log/boot.log

 $ModLoad imudp
 $UDPServerRun 514

 $ModLoad imtcp
 $InputTCPServerRun 10514

 $ModLoad imudp
 $UDPServerAddress 192.0.2.1 # this entry MUST be before the $UDPServerRun directive
 $UDPServerRun 514

$ModLoad imuxsock.so
$ModLoad imtcp.so
$InputTCPServerAddress 192.0.2.1
$InputTCPServerRun 10514
$ModLoad imudp.so
$UDPServerAddress 192.0.2.1
$UDPServerRun 514
*.info;mail.none;authpriv.none;cron.none      /var/log/messages
authpriv.*                                    /var/log/secure
mail.*                                        /var/log/maillog
cron.*                                        /var/log/cron
*.emerg                                       *
uucp,news.crit                                /var/log/spooler
local7.*                                      /var/log/boot.log

<syntaxhighlight lang="mysql">CREATE DATABASE Syslog;
USE Syslog;
CREATE TABLE SystemEvents
(
        ID int unsigned not null auto_increment primary key,
        CustomerID bigint,
        ReceivedAt datetime NULL,
        DeviceReportedTime datetime NULL,
        Facility smallint NULL,
        Priority smallint NULL,
        FromHost varchar(60) NULL,
        Message text,
        NTSeverity int NULL,
        Importance int NULL,
        EventSource varchar(60),
        EventUser varchar(60) NULL,
        EventCategory int NULL,
        EventID int NULL,
        EventBinaryData text NULL,
        MaxAvailable int NULL,
        CurrUsage int NULL,
        MinUsage int NULL,
        MaxUsage int NULL,
        InfoUnitID int NULL ,
        SysLogTag varchar(60),
        EventLogType varchar(60),
        GenericFileName VarChar(60),
        SystemID int NULL
);
CREATE TABLE SystemEventsProperties
(
        ID int unsigned not null auto_increment primary key,
        SystemEventID int NULL ,
        ParamName varchar(255) NULL ,
        ParamValue text NULL
);</syntaxhighlight>

 $ModLoad ommysql.so

 *.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword

Templates

Many vendors format their syslog messages differently. If the network equipment logs to a central rsyslog server the difference in logging will be easy to notice. After some time of log dumping it will be difficult to filter the syslog server messages for a certain

• Date
• Facility
• Severity
• Host
• Syslogtag
• ProcessID
• MessageType
• Message

To unify syslog messages to a certain or preferred format, Rsyslog uses templates which parse arriving messages and "rewrites" them to the desired format.

To maintain a simple and modular configuration, templates are stored within the /etc/rsyslog.d/ directory. To include files stored within the rsyslog.d directory add following line to /etc/rsyslog.conf file:

 $IncludeConfig /etc/rsyslog.d/*.conf

Templates should be stored to the /etc/rsyslog.d/ directory.

Here a simple template for a cisco IOS host which logs to rsyslogd:

$template mysql_cisco, "insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg:R,ERE,1,DFLT:%[A-Z0-9_-]+: (.*)--end%', %syslogfacility%, '%fromhost%', %syslog
priority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%msg:R,ERE,0,DFLT:%[A-Z0-9_-]+:--end%')",SQL

Here a simple template for a ScreenOS host which logs to rsyslogd:

$template mysql_netscreen, "insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg:R,ERE,1,DFLT:[a-zA-Z0-9-]+: (.*)--end%', %syslogfacility%, '%fromhost%', %s
yslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%msg:R,ERE,0,DFLT:[a-zA-Z0-9-]+:--end%')",SQL

Here a simple template for Linux host which logs to rsyslogd:

$template mysql_linux, "insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, IntoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::
date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag:R,ERE,1,FIELD:(.+)(\[[0-9]{1,5}\]).*--end%')" ,SQL

Configure rsyslogd which predefined template to apply to which facility, add following template references to the end of the /etc/rsyslog.conf file:

• All messages arriving at facility local4, are Cisco IOS messages:

 local4.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_cisco

• All messages arriving at facility local5 , are ScreenOS messages:

 local5.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_netscreen

• All messages arriving at syslog consider as Linux messages, and ignore local4 and local5 facilities which have their own templates.

 *.*;local4.none;local5.none :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_linux

The following is an example of how the /etc/rsyslog.conf file could look on a syslog server with working templates:

$ModLoad imudp
$UDPServerRun 514
$ModLoad ommysql.so
$IncludeConfig /etc/rsyslog.d/*.conf

*.info;mail.none;authpriv.none;cron.none	-/var/log/messages
authpriv.*					/var/log/secure
mail.*						-/var/log/maillog
cron.*						-/var/log/cron
*.emerg						*
uucp,news.crit					-/var/log/spooler
local7.*					/var/log/boot.log

local4.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_cisco
local5.* :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_netscreen
*.*;local4.none;local5.none :ommysql:localhost,Syslog,rsyslog-user,MySecretPassword;mysql_linux

Reload rsyslog server to apply new changes:

Further examples can be found here.

Troubleshooting

Check if a syslog process is running :

root     9161  0.0  0.0 1323652  3424 ?        Sl   00:51   0:00 /usr/sbin/rsyslogd -c5 -i /var/run/rsyslogd.pid -f /etc/rsyslog.conf

Verify network configuration:

udp        0      0 192.0.2.1:514             0.0.0.0:*                           0          33472286   9161/rsyslogd
udp6       0      0 :::514                    :::*                                0          33472287   9161/rsyslogd

Verify with the command logger, if messages are arriving in at the syslogserver:

Following message should appear in the /var/log/messages file if rsyslog is working properly:

...
2011-11-23T00:47:05+01:00 Rsyslogserver test: my syslog-test-message

See also

• Syslog-ng — a powerful, highly configurable monitoring and logging daemon.

External resources

• Official documentation
• Rsyslog Templates HOWTO
• RFC 5424 - The Syslog Protocol