Goodies | Rsyslog

Rsyslog Troubleshooting Guide

Initiating Debug Mode To kick off debug logging from the get-go, prepend your rsyslog.conf file with these lines. This ensures debug logging activates immediately upon the rsyslog service launching: $DebugFile…

pje April 1, 2024

Goodies Goodies | Linux Goodies | Rsyslog

Rsyslog – Forward logs to another server

Create a new config file under the rsyslog config directory sudo vim /etc/rsyslog.d/30-forward-logs.conf Use single @ for udp forwardingUse double @ for tcp forwarding Example of udp forwarding *.* @172.16.204.1:514…

pje August 16, 2023

Goodies Goodies | Linux Goodies | Rsyslog

Rsyslog – Save login to a seperate file

Create a new rsyslog config file sudo vim /etc/rsyslog.d/10-auth.log.conf Add the following text :msg, contains, ":session" /var/log/rsyslog-auth.log :msg, contains, ":auth" /var/log/rsyslog-auth.log :msg, contains, "COMMAND=" /var/log/rsyslog-auth.log :msg, contains, "session opened for…

pje August 16, 2023