ja:Rsyslog

rsyslog is a syslog implementation that offers many benefits over syslog-ng. It can be configured to receive log entries from systemd's journal in order to process or filter them before quickly writing them to disk or sending them over network.

Installation

Install the rsyslog package.

Enabling and starting service

After installation, enable rsyslog.service and start it afterwards.

Starting the rsyslog.service unit first would likely fail, because enabling the service creates a symlink for syslog.service which would be missing otherwise; rsyslog.service would raise the error:

rsyslog.service: Job rsyslog.service/start failed with result 'dependency'

Configure hostname

Rsyslog uses the glibc routine gethostname() or gethostbyname() to determine the hostname of the local machine. The gethostname() or gethostbyname() routine check the contents of /etc/hosts for the fully qualified domain name (FQDN) if you are not using BIND or NIS.

You can check what the local machine's currently configured FQDN is by running hostname --fqdn. The output of hostname --short will be used by rsyslog when writing log messages. If you want to have full hostnames in logs, you need to add $PreserveFQDN on to the beginning of the file (before using any directive that write to files). This is because, rsyslog reads its configuration file and applies it on-the-go and then reads the later lines.

The /etc/hosts file contains a number of lines that map FQDNs to IP addresses and that map aliases to FQDNs. See the example /etc/hosts file below:

#<ip-address>    <hostname.domain.org> <hostname>
#<ip-address>    <actual FQDN> <aliases>
127.0.0.1        localhost.localdomain somehost.localdomain localhost somehost
::1              localhost.localdomain somehost.localdomain localhost somehost

/etc/hosts

localhost.localdomain is the first item following the IP address, so gethostbyname() function will return localhost.localdomain as the local machine's FQDN. Then /var/log/messages file will use localhost as hostname.

To use somehost as the hostname. Move somehost.localdomain to the first item:

#<ip-address>    <hostname.domain.org> <hostname>
#<ip-address>    <actual FQDN> <aliases>
127.0.0.1        somehost.localdomain localhost.localdomain localhost somehost
::1              somehost.localdomain localhost.localdomain localhost somehost

/etc/hosts

Configuration

rsyslog is configured in /etc/rsyslog.conf. See the official documentation for more information on the available configuration options.

By default, all syslog messages are handled by systemd's journal. In order to gather system logs in rsyslog, you either have to turn on #journald's syslog-forward feature or use the #imjournal module of rsyslog to gather the logs by importing it from the systemd journald.

imjournal

If you want rsyslog to pull messages from systemd, load the imjournal module:

$ModLoad imjournal

/etc/rsyslog.conf

See the documentation on the imjournal input module for more information.

journald's syslog-forward feature

ForwardToSyslog=yes

/etc/systemd/journald.conf

Log output can be fine tuned in /etc/rsyslog.conf. The daemon uses Facility levels (see below) to determine what gets put where. For example:

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

/etc/rsyslog.conf

States that all messages falling under the authpriv facility are logged to /var/log/secure.

Another example, which would be similar to the behaviour of syslog-ng for the old auth.log:

auth.*                                                  -/var/log/auth

/etc/rsyslog.conf

See Systemd/Journal#Journald in conjunction with syslog for more information.

Facility levels

Severity levels

As defined in RFC 5424, there are eight severity levels:

Examples

journald with rsyslog for kernel messages

Since the syslog component of systemd, journald, does not flush its logs to disk during normal operation, these logs will be gone when the machine is shut down abnormally (power loss, kernel lock-ups, ...). In the case of kernel lock-ups, it can be important to have some kernel logs for debugging. Until journald gains a configuration option for flushing kernel logs, rsyslog can be used in conjunction with journald.

Summary of requirements:

• journald must still get all log messages.

• rsyslog must only log kernel messages, all other logs are handled by journald.

• Kernel logs must be logged separatedly to /var/log/kernel.log.

• Use systemd to start the service.

Installation and configuration steps:

1. Install rsyslog.

2. Edit /etc/logrotate.d/rsyslog and add /var/log/kernel.log to the list of logs. Without this modification, the kernel log would grow indefinitely.

3. Edit /etc/rsyslog.conf and comment everything except for $ModLoad imklog. If a heart-beat (repeated confirmation that the log is alive) is preferred, $ModLoad immark should remain uncommented as well.

4. Add the next line to the same configuration file:

   1. kern.*     /var/log/kernel.log;RSYSLOG_TraditionalFileFormat

   2. The kern.* part catches all messages originating from the kernel. ;RSYSLOG_TraditionalFileFormat is used here to use a less verbose date format. By default, a date format like 2013-03-09T19:29:33.103897+01:00 is used. Since the kernel log contains a precision already (printk time) and the actual log time is irrelevant, a format like Mar 9 19:29:13 might be preferred.

   Since rsyslog should operate completely separated from systemd, remove the option that shares a socket with systemd:

   1. # sed 's/^Sockets=/#&/' /usr/lib/systemd/system/rsyslog.service > /etc/systemd/system/rsyslog.service

   Next, make rsyslog start on boot and start it for this session by starting and enabling rsyslog.service.

See also

• Rsyslog manual