Hello.
I am surprised that rsyslog start, stop and restart automatically.
Have you any idea.
It looks like if rsyslog use two different file configuration.
Thank you for your help.
Oct 2 16:21:48 LINUX-SRV kernel: imklog 5.4.0, log source = /proc/kmsg started.
Oct 2 16:21:48 LINUX-SRV rsyslogd: [origin software=“rsyslogd” swVersion=“5.4.0” x-pid=“1688” x-info=“http://www.rsyslog.com”] start
Oct 2 16:21:48 LINUX-SRV kernel: 17.616106] type=1505 audit(1286029306.498:2): operation=“profile_load” pid=1580 name=/bin/ping
…
…
…
following messages not respecting the asked format (rsylog.conf).
…
…
…
then rsyslog stop and restart with the correct format.
Oct 2 16:21:55 LINUX-SRV kernel: 26.507284] end_request: I/O error, dev fd0, sector 0
Oct 2 16:21:55 LINUX-SRV kernel: Kernel logging (proc) stopped.
Oct 2 16:21:55 LINUX-SRV rsyslogd: [origin software=“rsyslogd” swVersion=“5.4.0” x-pid=“1688” x-info=“http://www.rsyslog.com”] exiting on signal 15.
2010-10-02T16:21:55.629234+02:00 LINUX-SRV SVRTY:6 TAG:kernel: MSG: imklog 5.4.0, log source = /proc/kmsg started.
2010-10-02T16:21:55.629592+02:00 LINUX-SRV SVRTY:6 TAG:rsyslogd: MSG: [origin software=“rsyslogd” swVersion=“5.4.0” x-pid=“2961” x-info=“http://www.rsyslog.com”] start
2010-10-02T16:21:55.913670+02:00 LINUX-SRV SVRTY:6 TAG:kernel: MSG: 27.029292] [drm] nouveau 0000:02:00.0: Load detected on output C
rsyslog.conf :
rsyslog v3: load input modules
If you do not load inputs, nothing happens!
$ModLoad immark.so # provides --MARK-- message capability
$ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command)
$ModLoad imklog.so # kernel logging (may be also provided by /sbin/klogd),
$klogConsoleLogLevel 1 # set log level 1 (same as in /etc/sysconfig/syslog).
Use traditional log format by default. To change it for a single
file, append “;RSYSLOG_TraditionalFileFormat” to the filename.
#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
NEW myFormat_02
$template myFormat_02,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% SVRTY:%syslogseverity% TAG:%syslogtag% MSG:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%
"
$ActionFileDefaultTemplate myFormat_02
$IncludeConfig /var/run/rsyslog/additional-log-sockets.conf
nothing changed from initial install
$IncludeConfig /etc/rsyslog.d/*.conf
nothing changed from initial install
print most important on tty10 and on the xconsole pipe
if (
/* kernel up to warning except of firewall /
($syslogfacility-text == ‘kern’) and
($syslogseverity <= 4 / warning / ) and not
($msg contains ‘IN=’ and $msg contains ‘OUT=’)
) or (
/ up to errors except of facility authpriv /
($syslogseverity <= 3 / errors */ ) and not
($syslogfacility-text == ‘authpriv’)
)
then /dev/tty10
& |/dev/xconsole
Emergency messages to everyone logged on (wall)
*.emerg *
#######################################################################
ANY MESSAGE RELATIVE TO NSS_LDAP
#######################################################################
:msg, contains, “nss_ldap” /var/log/openldap/nss_ldap_related.log
& ~
firewall messages into separate file and stop their further processing
if ($syslogfacility-text == ‘kern’) and
($msg contains ‘IN=’ and $msg contains ‘OUT=’)
then -/var/log/firewall
& ~
acpid messages into separate file and stop their further processing
=> all acpid messages for debuging (uncomment if needed):
#if ($programname == ‘acpid’ or $syslogtag == ‘[acpid]:’) then \
-/var/log/acpid
=> up to notice (skip info and debug)
if ($programname == ‘acpid’ or $syslogtag == ‘[acpid]:’) and
($syslogseverity <= 5 /* notice */)
then -/var/log/acpid
& ~
NetworkManager into separate file and stop their further processing
if ($programname == ‘NetworkManager’) or
($programname startswith ‘nm-’)
then -/var/log/NetworkManager
& ~
#################################################################
DHCP - NAMED
#################################################################
DHCP into separate file and stop their further processing
if ($programname == ‘dhcpd’) and
( ($syslogseverity <= 4 /* warning */) or
($msg contains ‘/etc/dhcpd.conf’) )
then -/var/log/dhcp_dns/dhcp.log
& ~
if ($programname == ‘dhcpd’) and
($syslogseverity >= 5 /* notice */)
then -/var/log/dhcp_dns/dhcp_notice.log
& ~
NAMED into separate file and stop their further processing
if ($programname == ‘named’) and
( ($syslogseverity <= 4 /* warning */) or
($msg contains ‘/etc/named.conf’) )
then -/var/log/dhcp_dns/named.log
& ~
if ($programname == ‘named’) and
($syslogseverity >= 5 /* notice */)
then -/var/log/dhcp_dns/named_notice.log
& ~
#################################################################
SAMBA - LDAP
#################################################################
SAMBA into separate file and stop their further processing
if ($programname == ‘winbindd’)
then -/var/log/samba/winbindd.log
& ~
if ($programname == ‘nmbd’)
then -/var/log/samba/nmbd.log
& ~
if ($programname == ‘smbd’)
then -/var/log/samba/smbd.log
& ~
LDAP into separate file and stop their further processing
if ($programname == ‘slapd’)
then -/var/log/openldap/slapd.log
& ~
if ($programname == ‘ldap’)
then -/var/log/openldap/ldap.log
& ~
#################################################################
LE RESTE
#################################################################
SMARTD
if ($programname == ‘smartd’)
then -/var/log/smartd.log
& ~
email-messages
mail.* -/var/log/mail
mail.info -/var/log/mail.info
mail.warning -/var/log/mail.warn
mail.err /var/log/mail.err
news-messages
news.crit -/var/log/news/news.crit
news.err -/var/log/news/news.err
news.notice -/var/log/news/news.notice
Warnings in one file
.=warning;.=err -/var/log/warn
*.crit /var/log/warn
the rest in one file
.;mail.none;news.none -/var/log/messages
Some foreign boot scripts require local7
local0,local1.* -/var/log/localmessages
local2,local3.* -/var/log/localmessages
local4,local5.* -/var/log/localmessages
local6,local7.* -/var/log/localmessages