Welcome to Rsyslog¶

Rainer Gerhards <rgerhards@adiscon.com>

%property:fromChar:toChar:options%

%msg:R,ERE,1,FIELD:for (vlan[0-9]\*):--end%

%msg:R,ERE,1,FIELD,1:for (vlan[0-9]\*):--end%

int n, m;
...
syslog(LOG_ERR, "%d test %6d", n, m);

"%msg:F,32:2%" to "%msg:F,32+:2%".

*.* /var/log/allmsgs-including-informational.log
:msg, contains, "informational"  ~
*.* /var/log/allmsgs-but-informational.log

if expr then action-part-of-selector-line

*.* /var/log/file1 # the traditional way
if $msg contains 'error' then /var/log/errlog # the expression-based way

if $syslogfacility-text == 'local0' and $msg startswith 'DEVNAME' and ($msg contains 'error1' or $msg contains 'error0') then /var/log/somelog

if $syslogfacility-text == 'local0' and $msg startswith 'DEVNAME' and not ($msg contains 'error1' or $msg contains 'error0') then /var/log/somelog

if $msg contains getenv('TRIGGERVAR') then /path/to/errfile

*.=crit :omusrmsg:rger
& root
& /var/log/critmsgs

*.=crit :omusrmsg:rger
*.=crit root
*.=crit /var/log/critmsgs

$ModLoad ommysql

$template WinSyslogFmt,"%HOSTNAME%,%timegenerated:1:10:date-rfc3339%,
%timegenerated:12:19:date-rfc3339%,%timegenerated:1:10:date-rfc3339%,
%timegenerated:12:19:date-rfc3339%,%syslogfacility%,%syslogpriority%,
%syslogtag%%msg%\\n"

# Store critical stuff in critical
#
*.=crit;kern.none /var/adm/critical

# Kernel messages are first, stored in the kernel
# file, critical messages and higher ones also go
# to another host and to the console. Messages to
# the host server.example.net are forwarded in RFC 3164
# format (using the template defined above).
#
kern.* /var/adm/kernel
kern.crit @server.example.net;RFC3164fmt
kern.crit /dev/console
kern.info;kern.!err /var/adm/kernel-info

# The tcp wrapper loggs with mail.info, we display
# all the connections on tty12
#
mail.=info /dev/tty12

# Store all mail concerning stuff in a file
#
mail.\*;mail.!=info /var/adm/mail

# Log all mail.info and news.info messages to info
#
mail,news.=info /var/adm/info

# Log info and notice messages to messages file
#
*.=info;*.=notice;\
mail.none /var/log/messages

# Log info messages to messages file
#
*.=info;\
mail,news.none /var/log/messages

# Emergency messages will be displayed to all users
#
*.=emerg :omusrmsg:*

# Messages of the priority alert will be directed
# to the operator
#
*.alert root,rgerhards

*.* @server.example.net

*.* @@server.example.net

*.* @@server.example.net:1514

*.* @server.example.net:1514
*.* >dbhost,dbname,dbuser,dbpassword;dbtemplate

:msg,contains,"error" @server.example.net

$AllowedSender <type>, ip[/bits], ip[/bits]

$AllowedSender UDP, 127.0.0.1, 192.0.2.0/24, [::1]/128, *.example.net, somehost.example.com

$ModLoad imudp
$ModLoad pmdevice1 # load parser "device1.parser" for device 1
$ModLoad pmdevice2 # load parser "device2.parser" for device 2

# define ruleset for the first device sending malformed data
$Ruleset maldev1
$RulesetCreateMainQueue on # create ruleset-specific queue
$RulesetParser "device1.parser" # note: this deactivates the default parsers
# forward all messages to default ruleset:
$ActionOmrulesetRulesetName RSYSLOG\_DefaultRuleset
\*.\* :omruleset:

# define ruleset for the second device sending malformed data
$Ruleset maldev2 $RulesetCreateMainQueue on # create ruleset-specific queue
$RulesetParser "device2.parser" # note: this deactivates the default parsers
# forward all messages to default ruleset:
$ActionOmrulesetRulesetName RSYSLOG\_DefaultRuleset
\*.\* :omruleset:

# switch back to default ruleset
$Ruleset RSYSLOG\_DefaultRuleset

\*.\* /path/to/file
auth.info @authlogger.example.net
# whatever else you usually do...

# now define the inputs and bind them to the rulesets
# first the default listener (utilizing the default ruleset)
$UDPServerRun 514

# now the one with the parser for device type 1:
$InputUDPServerBindRuleset maldev1
$UDPServerRun 10514

# and finally the one for device type 2:
$InputUDPServerBindRuleset maldev2
$UDPServerRun 10515

$ModLoad omhdfs $OMHDFSFileName /var/log/logfile \*.\* :omhdfs:

$ModLoad ommail
$ActionMailSMTPServer mail.example.net
$ActionMailFrom rsyslog@example.net
$ActionMailTo operator@example.net $template mailSubject,"disk problem on %hostname%"
$template mailBody,"RSYSLOG Alert\\r\\nmsg='%msg%'"
$ActionMailSubject mailSubject
# make sure we receive a mail only once in six
# hours (21,600 seconds ;))
$ActionExecOnlyOnceEveryInterval 21600
# the if ... then ... mailBody must be on one line!
if $msg contains 'hard disk fatal failure' then :ommail:;mailBody
# re-set interval so that other actions are not affected
$ActionExecOnlyOnceEveryInterval 0

$ModLoad ommail
$ActionMailSMTPServer mail.example.net
$ActionMailFrom rsyslog@example.net
$ActionMailTo operator@example.net
$ActionMailTo admin@example.net
$template mailSubject,"disk problem on %hostname%" $template mailBody,"RSYSLOG Alert\\r\\nmsg='%msg%'"
$ActionMailSubject mailSubject
# make sure we receive a mail only once in six
# hours (21,600 seconds ;))
$ActionExecOnlyOnceEveryInterval 21600
# the if ...  then ... mailBody mus be on one line!
if $msg contains 'hard disk fatal failure' then :ommail:;mailBody
# re-set interval so that other actions are not affected
$ActionExecOnlyOnceEveryInterval 0

This is an output module feeding directly to an Oracle
database. It uses Oracle Call Interface, a propietary module
provided by Oracle.

Selector lines to be used are of this form:

:omoracle:;TemplateName

The module gets its configuration via rsyslog $... directives,
namely:

$OmoracleDBUser: user name to log in on the database.

$OmoracleDBPassword: password to log in on the database.

$OmoracleDB: connection string (an Oracle easy connect or a db
name as specified by tnsnames.ora)

$OmoracleBatchSize: Number of elements to send to the DB on each
transaction.

$OmoracleStatement: Statement to be prepared and executed in
batches. Please note that Oracle's prepared statements have their
placeholders as ':identifier', and this module uses the colon to
guess how many placeholders there will be.

All these directives are mandatory. The dbstring can be an Oracle
easystring or a DB name, as present in the tnsnames.ora file.

The form of the template is just a list of strings you want
inserted to the DB, for instance:

$template TestStmt,"%hostname%%msg%"

Will provide the arguments to a statement like

$OmoracleStatement \
    insert into foo(hostname,message)values(:host,:message)

Also note that identifiers to placeholders are arbitrary. You
need to define the properties on the template in the correct order
you want them passed to the statement!

REQUIREMENTS:
--------------

- Oracle Instantclient 10g (NOT 11g) Base + Devel
  (if you´re on 64-bit linux you should choose the 64-bit libs!)
- JDK 1.6 (not neccessary for oracle plugin but "make" didd not finsished successfully without it)

- "oracle-instantclient-config" script
  (seems to shipped with instantclient 10g Release 1 but i was unable to find it for 10g Release 2 so here it is)

======================  /usr/local/bin/oracle-instantclient-config =====================
#!/bin/sh
#
# Oracle InstantClient SDK config file
# Jean-Christophe Duberga - Bordeaux 2 University
#

# just adapt it to your environment
incdirs="-I/usr/include/oracle/10.2.0.4/client64"
libdirs="-L/usr/lib/oracle/10.2.0.4/client64/lib"

usage="\
Usage: oracle-instantclient-config [--prefix[=DIR]] [--exec-prefix[=DIR]] [--version] [--cflags] [--libs] [--static-libs]"

if test $# -eq 0; then
      echo "${usage}" 1>&2
      exit 1
fi

while test $# -gt 0; do
  case "$1" in
  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
  *) optarg= ;;
  esac

  case $1 in
    --prefix=*)
      prefix=$optarg
      if test $exec_prefix_set = no ; then
        exec_prefix=$optarg
      fi
      ;;
    --prefix)
      echo $prefix
      ;;
    --exec-prefix=*)
      exec_prefix=$optarg
      exec_prefix_set=yes
      ;;
    --exec-prefix)
      echo ${exec_prefix}
      ;;
    --version)
      echo ${version}
      ;;
    --cflags)
      echo ${incdirs}
      ;;
    --libs)
      echo $libdirs -lclntsh -lnnz10 -locci -lociei -locijdbc10
      ;;
    --static-libs)
      echo "No static libs" 1>&2
      exit 1
      ;;
    *)
      echo "${usage}" 1>&2
      exit 1
      ;;
  esac
  shift
done

===============   END ==============

COMPILING RSYSLOGD
-------------------

./configure --enable-oracle

RUNNING
-------

- make sure rsyslogd is able to locate the oracle libs (either via LD_LIBRARY_PATH or /etc/ld.so.conf)
- set TNS_ADMIN to point to your tnsnames.ora
- create a tnsnames.ora and test you are able to connect to the database

- create user in oracle as shown in the following example:
        create user syslog identified by syslog default tablespace users quota unlimited on users;
        grant create session to syslog;
        create role syslog_role;
        grant syslog_role to syslog;
        grant create table to syslog_role;
        grant create sequence to syslog_role;

- create tables as needed

- configure rsyslog as shown in the following example
        $ModLoad omoracle

        $OmoracleDBUser syslog
        $OmoracleDBPassword syslog
        $OmoracleDB syslog
        $OmoracleBatchSize 1
        $OmoracleBatchItemSize 4096

        $OmoracleStatementTemplate OmoracleStatement
        $template OmoracleStatement,"insert into foo(hostname,message) values (:host,:message)"
        $template TestStmt,"%hostname%%msg%"
        *.*                     :omoracle:;TestStmt
    (you guess it: username = password = database = "syslog".... see $rsyslogd_source/plugins/omoracle/omoracle.c for me info)

$ModLoad omruleset # define ruleset for commonly written file
$RuleSet CommonAction
$RulesetCreateMainQueue on
*.* /path/to/file.log

#switch back to default ruleset
$ruleset RSYSLOG_DefaultRuleset

# begin first action
# note that we must first specify which ruleset to use for omruleset:
$ActionOmrulesetRulesetName CommonAction
mail.info :omruleset:
# end first action

# begin second action
# note that we must first specify which ruleset to use for omruleset:
$ActionOmrulesetRulesetName CommonAction
:FROMHOST, isequal, "myhost.example.com" :omruleset:
#end second action

# of course, we can have "regular" actions alongside :omrulset: actions
*.* /path/to/general-message-file.log

$ModLoad omruleset
# define "second" ruleset
$RuleSet nested
$RulesetCreateMainQueue on
# again, we use our own queue
mail.* /path/to/mailerr.log
kernel.* /path/to/kernelerr.log
auth.* /path/to/autherr.log

#switch back to default ruleset
$ruleset RSYSLOG_DefaultRuleset

# begin first action - here we filter on "error"
# note that we must first specify which ruleset to use for omruleset:
$ActionOmrulesetRulesetName nested
:msg, contains, "error" :omruleset:
#end first action

# begin second action - as an example we can do anything else in
# this processing. Note that these actions are processed concurrently
# to the ruleset "nested"
:FROMHOST, isequal, "myhost.example.com" /path/to/host.log
#end second action

# of course, we can have "regular" actions alongside :omrulset: actions
*.* /path/to/general-message-file.log

$ModLoad omsnmp
$actionsnmptransport udp
$actionsnmptarget localhost
$actionsnmptargetport 162
$actionsnmpversion 1
$actionsnmpcommunity public
*.* :omsnmp:

$ModLoad omudpspoof $ActionOMUDPSpoofTargetHost server.example.com
*.*      :omudpspoof:

$ModLoad omudpspoof $template spoofaddr,"192.0.2.1" $template
spooftemplate,"%rawmsg%" $ActionOMUDPSpoofSourceNameTemplate spoofaddr
$ActionOMUDPSpoofTargetHost server.example.com
$ActionOMUDPSpoofSourcePortStart 514 $ActionOMUDPSpoofSourcePortEnd 514
*.*      :omudpspoof:;spooftemplate

$ModLoad omudpspoof $template spoofaddr,"192.0.2.1"
$ActionOMUDPSpoofSourceNameTemplate spoofaddr
$ActionOMUDPSpoofTargetHost server.example.com
*.*      :omudpspoof:

$ModLoad omucsock
$OMUxSockSocket /tmp/socksample
*.* :omuxsock:

$ModLoad im3195 $Input3195ListenPort 1601

$ModLoad imfile # needs to be done just once
# File 1
$InputFileName /path/to/file1
$InputFileTag tag1:
$InputFileStateFile stat-file1

$InputFileSeverity error
$InputFileFacility local7
$InputRunFileMonitor

# File 2
$InputFileName /path/to/file2
$InputFileTag tag2:

$InputFileStateFile stat-file2
$InputRunFileMonitor
# ... and so on ...
# check for new lines every 10 seconds $InputFilePollingInterval 10

$ModLoad imgssapi # needs to be done just once
$InputGSSServerRun 1514
$InputGSSServerPermitPlainTCP on

$ModLoad imklog

$ModLoad impstats $PStatInterval 600 $PStatSeverity 7 syslog.debug /var/log/rsyslog-stats

$ModLoad imptcp # needs to be done just once
$InputPTCPServerRun 514

$ModLoad imrelp # needs to be done just once
$InputRELPServerRun 20514

$ModLoad imsolaris

$ModLoad imtcp # needs to be done just once
$InputTCPMaxSessions 500
$InputTCPServerRun 514

$ModLoad imudp # needs to be done just once
$UDPServerRun 514

logger -t snmptrapd/warning/realhost Host 003c.abcd.ffff in vlan 17 is flapping between port Gi4/1 and port Gi3/2

2011-04-21T16:43:09.101633+02:00 realhost snmptrapd: Host 003c.abcd.ffff in vlan 122 is flapping between port Gi4/1 and port Gi3/2

checking for SYSLOG_UNIXAF support... yes
checking for FSSTND support... yes
./configure: line 25895: syntax error near unexpected token `RELP,'
./configure: line 25895: ` PKG_CHECK_MODULES(RELP, relp >= 0.1.1)'

make[2]: Entering directory `/home/az/RSyslog/rsyslog-5.5.0/tools'
  CCLD   rsyslogd
rsyslogd-omfile.o: In function `getClockFileAccess':
/home/az/RSyslog/rsyslog-5.5.0/tools/omfile.c:91: undefined reference to `__sync_fetch_and_add_8'
/home/az/RSyslog/rsyslog-5.5.0/tools/omfile.c:91: undefined reference to `__sync_fetch_and_add_8'
/home/az/RSyslog/rsyslog-5.5.0/tools/omfile.c:91: undefined reference to `__sync_fetch_and_add_8'

./configure CFLAGS="-march=i586 -mcpu=i686" --enable-imfile ... (whatever you need)

./configure --enable-mysql

$RuleSet <name>

$InputTCPServerBindRuleset <name>

$DefaultRuleset <name>

# ... module loading ...
# The authpriv file has restricted access.
authpriv.*  /var/log/secure
# Log all the mail messages in one place.
mail.*      /var/log/maillog
# Log cron stuff
cron.*      /var/log/cron
# Everybody gets emergency messages
*.emerg     *
... more ...

# ... module loading ...
# process remote messages
:fromhost-ip, isequal, "192.0.2.1"    /var/log/remotefile
& ~
# only messages not from 192.0.21 make it past this point

# The authpriv file has restricted access.
authpriv.*                            /var/log/secure
# Log all the mail messages in one place.
mail.*                                /var/log/maillog
# Log cron stuff
cron.*                                /var/log/cron
# Everybody gets emergency messages
*.emerg                               *
... more ...

# ... module loading ...
# process remote messages
# define new ruleset and add rules to it:
$RuleSet remote
*.*           /var/log/remotefile
# only messages not from 192.0.21 make it past this point

# bind ruleset to tcp listener
$InputTCPServerBindRuleset remote
# and activate it:
$InputTCPServerRun 10514

# switch back to the default ruleset:
$RuleSet RSYSLOG_DefaultRuleset
# The authpriv file has restricted access.
authpriv.*    /var/log/secure
# Log all the mail messages in one place.
mail.*        /var/log/maillog
# Log cron stuff
cron.*        /var/log/cron
# Everybody gets emergency messages
*.emerg       *
... more ...

# ... module loading ...
# at first, this is a copy of the unmodified rsyslog.conf
# The authpriv file has restricted access.
authpriv.*    /var/log/secure
# Log all the mail messages in one place.
mail.*        /var/log/maillog
# Log cron stuff
cron.*        /var/log/cron
# Everybody gets emergency messages
*.emerg       *
... more ...
# end of the "regular" rsyslog.conf. Now come the new definitions:

# process remote messages
# define new ruleset and add rules to it:
$RuleSet remote
*.*           /var/log/remotefile

# bind ruleset to tcp listener
$InputTCPServerBindRuleset remote
# and activate it:
$InputTCPServerRun 10514

# ... module loading ...
# at first, this is a copy of the unmodified rsyslog.conf
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.*  /var/log/maillog
# Log cron stuff
cron.*  /var/log/cron
# Everybody gets emergency messages
*.emerg       *
... more ...
# end of the "regular" rsyslog.conf. Now come the new definitions:

# process remote messages

#define rulesets first
$RuleSet remote10514
*.*     /var/log/remote10514

$RuleSet remote10515
*.*     /var/log/remote10515

$RuleSet remote10516
mail.*  /var/log/mail10516
&       ~
# note that the discard-action will prevent this messag from
# being written to the remote10516 file - as usual...
*.*     /var/log/remote10516

# and now define listners bound to the relevant ruleset
$InputTCPServerBindRuleset remote10514
$InputTCPServerRun 10514

$InputTCPServerBindRuleset remote10515
$InputTCPServerRun 10515

$InputTCPServerBindRuleset remote10516
$InputTCPServerRun 10516

kill -USR1 `cat /var/run/rsyslogd.pid`

$ /path/to/rsyslogd -f/path/to/config-file -N1

yum install rsyslog-debuginfo

$ gdb /path/to/rsyslogd
$ core /core.1234
$ info thread
$ thread apply all bt full
$ q # quits gdb

certtool --generate-privkey --outfile ca-key.pem

certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca.pem

[root@rgf9dev sample]# certtool --generate-privkey --outfile ca-key.pem --bits 2048
Generating a 2048 bit RSA private key...
[root@rgf9dev sample]# certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca.pem
Generating a self signed certificate...
Please enter the details of the certificate's distinguished name. Just press enter to ignore a field.
Country name (2 chars): US
Organization name: SomeOrg
Organizational unit name: SomeOU
Locality name: Somewhere
State or province name: CA
Common name: someName (not necessarily DNS!)
UID:
This field should not be used in new certificates.
E-mail:
Enter the certificate's serial number (decimal):

Activation/Expiration time.
The certificate will expire in (days): 3650

Extensions.
Does the certificate belong to an authority? (Y/N): y
Path length constraint (decimal, -1 for no constraint):
Is this a TLS web client certificate? (Y/N):
Is this also a TLS web server certificate? (Y/N):
Enter the e-mail of the subject of the certificate: someone@example.net
Will the certificate be used to sign other certificates? (Y/N): y
Will the certificate be used to sign CRLs? (Y/N):
Will the certificate be used to sign code? (Y/N):
Will the certificate be used to sign OCSP requests? (Y/N):
Will the certificate be used for time stamping? (Y/N):
Enter the URI of the CRL distribution point:
X.509 Certificate Information:
    Version: 3
    Serial Number (hex): 485a365e
    Validity:
        Not Before: Thu Jun 19 10:35:12 UTC 2008
        Not After: Sun Jun 17 10:35:25 UTC 2018
    Subject: C=US,O=SomeOrg,OU=SomeOU,L=Somewhere,ST=CA,CN=someName (not necessarily DNS!)
    Subject Public Key Algorithm: RSA
        Modulus (bits 2048):
            d9:9c:82:46:24:7f:34:8f:60:cf:05:77:71:82:61:66
            05:13:28:06:7a:70:41:bf:32:85:12:5c:25:a7:1a:5a
            28:11:02:1a:78:c1:da:34:ee:b4:7e:12:9b:81:24:70
            ff:e4:89:88:ca:05:30:0a:3f:d7:58:0b:38:24:a9:b7
            2e:a2:b6:8a:1d:60:53:2f:ec:e9:38:36:3b:9b:77:93
            5d:64:76:31:07:30:a5:31:0c:e2:ec:e3:8d:5d:13:01
            11:3d:0b:5e:3c:4a:32:d8:f3:b3:56:22:32:cb:de:7d
            64:9a:2b:91:d9:f0:0b:82:c1:29:d4:15:2c:41:0b:97
        Exponent:
            01:00:01
    Extensions:
        Basic Constraints (critical):
            Certificate Authority (CA): TRUE
        Subject Alternative Name (not critical):
            RFC822name: someone@example.net
        Key Usage (critical):
            Certificate signing.
        Subject Key Identifier (not critical):
            fbfe968d10a73ae5b70d7b434886c8f872997b89
Other Information:
    Public Key Id:
        fbfe968d10a73ae5b70d7b434886c8f872997b89

Is the above information ok? (Y/N): y

Signing certificate...
[root@rgf9dev sample]# chmod 400 ca-key.pem
[root@rgf9dev sample]# ls -l
total 8
-r-------- 1 root root  887 2008-06-19 12:33 ca-key.pem
-rw-r--r-- 1 root root 1029 2008-06-19 12:36 ca.pem
[root@rgf9dev sample]#

[root@rgf9dev sample]# certtool --generate-privkey --outfile key.pem --bits 2048
Generating a 2048 bit RSA private key...
[root@rgf9dev sample]# certtool --generate-request --load-privkey key.pem --outfile request.pem
Generating a PKCS #10 certificate request...
Country name (2 chars): US
Organization name: SomeOrg
Organizational unit name: SomeOU
Locality name: Somewhere
State or province name: CA
Common name: machine.example.net
UID:
Enter a dnsName of the subject of the certificate:
Enter the IP address of the subject of the certificate:
Enter the e-mail of the subject of the certificate:
Enter a challange password:
Does the certificate belong to an authority? (y/N): n
Will the certificate be used for signing (DHE and RSA-EXPORT ciphersuites)? (y/N):
Will the certificate be used for encryption (RSA ciphersuites)? (y/N):
Is this a TLS web client certificate? (y/N): y
Is this also a TLS web server certificate? (y/N): y
[root@rgf9dev sample]# certtool --generate-certificate --load-request request.pem --outfile cert.pem --load-ca-certificate ca.pem --load-ca-privkey ca-key.pem
Generating a signed certificate...
Enter the certificate's serial number (decimal):

Activation/Expiration time.
The certificate will expire in (days): 1000

Extensions.
Do you want to honour the extensions from the request? (y/N):
Does the certificate belong to an authority? (Y/N): n
Is this a TLS web client certificate? (Y/N): y
Is this also a TLS web server certificate? (Y/N): y
Enter the dnsName of the subject of the certificate: machine.example.net {This is the name of the machine that will use the certificate}
Enter the IP address of the subject of certificate:
Will the certificate be used for signing (DHE and RSA-EXPORT ciphersuites)? (Y/N):
Will the certificate be used for encryption (RSA ciphersuites)? (Y/N):
X.509 Certificate Information:
    Version: 3
    Serial Number (hex): 485a3819
    Validity:
        Not Before: Thu Jun 19 10:42:54 UTC 2008
        Not After: Wed Mar 16 10:42:57 UTC 2011
    Subject: C=US,O=SomeOrg,OU=SomeOU,L=Somewhere,ST=CA,CN=machine.example.net
    Subject Public Key Algorithm: RSA
        Modulus (bits 2048):
            b2:4e:5b:a9:48:1e:ff:2e:73:a1:33:ee:d8:a2:af:ae
            2f:23:76:91:b8:39:94:00:23:f2:6f:25:ad:c9:6a:ab
            2d:e6:f3:62:d8:3e:6e:8a:d6:1e:3f:72:e5:d8:b9:e0
            d0:79:c2:94:21:65:0b:10:53:66:b0:36:a6:a7:cd:46
            1e:2c:6a:9b:79:c6:ee:c6:e2:ed:b0:a9:59:e2:49:da
            c7:e3:f0:1c:e0:53:98:87:0d:d5:28:db:a4:82:36:ed
            3a:1e:d1:5c:07:13:95:5d:b3:28:05:17:2a:2b:b6:8e
            8e:78:d2:cf:ac:87:13:15:fc:17:43:6b:15:c3:7d:b9
        Exponent:
            01:00:01
    Extensions:
        Basic Constraints (critical):
            Certificate Authority (CA): FALSE
        Key Purpose (not critical):
            TLS WWW Client.
            TLS WWW Server.
        Subject Alternative Name (not critical):
            DNSname: machine.example.net
        Subject Key Identifier (not critical):
            0ce1c3dbd19d31fa035b07afe2e0ef22d90b28ac
        Authority Key Identifier (not critical):
            fbfe968d10a73ae5b70d7b434886c8f872997b89
Other Information:
    Public Key Id:
        0ce1c3dbd19d31fa035b07afe2e0ef22d90b28ac

Is the above information ok? (Y/N): y

Signing certificate...
[root@rgf9dev sample]# rm -f request.pem
[root@rgf9dev sample]# ls -l
total 16
-r-------- 1 root root  887 2008-06-19 12:33 ca-key.pem
-rw-r--r-- 1 root root 1029 2008-06-19 12:36 ca.pem
-rw-r--r-- 1 root root 1074 2008-06-19 12:43 cert.pem
-rw-r--r-- 1 root root  887 2008-06-19 12:40 key.pem
[root@rgf9dev sample]# # it may be a good idea to rename the files to indicate where they belong to
[root@rgf9dev sample]# mv cert.pem machine-cert.pem
[root@rgf9dev sample]# mv key.pem machine-key.pem
[root@rgf9dev sample]#

$DefaultNetstreamDriverCAFile /home/rger/proj/rsyslog/sample/ca.pem
$DefaultNetstreamDriverCertFile /home/rger/proj/rsyslog/sample/machine-cert.pem
$DefaultNetstreamDriverKeyFile /home/rger/proj/rsyslog/sample/machine-key.pem

$InputTCPServerStreamDriverPermittedPeer *.example.net

$InputTCPServerStreamDriverPermittedPeer *.example.net
$InputTCPServerStreamDriverPermittedPeer *.otherdepartment.example.net
$InputTCPServerStreamDriverPermittedPeer *.example.com

$InputTCPServerStreamDriverPermittedPeer zuse.example.net
$InputTCPServerStreamDriverPermittedPeer turing.example.net
$InputTCPServerStreamDriverPermittedPeer ada.example.net

$ModLoad imuxsock # local messages
$ModLoad imtcp # TCP listener

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /rsyslog/protected/ca.pem
$DefaultNetstreamDriverCertFile /rsyslog/protected/machine-cert.pem
$DefaultNetstreamDriverKeyFile /rsyslog/protected/machine-key.pem

$InputTCPServerStreamDriverAuthMode x509/name
$InputTCPServerStreamDriverPermittedPeer *.example.net
$InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode
$InputTCPServerRun 10514 # start up listener at port 10514

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /rsyslog/protected/ca.pem
$DefaultNetstreamDriverCertFile /rsyslog/protected/machine-cert.pem
$DefaultNetstreamDriverKeyFile /rsyslog/protected/machine-key.pem

$ActionSendStreamDriverAuthMode x509/name
$ActionSendStreamDriverPermittedPeer central.example.net
$ActionSendStreamDriverMode 1 # run driver in TLS-only mode
*.* @@central.example.net:10514 # forward everything to remote server

# start a UDP listener for the remote router
$ModLoad imudp    # load UDP server plugin
$AllowedSender UDP, 192.0.2.1 # permit only the router
$UDPServerRun 514 # listen on default syslog UDP port 514

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /rsyslog/protected/ca.pem
$DefaultNetstreamDriverCertFile /rsyslog/protected/machine-cert.pem
$DefaultNetstreamDriverKeyFile /rsyslog/protected/machine-key.pem

$ActionSendStreamDriverAuthMode x509/name
$ActionSendStreamDriverPermittedPeer central.example.net
$ActionSendStreamDriverMode 1 # run driver in TLS-only mode
*.* @@central.example.net:10514 # forward everything to remote server

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /path/to/contrib/gnutls/ca.pem
$DefaultNetstreamDriverCertFile /path/to/contrib/gnutls/cert.pem
$DefaultNetstreamDriverKeyFile /path/to/contrib/gnutls/key.pem

$ModLoad imtcp # load TCP listener

$InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode
$InputTCPServerStreamDriverAuthMode anon # client is NOT authenticated
$InputTCPServerRun 10514 # start up listener at port 10514

# certificate files - just CA for a client
$DefaultNetstreamDriverCAFile /path/to/contrib/gnutls/ca.pem

# set up the action
$DefaultNetstreamDriver gtls # use gtls netstream driver
$ActionSendStreamDriverMode 1 # require TLS for the connection
$ActionSendStreamDriverAuthMode anon # server is NOT authenticated
*.* @@(o)server.example.net:10514 # send (all) messages

certtool --generate-privkey --outfile ca-key.pem

certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca.pem

certtool --generate-privkey --outfile key.pem

certtool --generate-request --load-privkey key.pem --outfile request.pem

certtool --generate-certificate --load-request request.pem --outfile cert.pem \ --load-ca-certificate ca.pem --load-ca-privkey ca-key.pem

$ certtool --certificate-info --infile cert.pem

*.* @@primary-syslog.example.com
$ActionExecOnlyWhenPreviousIsSuspended on
& @@secondary-1-syslog.example.com
& @@secondary-2-syslog.example.com
& /var/log/localbuffer
$ActionExecOnlyWhenPreviousIsSuspended off

# start log rotation via outchannel
# outchannel definiation
$outchannel log_rotation,/var/log/log_rotation.log, 52428800,/home/me/./log_rotation_script
#  activate the channel and log everything to it
*.* :omfile:$log_rotation
# end log rotation via outchannel

mv -f /var/log/log_rotation.log /var/log/log_rotation.log.1

BEGINmodInit()
    rsRetVal localRet;
    rsRetVal (*pomsrGetSupportedTplOpts)(unsigned long *pOpts);
    unsigned long opts;
    int bArrayPassingSupported;     /* does core support template passing as an array? */
CODESTARTmodInit
    *ipIFVersProvided = CURR_MOD_IF_VERSION; /* we only support the current interface specification */
CODEmodInit_QueryRegCFSLineHdlr
    /* check if the rsyslog core supports parameter passing code */
    bArrayPassingSupported = 0;
    localRet = pHostQueryEtryPt((uchar*)"OMSRgetSupportedTplOpts", &pomsrGetSupportedTplOpts);
    if(localRet == RS_RET_OK) {
        /* found entry point, so let's see if core supports array passing */
        CHKiRet((*pomsrGetSupportedTplOpts)(&opts));
        if(opts & OMSR_TPL_AS_ARRAY)
            bArrayPassingSupported = 1;
    } else if(localRet != RS_RET_ENTRY_POINT_NOT_FOUND) {
        ABORT_FINALIZE(localRet); /* Something else went wrong, what is not acceptable */
    }
    DBGPRINTF("omstdout: array-passing is %ssupported by rsyslog core.\n", bArrayPassingSupported ? "" : "not ");

    if(!bArrayPassingSupported) {
        DBGPRINTF("rsyslog core too old, shutting down this plug-in\n");
        ABORT_FINALIZE(RS_RET_ERR);
    }

doAction()
    {
    beginTransaction()
    ProcessMessage()
    endTransaction()
    }

beginTransaction()
    {
    /* prepare for transaction */
    }

doAction()
    {
    ProcessMessage()
    /* maybe do partial commits */
    }

endTransaction()
    {
    /* commit (rest of) batch */
    }

INITChkCoreFeature(bCoreSupportsBatching, CORE_FEATURE_BATCHING);

+-----------------+
| "remote" PLOrig |
+-----------------+
    |
    I  +--------+-----+-----+          +-----+-------+------+-----+
    P  | PLOrig | GWI | ... |          | GWO | Store | Disc | ... |
    C  +--------+-----+-----+          +-----+-------+------+-----+
    |        |                                          ^
    v        v                                          |
   +--------------+        +------------+          +--------------+
   | PLGenerator  |        |  RelayEng  |          | CollectorEng |
   +--------------+        +------------+          +--------------+
          |                      ^                       ^
          |                      |                       |
          v                      v                       |
   +-------------+         +------------+          +--------------+
   |   PLG Ext   |         | RelEng Ext |          | CollcEng Ext |
   +-------------+         +------------+          +--------------+
          |                      ^                       ^
          |                      |                       |
          v                      v                       |
   +--------------------------------------------------------------+
   |                      Message Router                          |
   +--------------------------------------------------------------+
                      |                            ^
                      v                            |
   +--------------------------------------------------------------+
   |           Message CoDec (e.g. RFC 3164, RFCYYYY)             |
   +--------------------------------------------------------------+
                      |                            ^
                      v                            |
   +---------------------+-----------------------+----------------+
   |    transport UDP    |    transport TLS      |      ...       |
   +---------------------+-----------------------+----------------+

             Generic Syslog Application Architecture

CREATE DATABASE syslog
USE syslog
CREATE TABLE logs(host varchar(32) default NULL,
                  facility varchar(10)
                  default NULL,
                  priority varchar(10) default NULL,
                  level varchar(10) default NULL,
                  tag varchar(10) default NULL,
                  date date default NULL,
                  time time default NULL,
                  program varchar(15) default NULL,
                  msg text,
                  seq int(10) unsigned NOT NULL auto_increment,
                  PRIMARY KEY (seq),
                  KEY host (host),
                  KEY seq (seq),
                  KEY program (program),
                  KEY time (time),
                  KEY date (date),
                  KEY priority (priority),
                  KEY facility (facility
                 ) TYPE=MyISAM;``

$template syslog-ng,"insert into logs(host, facility, priority, tag, date, time, msg) values ('%HOSTNAME%', %syslogfacility%, %syslogpriority%, '%syslogtag%', '%timereported:::date-mysql%', '%timereported:::date-mysql%', '%msg%')", SQL
*.*,           mysql-server,syslog,user,pass;syslog-ng

; Certificate/key is needed in server modecert = /etc/stunnel/stunnel.pem; Some debugging stuff useful for troubleshootingdebug = 7foreground=yes

; Some debugging stuff useful for troubleshootingdebug = 7foreground=yes

client=yes

[ssyslog]
accept  = 127.0.0.1:61514
connect = 192.0.2.1:60514

*.*      @@127.0.0.1:61514

   The payload of any IP packet that has a UDP destination port of 514
   MUST be treated as a syslog message.

Think a bit about it: this means that whatever is send to port 514 must be considered
a valid syslog message. No format at all is demanded. So if "this is junk" is sent to
UDP port 514 - voila, we have a valid message (interestingly, it is no longer a syslog
message if it is sent to port 515 ;)). You may now argue that I am overdoing. So let's
cite RFC 3164, Section 5.4, Example 2:

  Example 2

        Use the BFG!

   While this is a valid message, it has extraordinarily little useful
   information.

<PRI>TIMESTAMP SP HOST SP TAG MSG(Freetext)

<144>Tue Sep 23 11:40:01 taghost sample message

"<130> [ERROR] iapp_socket_task.c 399: iappSocketTask: iappRecvPkt returned error"

"<130> [ERROR] host.example.net 2008-09-23 11-40-22 PST iapp_socket_task.c 399: iappSocketTask: iappRecvPkt returned error"

*.* /var/log/somefile

$template, MalfromedMsgFormater,"%timegenerated% %fromhost% %rawmsg:::drop-last-lf%\n"
*.* /var/log/somefile;MalformedMsgFormatter

$ kill -HUP `cat /var/run/rsyslogd.pid`

$ /etc/init.d/rsyslog restart

$ModLoad immark # provides --MARK-- message capability
$ModLoad imudp # provides UDP syslog reception
$ModLoad imtcp # provides TCP syslog reception
$ModLoad imgssapi # provides GSSAPI syslog reception
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)

$ModLoad immark
$MarkMessagePeriod 1800 # 30 minutes

$ModLoad imudp
$UDPServerAddress 192.0.2.1 # this MUST be before the $UDPServerRun directive!
$UDPServerRun 514

$ModLoad imudp
$UDPServerAddress 192.0.2.1 # this MUST be before the $UDPServerRun directive!
$UDPServerRun 514
$UDPServerAddress \* # all local interfaces
$UDPServerRun 1514

$ModLoad imklog

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$ActionForwardDefaultTemplate RSYSLOG_ForwardFormat # for plain TCP and UDP
$ActionGSSForwardDefaultTemplate RSYSLOG_ForwardFormat # for GSS-API

Mode	Returned
DFLT	“NO MATCH”
BLANK	“” (empty string)
ZERO	“0”
FIELD	full content of original field
	Interactive Tool

Module Name:	imudp
Author:	Rainer Gerhards <rgerhards@adiscon.com>
Multi-Ruleset Support:	since 5.3.2

Code	Severity
0	Emergency: system is unusable
1	Alert: action must be taken immediately
2	Critical: critical conditions
3	Error: error conditions
4	Warning: warning conditions
5	Notice: normal but significant condition
6	Informational: informational messages
7	Debug: debug-level messages

RS_RET_OK	The record and all previous inside the batch has been commited. Note: this definition is what makes integrating plugins without the transaction being/end calls so easy - this is the traditional “success” return state and if every call returns it, there is no need for actually calling `endTransaction()`, because there is no transaction open).
RS_RET_DEFER_COMMIT	The record has been processed, but is not yet commited. This is the expected state for transactional-aware plugins.
RS_RET_PREVIOUS_COMMITTED	The previous record inside the batch has been committed, but the current one not yet. This state is introduced to support sources that fill up buffers and commit once a buffer is completely filled. That may occur halfway in the next record, so it may be important to be able to tell the engine the everything up to the previouos record is commited

Navigation

Welcome to Rsyslog¶

Manual¶

Configuration¶

Basic Structure¶

Quick overview of message flow and objects¶

Processing Principles¶

Configuration File¶

Statements¶

Comments¶

Processing Order¶

Flow Control Statements¶

Inputs¶

Outputs¶

Rulesets and Rules¶

Templates¶

String-based Templates¶

String-based Template Samples¶

String Generator based Templates¶

rsyslog Properties¶

Message Properties¶

System Properties¶

The Property Replacer¶

Accessing Properties¶

Available Properties¶

Character Positions¶

Property Options¶

Further Links¶

Property Replacer nomatch mode¶

Filter Conditions¶

Selectors¶

Property-Based Filters¶

Compare-Operations¶

Value Part¶

Expression-Based Filters¶

BSD-style Blocks¶

Examples¶

RainerScript¶

Data Types¶

Expressions¶

Functions¶

Actions¶

Regular File¶

Named Pipes¶

Terminal and Console¶

Remote Machine¶

List of Users¶

Everyone logged on¶

Call Plugin¶

Database Table¶

Discard¶

Output Channel¶

Shell Execute¶

Template Name¶

Examples¶

Templates¶

Selector lines¶

Configuration Directives¶

Configuration Parameter Types¶

Global Configuration Statements¶

True Global Directives¶

main queue specific Directives¶

Directives affecting Input Modules¶

Directives affecting multiple Input Modules¶

immark-specific Directives¶

Action-Specific Configuration Statements¶

Generic action configuration Statements¶

omfile-specific Configuration Statements¶

omfwd-specific Configuration Statements¶

omgssapi-specific Configuration Statements¶

action-queue specific Configuration Statements¶

Ruleset-Specific Configuration Statements¶

$RulesetCreateMainQueue¶

$RulesetParser¶

Modules¶

Output Modules¶

omhdfs: Hadoop Filesystem Output Module¶

omlibdbi: Generic Database Output Module¶

ommail: Mail Output Module¶

ommysql: MySQL Database Output Module¶