RSYSLOGD(8)               Linux System Administration              RSYSLOGD(8)



NAME
       rsyslogd - reliable and extended syslogd

SYNOPSIS
       rsyslogd [ -4 ] [ -6 ] [ -A ] [ -a socket ] [ -d ] [ -e ]
       [ -f config file ] [ -h ] [ -i pid file ] [ -l hostlist ]
       [ -m interval ] [ -n ] [ -o ] [ -p socket ]
       [ -r [port] ] [ -s domainlist ] [ -t port,max-nbr-of-sessions ]
       [ -v ] [ -w ] [ -x ]


DESCRIPTION
       Rsyslogd  is  a  system  utility providing support for message logging.
       Support of both internet and unix domain sockets enables  this  utility
       to support both local and remote logging (via UDP and TCP).

       Rsyslogd(8)  is  derived  from  the  sysklogd  package which in turn is
       derived from the stock BSD sources.

       Rsyslogd provides a kind of logging  that  many  modern  programs  use.
       Every  logged  message  contains  at least a time and a hostname field,
       normally a program name field, too, but that depends on how trusty  the
       logging  program  is.  The  rsyslog package supports free definition of
       output formats via templates. It also supports precise  timestamps  and
       writing  directly  to  MySQL databases. If the database option is used,
       tools like phpLogCon can be used to view the log data.

       While the rsyslogd sources have been heavily modified a couple of notes
       are  in  order.   First  of  all there has been a systematic attempt to
       insure that rsyslogd follows its default,  standard  BSD  behavior.  Of
       course,  some configuration file changes are necessary in order to sup-
       port the template system. However, rsyslogd should be  able  to  use  a
       standard  syslog.conf  and  act  like  the original syslogd. However, an
       original syslogd will not work correctly with a  rsyslog-enhanced  con-
       figuration  file.  At  best, it will generate funny looking file names.
       The second important concept to note is that this version  of  rsyslogd
       interacts  transparently  with the version of syslog found in the stan-
       dard libraries.  If a binary linked to the  standard  shared  libraries
       fails  to  function correctly we would like an example of the anomalous
       behavior.

       The main configuration file /etc/rsyslog.conf or an  alternative  file,
       given  with  the  -f  option, is read at startup.  Any lines that begin
       with the hash mark (‘‘#’’) and empty lines are ignored.   If  an  error
       occurs  during  parsing  the  error  element is ignored. It is tried to
       parse the rest of the line.

       For details and configuration examples, see the  rsyslog.conf  (5)  man
       page.



OPTIONS
       -A     When sending UDP messages, there are potentially multiple paths
              to the target destination. By default, rsyslogd  only  sends  to
              the  first  target  it can successfully send to. If -A is given,
              messages are sent to all targets. This may improve  reliability,
              but  may  also  cause  message  duplication.  This  option should
              enabled only if it is fully understood.

       -4     Causes rsyslogd to listen to IPv4 addresses only.  If neither -4
              nor -6 is given, rsyslogd listens to all configured addresses of
              the system.

       -6     Causes rsyslogd to listen to IPv6 addresses only.  If neither -4
              nor -6 is given, rsyslogd listens to all configured addresses of
              the system.

       -a socket
              Using this argument you can specify additional sockets from that
              rsyslogd  has  to  listen to.  This is needed if you’re going to
              let some daemon run within a chroot() environment.  You can  use
              up  to  19  additional  sockets.  If your environment needs even
              more, you have to increase the symbol MAXFUNIX within  the  sys-
              logd.c  source  file.   An  example  for  a  chroot()  daemon is
              described     by     the     people     from     OpenBSD      at
              http://www.psionic.com/papers/dns.html.

       -d     Turns  on  debug mode.  Using this the daemon will not proceed a
              fork(2) to set itself in the background, but  opposite  to  that
              stay  in  the foreground and write much debug information on the
              current tty.  See the DEBUGGING section for more information.

       -e     Set the default of $RepeatedMsgReduction config option to "off".
              Hine:  "e"  like  "every  message". For further information, see
              there.

       -f config file
              Specify an alternative configuration file instead of  /etc/rsys-
              log.conf, which is the default.

       -h     By  default  rsyslogd will not forward messages it receives from
              remote hosts.  Specifying this switch on the command  line  will
              cause  the log daemon to forward any remote messages it receives
              to forwarding hosts which have been defined.

       -i pid file
              Specify an alternative pid file  instead  of  the  default  one.
              This  option  must  be  used  if  multiple instances of rsyslogd
              should run on a single machine.

       -l hostlist
              Specify a hostname that should be logged only  with  its  simple
              hostname  and  not  the  fqdn.   Multiple hosts may be specified
              using the colon (‘‘:’’) separator.

       -m interval
              The rsyslogd logs  a  mark  timestamp  regularly.   The  default
              interval  between  two -- MARK -- lines is 20 minutes.  This can
              be changed with this option.  Setting the interval to zero turns
              it off entirely.

       -n     Avoid  auto-backgrounding.   This  is  needed  especially if the
              rsyslogd is started and controlled by init(8).

       -o     Omit reading the standard local log socket. This option is  most
              useful  for  running  multiple instances of rsyslogd on a single
              machine. When specified, no local log socket is opened at all.

       -p socket
              You can specify an alternative unix  domain  socket  instead  of
              /dev/log.

       -r ["port"]
              Activates  the  syslog/udp  listener  service. The listener will
              listen to the specified port.  If no port  is  specified,  0  is
              used  as port number, which in turn will lead to a lookup of the
              system default syslog port. If there is no system  default,  514
              is  used.  Please note that the port must immediately follow the
              -r option. Thus "-r514" is valid while "-r 514" is invalid (note
              the space).

       -s domainlist
              Specify a domainname that should be stripped off before logging.
              Multiple domains may be specified using the colon (‘‘:’’)  sepa-
              rator.   Please  be advised that no sub-domains may be specified
              but only entire domains.  For example if -s north.de  is  speci-
              fied  and the host logging resolves to satu.infodrom.north.de no
              domain would be cut, you will have to specify two domains  like:
              -s north.de:infodrom.north.de.

       -t port,max-nbr-of-sessions
              Activates  the  syslog/tcp  listener  service. The listener will
              listen to the specified port. If max-nbr-of-sessions  is  speci-
              fied,  that  becomes  the  maximum number of concurrent tcp ses-
              sions. If not specified, the default is 200.  Please  note  that
              syslog/tcp  is not standardized, but the implementation in rsys-
              logd follows common practice and is compatible with  e.g.  Cisco
              PIX,  syslog-ng and MonitorWare (Windows).  Please note that the
              port must immediately follow the  -t  option.  Thus  "-t514"  is
              valid while "-t 514" is invalid (note the space).

       -v     Print version and exit.

       -w     Supress  warnings  issued  when  messages are received from non-
              authorized machines (those, that are in no AllowedSender  list).

       -x     Disable DNS for remote messages.


SIGNALS
       Rsyslogd  reacts  to a set of signals.  You may easily send a signal to
       rsyslogd using the following:

              kill -SIGNAL ‘cat /var/run/rsyslogd.pid‘


       SIGHUP This lets rsyslogd perform a re-initialization.  All open  files
              are  closed,  the  configuration  file  (default  is  /etc/rsys-
              log.conf) will be reread and the rsyslog(3) facility is  started
              again.

       SIGTERM
              Rsyslogd will die.

       SIGINT, SIGQUIT
              If  debugging  is  enabled these are ignored, otherwise rsyslogd
              will die.

       SIGUSR1
              Switch debugging on/off.  This option can only be used if  rsys-
              logd is started with the -d debug option.

       SIGCHLD
              Wait for childs if some were born, because of wall’ing messages.


SUPPORT FOR REMOTE LOGGING
       Rsyslogd provides network support to  the  syslogd  facility.   Network
       support  means  that  messages  can  be forwarded from one node running
       rsyslogd to another node  running  rsyslogd  (or  a  compatible  syslog
       implementation) where they will be actually logged to a disk file.

       To  enable  this  you have to specify either the -r or -t option on the
       command line.  The default behavior is that rsyslogd  won’t  listen  to
       the  network.  You can also combine these two options if you want rsys-
       logd to listen to both TCP and UDP messages.

       The strategy is to have rsyslogd listen on a  unix  domain  socket  for
       locally  generated  log messages.  This behavior will allow rsyslogd to
       inter-operate with the syslog found in the standard C library.  At  the
       same  time  rsyslogd  listens  on the standard syslog port for messages
       forwarded from other hosts.  To  have  this  work  correctly  the  ser-
       vices(5) files (typically found in /etc) must have the following entry:

                   syslog          514/udp

       If this entry is missing rsyslogd will use the well known port  of  514
       (so in most cases, it’s not really needed).

       To  cause  messages  to be forwarded to another host replace the normal
       file line in the rsyslog.conf file with the name of the host  to  which
       the  messages  is  to be sent prepended with an @ (for UDP delivery) or
       the sequence @@ (for TCP delivery). The host name can also be  followed
       by  a colon and a port number, in which case the message is sent to the
       specified port on the remote host.

              For example, to forward ALL messages to a remote  host  use  the
              following rsyslog.conf entry:

                   # Sample rsyslogd configuration file to
                   # messages to a remote host forward all.
                   *.*            @hostname
              More samples can be found in sample.conf.

              If  the  remote  hostname cannot be resolved at startup, because
              the name-server might not be accessible (it may be started after
              rsyslogd)  you  don’t  have  to  worry.   Rsyslogd will retry to
              resolve the name ten times and then complain.  Another possibil-
              ity to avoid this is to place the hostname in /etc/hosts.

              With  normal syslogds you would get syslog-loops if you send out
              messages that were received from a remote host to the same  host
              (or  more  complicated to a third host that sends it back to the
              first one, and so on).

              To avoid this no messages that were received from a remote  host
              are  sent out to another (or the same) remote host. You can dis-
              able this feature by the -h option.

              If the remote host is located in the same domain  as  the  host,
              rsyslogd  is running on, only the simple hostname will be logged
              instead of the whole fqdn.

              In a local network you may provide a central log server to  have
              all  the important information kept on one machine.  If the net-
              work consists of different domains you don’t  have  to  complain
              about logging fully qualified names instead of simple hostnames.
              You may want to use the strip-domain feature -s of this  server.
              You  can  tell  rsyslogd to strip off several domains other than
              the one the server is located in and only log simple  hostnames.

              Using  the -l option there’s also a possibility to define single
              hosts as local machines.  This, too,  results  in  logging  only
              their simple hostnames and not the fqdns.


OUTPUT TO DATABASES
       Rsyslogd  has  support  for  writing data to MySQL database tables. The
       exact specifics are described in the rsyslog.conf (5) man page. Be sure
       to read it if you plan to use database logging.

       While  it  is  often  handy to have the data in a database, you must be
       aware of the implications. Most importantly, database logging takes far
       longer  than  logging  to a text file. A system that can handle a large
       log volume when writing to text files can most likely not handle a sim-
       ilar large volume when writing to a database table.


OUTPUT TO NAMED PIPES (FIFOs)
       Rsyslogd has support for logging output to named pipes (fifos).  A fifo
       or named pipe can be used as a destination for log messages by prepend-
       ing  a  pipy symbol (‘‘|’’) to the name of the file.  This is handy for
       debugging.  Note that the fifo must be created with the mkfifo  command
       before rsyslogd is started.

              The  following configuration file routes debug messages from the
              kernel to a fifo:

                   # Sample configuration to route kernel debugging
                   # messages ONLY to /usr/adm/debug which is a
                   # named pipe.
                   kern.=debug              |/usr/adm/debug


INSTALLATION CONCERNS
       There is probably one important consideration when installing rsyslogd.
       It  is  dependent  on proper formatting of messages by the syslog func-
       tion.  The functioning of the syslog function in the  shared  libraries
       changed  somewhere  in  the  region of libc.so.4.[2-4].n.  The specific
       change was to null-terminate the message before transmitting it to  the
       /dev/log  socket.   Proper  functioning  of this version of rsyslogd is
       dependent on null-termination of the message.

       This problem will typically manifest itself if  old  statically  linked
       binaries  are being used on the system.  Binaries using old versions of
       the syslog function will cause empty lines to be logged followed by the
       message  with  the  first  character in the message removed.  Relinking
       these binaries to newer versions of the shared libraries  will  correct
       this problem.

       The  rsyslogd(8) can be run from init(8) or started as part of the rc.*
       sequence.  If it is started from init the option -n must be set, other-
       wise  you’ll  get  tons  of  syslog  daemons  started.  This is because
       init(8) depends on the process ID.


SECURITY THREATS
       There is the potential for the rsyslogd daemon to be used as a  conduit
       for a denial of service attack.  A rogue program(mer) could very easily
       flood the rsyslogd daemon with syslog messages  resulting  in  the  log
       files  consuming all the remaining space on the filesystem.  Activating
       logging over the inet domain sockets will of course expose a system  to
       risks outside of programs or individuals on the local machine.

       There are a number of methods of protecting a machine:

       1.     Implement  kernel  firewalling  to limit which hosts or networks
              have access to the 514/UDP socket.

       2.     Logging can be directed to an isolated  or  non-root  filesystem
              which, if filled, will not impair the machine.

       3.     The ext2 filesystem can be used which can be configured to limit
              a certain percentage of a filesystem  to  usage  by  root  only.
              NOTE  that  this  will  require rsyslogd to be run as a non-root
              process.  ALSO NOTE that this will prevent usage of remote  log-
              ging  since  rsyslogd  will  be  unable  to  bind to the 514/UDP
              socket.

       4.     Disabling inet domain sockets  will  limit  risk  to  the  local
              machine.

       5.     Use step 4 and if the problem persists and is not secondary to a
              rogue program/daemon get a 3.5 ft (approx. 1  meter)  length  of
              sucker rod* and have a chat with the user in question.

              Sucker  rod  def.  —  3/4,  7/8 or 1in. hardened steel rod, male
              threaded on each end.  Primary use in the oil industry in  West-
              ern North Dakota and other locations to pump ’suck’ oil from oil
              wells.  Secondary uses are for the construction of  cattle  feed
              lots  and  for  dealing with the occasional recalcitrant or bel-
              ligerent individual.

   Message replay and spoofing
       If remote logging is  enabled,  messages  can  easily  be  spoofed  and
       replayed.   As  the messages are transmitted in clear-text, an attacker
       might use the information  obtained  from  the  packets  for  malicious
       things.  Also,  an  attacker  might  reply recorded messages or spoof a
       sender’s IP address, which could lead to a wrong perception  of  system
       activity.  Be  sure  to  think  about  syslog  network  security before
       enabling it.


DEBUGGING
       When debugging is turned on using -d option then rsyslogd will be  very
       verbose  by  writing much of what it does on stdout.  Whenever the con-
       figuration file is reread and re-parsed you’ll see  a  tabular,  corre-
       sponding to the internal data structure.  This tabular consists of four
       fields:

       number This field contains a serial number starting by zero.  This num-
              ber represents the position in the internal data structure (i.e.
              the array).  If one number is left out then there  might  be  an
              error in the corresponding line in /etc/rsyslog.conf.

       pattern
              This  field  is  tricky  and  represents  the internal structure
              exactly.  Every column stands for  a  facility  (refer  to  sys-
              log(3)).   As  you can see, there are still some facilities left
              free for former use, only the left most are used.   Every  field
              in a column represents the priorities (refer to syslog(3)).

       action This  field  describes  the  particular  action that takes place
              whenever a message is received that matches the pattern.   Refer
              to the syslog.conf(5) manpage for all possible actions.

       arguments
              This field shows additional arguments to the actions in the last
              field.  For file-logging this is the filename for  the  logfile;
              for  user-logging  this  is  a list of users; for remote logging
              this is the hostname of the machine to log to; for  console-log-
              ging this is the used console; for tty-logging this is the spec-
              ified tty; wall has no additional arguments.


          templates
              There will also be a second internal structure which  lists  all
              defined  templates  and there contents. This also enables you to
              see the internally-defined, hardcoded templates.

FILES
       /etc/rsyslog.conf
              Configuration file for rsyslogd.  See rsyslog.conf(5) for  exact
              information.
       /dev/log
              The  Unix  domain socket to from where local syslog messages are
              read.
       /var/run/rsyslogd.pid
              The file containing the process id of rsyslogd.

BUGS
       Please review the file BUGS for up-to-date information  on  known  bugs
       and annoyances.

Further Information
       Please  visit  http://www.rsyslog.com/doc  for  additional information,
       tutorials and a support forum.

SEE ALSO
       rsyslog.conf(5),   logger(1),   syslog(2),   syslog(3),    services(5),
       savelog(8)


COLLABORATORS
       rsyslogd is derived from sysklogd sources, which in turn was taken from
       the BSD sources. Special thanks  to  Greg  Wettstein  (greg@wind.enjel-
       lic.com) and Martin Schulze (joey@linux.de) for the fine sysklogd pack-
       age.

       Rainer Gerhards
       Adiscon GmbH
       Grossrinderfeld, Germany
       rgerhards@adiscon.com

       Michael Meckelein
       Adiscon GmbH
       mmeckelein@adiscon.com



Version 1.16.1 (devel)           17 July 2007                      RSYSLOGD(8)