rsyslog — system logs

Q: The log isn't being written

Is the service active (systemctl status rsyslog)? Any typo in the rule? Check with rsyslogd -N1 (syntax) and logger -p auth.info "test" (does it arrive).

Q: Logs grow and fill the disk

Rotation is logrotate's job (rsyslog never cleans up on its own). Check /etc/logrotate.d/rsyslog and see disk-usage.

Q: Logs aren't arriving at the central server

Is the input module enabled on the receiver (imtcp/imudp, port 514) and the port open (firewall, nc -zv host 514)? On the sender — the @@host:514 rule.

Q: Duplicate lines / "logged twice"

journald forwards to rsyslog (imjournal) and the same facility gets written to several files. Clarify the rules; decide what goes where (journalctl -u vs text files).

Q: journald vs rsyslog — where to look

Structured search by service — journalctl (-u, _COMM=); familiar text files and forwarding — /var/log/* (rsyslog).

4 min Ubuntu 24.04 · rsyslog

Writes text logs to /var/log and forwards them over the network; it does not rotate them itself, that's logrotate's job.

Cheat sheet

5 commands Printable version

tail -f /var/log/syslog general system log in real time
tail -f /var/log/auth.log logins, sudo, ssh in real time
sudo rsyslogd -N1 check the config syntax
logger -p auth.info "msg" write a test entry to syslog
sudo systemctl restart rsyslog apply config changes

Overview

rsyslog writes classic text logs to /var/log (syslog, auth.log, mail.log). It works alongside journald: journald is a structured journal, rsyslog is text files and forwarding logs over the network to a central server.

bash

ls /var/log/                      # syslog, auth.log, kern.log, ...
tail -f /var/log/syslog           # the general system log
tail -f /var/log/auth.log         # logins/sudo/ssh (see fail2ban)

Options

Rules live in /etc/rsyslog.conf and /etc/rsyslog.d/*.conf. Format is facility.severity destination:

auth,authpriv.*     /var/log/auth.log
mail.*              -/var/log/mail.log     # "-" = skip fsync on every line
*.emerg             :omusrmsg:*            # to every terminal
:programname, isequal, "myapp"  /var/log/myapp.log   # property filter by program name
# forward to a remote server:
*.*                 @@logserver.example.com:514   # @@ = TCP, @ = UDP

facility: auth, cron, daemon, kern, mail, local0..7; severity: debug<info<notice<warning<err<crit<alert<emerg.

bash

sudo rsyslogd -N1                 # check the config syntax
sudo systemctl restart rsyslog
logger -p auth.info "test"        # send a test entry to syslog

Recipes

Centralization and rate limiting

Receiver (central log server) — enable the input module:

# /etc/rsyslog.d/10-server.conf
module(load="imtcp")
input(type="imtcp" port="514")
# split by host:
template(name="perhost" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
*.* ?perhost

Open port 514 in the firewall. On the sender — *.* @@logserver:514. Flood protection — $imjournalRatelimitInterval/RatelimitBurst (otherwise a noisy service floods the log).

Troubleshooting

The log isn't being written

Is the service active (systemctl status rsyslog)? Any typo in the rule? Check with rsyslogd -N1 (syntax) and logger -p auth.info "test" (does it arrive).

Logs grow and fill the disk

Rotation is logrotate's job (rsyslog never cleans up on its own). Check /etc/logrotate.d/rsyslog and see disk-usage.

Logs aren't arriving at the central server

Is the input module enabled on the receiver (imtcp/imudp, port 514) and the port open (firewall, nc -zv host 514)? On the sender — the @@host:514 rule.

Duplicate lines / "logged twice"

journald forwards to rsyslog (imjournal) and the same facility gets written to several files. Clarify the rules; decide what goes where (journalctl -u vs text files).

journald vs rsyslog — where to look

Structured search by service — journalctl (-u, _COMM=); familiar text files and forwarding — /var/log/* (rsyslog).