rsyslog: how to debug rsyslog.conf problems?

Trying to debug rsyslog.conf issues? This can be hard. Learn here why, and how you can avoid problems. Did you know? Upon startup, rsyslog reads its config file, usually located in /etc/rsyslog.conf. While doing so, it can include config snippets usually located in /etc/rsyslog.d. But no matter if given directly inside the rsyslog.conf, or inside a snippet, the overall config is just a single text document made up of the main config file and the snippets. This is important to note when debugging rsyslog problems.

Some Distributions (here: Ubuntu) and users split the rsyslog.conf file in too many snippets. This often causes hard-to-debug problems. (Screenshot: Rainer Gerhards)
Continue reading “rsyslog: how to debug rsyslog.conf problems?”

First Syslog Open Online Meeting a Success

Yesterday, we held the first open meeting for the (r)syslog community. It was announced on very short notice, but we still had more than 10 participants. Even more important, we had some great discussions. So I call the concept a “success” and plan for more to come.

For everyone who could not attend, here is the meeting recording:

Please accept YouTube cookies to play this video. By accepting you will be accessing content from YouTube, a service provided by an external third party.

YouTube privacy policy

If you accept this notice, your choice will be saved and the page will refresh.

Continue reading “First Syslog Open Online Meeting a Success”

Experiment: an open online meeting for rsyslog folks

I am thinking quite a while about doing online seminars or meetings for folks interested in rsyslog. After some prep work, I decided to do an experiment and invite all of you to the rsyslog community’s first open online meeting. It will be held at 2020-09-29 at 3p UTC (5p CEST, 11a EDT, 8a PDT). The meeting URL is Meeting language is English.

Foto of Rainer Gerhards preparing a Video Conference
Rainer Gerhards preparing a Video Conference.

This is more than a community experiment. I have worked on setting up a decent self-hosted Jitsi Meet server (some background info in German). The meeting is also meant as one of the first test runs for this system. So it definitely helps if you are a bit adventurous when you attend.

Continue reading “Experiment: an open online meeting for rsyslog folks”

Corona: Vacation Season Effect on Infections (Germany)

Do you wonder if traveling and vacation season has some effect on Corona spread? German numbers suggest it has – and it can be seen in new cases.

German Corona Infections for three fedaral states.
New Corona Infections (7 day incidence) of three German federal states. The red lines show a state with early school holidays, whereas the blue and green plot show two states where summer break is late. (Plot: Rainer Gerhards, Data: RKI)
Continue reading “Corona: Vacation Season Effect on Infections (Germany)”

rsyslog 8.2008 released – packages delayed

While we have released rsyslog 8.2008 today, binary packages are not yet updated. They will follow follow “a bit” later.

Image of rsyslog being build via SUSE OBS
A rsyslog build via SUSE Open Build Service. This time the rsyslog package build process is delayed due to problems with upgrades to the package build process. (Image: Rainer Gerhards)

The rsyslog project usually publishes binary packages for many distributions alongside the regular (source) scheduled stable releases. So far, this was a mostly manual process. In the past couple of week, we have worked on a CI system for package build as well as additional automation. We have not yet fully reached our goals, but things look pretty well.

Continue reading “rsyslog 8.2008 released – packages delayed”

LIBRELP 1.7.0 release upcoming

Librelp 1.7 brings some memory leaks fixes, support for chained certificate files and a bit more. The official release is tomorrow. It will be co-released with rsyslog 8.2008.

Librelp Logo Image
LIBRELP is a library for reliable network event logging. (Image: Rainer Gerhards)

The memory leak is especially relevant for some load-balancers, including AWS. I highly recommend to use the new library in such environments. As a side-note, we have also finally done some library symbol cleanups. If you used non-API functions that will hurt you. However, to the best of my knowledge nobody does such dirty tricks.

Adiscon will also integrate the new librelp in to it’s Windows products (including WinSyslog and EventReporter)


Librelp is library for reliable network event logging, It provides syslog-like functionality with a drastically reduced risk of messages loss. Note that industry-standard TCP syslog is unreliable by design. Librelp was written to address these shortcomings.

Rainer Gerhards initiated the librelp open source project. It is primarily sponsored by Adiscon.

SEO: Getting into Google News – no longer Possible?

Many publishers love to get into the Google News index – it offers an extra source of traffic and can really boost a site. Unfortunately, getting into News is not as easy as it looks.

A Picture of Google News
Google News: many publisher would like use this as a source of extra traffic. However, the site must fit and offer journalistic content. (Screenshot done by Rainer Gerhards on 2020-08-10)
Continue reading “SEO: Getting into Google News – no longer Possible?”

rsyslog: integrating Windows Event Log (via UDP)

This tutorial tells how to integrate data from Windows event log into our rsyslog configuration. We will do this integration via the UDP syslog protocol so that we finally can show this in a real case. No advanced topics are covered. We use CentOS 7 and Windows Server 2012 (because it still is in more widespread use). This is part of a rsyslog tutorial series.

Continue reading “rsyslog: integrating Windows Event Log (via UDP)”