Topic: syslog
-
Forwarding syslog with rsyslog over TCP behind a disk-assisted queue
A drop-in file under /etc/rsyslog.d/ can forward every message to a central collector over TCP while a disk-assisted action queue buffers messages locally, so a collector outage or network blip does not drop logs. rsyslogd -N1 validates the syntax before the change is applied.
-
Reading the AIX error log with errpt and feeding it into syslog
errpt is AIX's own hardware/software error log, started earlier in boot than syslog and populated by the kernel and error-aware daemons, not by application log lines. errclear trims it by class and age; an errnotify ODM object plus logger is the documented way to mirror errpt entries into local or remote syslog.
-
Timestamped, parseable logs: RFC 5424 versus RFC 3164, JSON templates, and why UTC
RFC 5424's syslog TIMESTAMP is a restricted RFC 3339 profile with year, sub-second precision and a time zone offset, while the earlier RFC 3164 format has none of those and is harder to parse unambiguously. rsyslog can emit either, or a fully custom JSON structure, through templates — and a server whose time zone and logs are in UTC removes an entire class of correlation bugs across time zones.
-
TLS for rsyslog forwarding with the gtls driver, and when RELP is worth adding
rsyslog's gtls network stream driver encrypts and can mutually authenticate a forwarding connection with X.509 certificates, configured with StreamDriverAuthMode. Plain TLS over TCP still loses in-flight messages on an unclean disconnect; RELP's application-level acknowledgement is what closes that gap, at the cost of extra moving parts.
Machine-readable: JSON