rsyslog, syslog-ng, and traditional syslog

rsyslog is the canonical syslog implementation on most Linux distributions. Even on systemd hosts, rsyslog coexists with journald — either as a parallel store or as the forwarder from journald to a SIEM.

The rsyslog flow

flowchart LR
  A[Application or service]
  S[Syslog socket /dev/log]
  R[rsyslogd]
  F1[/var/log/auth.log/]
  F2[/var/log/syslog/]
  F3[/var/log/kern.log/]
  SI[SIEM / remote]

  A --> S --> R --> F1
  R --> F2
  R --> F3
  R --> SI

Every program that writes a syslog message sends it to /dev/log (the syslog socket). rsyslogd reads from this socket and applies its configuration rules to route the message to one or more destinations: a local file, a remote syslog server, or both.

Reading rsyslog configuration

$ cat /etc/rsyslog.conf | head -30

module(load="imuxsock")
module(load="imjournal")
...
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;auth.none,authpriv.none   /var/log/syslog

# The authpriv file has restricted access.
authpriv.*                        /var/log/secure

# Log cron stuff
cron.*                            /var/log/cron

# Everybody gets emergency messages
*.emerg                          :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                    /var/log/spooler
...

Selector syntax

A selector is facility.priority. Common facilities:

Priorities (low to high): debug, info, notice, warning, warn, err, error, crit, alert, emerg, panic. err and error are synonyms; same for warn/warning, emerg/panic.

$ logger -p auth.warning -t myapp test-message; tail -1 /var/log/auth.log

Aug  9 12:00:01 host myapp: test message

Forwarding to a remote syslog

$ cat /etc/rsyslog.d/30-remote.conf

# Forward all messages to a remote syslog over TLS
action(type=omfwd
target=siem.example.com
port=6514
protocol=tls
template=RSYSLOG_SyslogProtocol23Format
queue.type=LinkedList
queue.filename=siem_queue
queue.maxdiskspace=1g
action.resumeRetryCount=-1)

When to use rsyslog

$ rsyslogd -N1; systemctl status rsyslog

rsyslogd: version 8.2406, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since ...

journald → rsyslog bridge

On modern systemd hosts, rsyslog reads from journald via the imjournal module. The flow:

flowchart LR
  APP[Application]
  J[journald]
  R[rsyslog]
  F[/var/log/]
  SI[SIEM]

  APP -->|stdout/stderr| J
  APP -->|syslog /dev/log| R
  J -->|imjournal| R
  R --> F
  R --> SI

This means every message in the journal can also appear in rsyslog’s text logs. To verify:

journalctl -u sshd -n 1 --no-pager
tail -1 /var/log/auth.log

The same message appears in both places. rsyslog uses the SYSLOG_IDENTIFIER field from the journal entry as the tag.

Knowledge check