Syslog

Last edited September 9, 2026

Note
syslog is a protocol and concept for how to structure log messages and transport them.
rsyslog (rocket-fast syslog) is a specific implementation and is default syslog daemon on most Linux distros.

Before syslog was defined every program was free to make up its own logging policy.

Think about log messages as a stream of events and rsyslog as an event-stream processing engine. Log message “events” are submitted as inputs, processed by filters and forwarded to output destinations (files, terminals, other machines).

The rsyslogd process typically starts at boot and runs continuously.
Programs that are syslog aware write log entries to the special file /dev/log, a UNIX domain socket.

`rsyslog` configuration test

My example system ubuntu 24 has supplant the rsyslogd socket with a symlink to systemd’s journald, to centralize logging, ingestion and storage.
```
$ ls -l /dev/log
lrwxrwxrwx 1 root root 28 May 26 08:23 /dev/log -> /run/systemd/journal/dev-log
$ ls -l /run/systemd/journal/dev-log 
srw-rw-rw- 1 root root 0 May 26 08:23 /run/systemd/journal/dev-log
```
Checking the systemd status of the service it is running - rsyslogd continues to run as a daemon for additional filtering and processing.

Let’s check what rsyslogd is doing, no freeloaders!

#/etc/rsyslog.conf

# global  configs are here..... 
# .....[snip].....
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

As expected rsyslog is pointing to a folder of configs /etc/rsyslog.d/*.conf

#/etc/rsyslog.d/50-default.conf

# Looking at this first rule, filting the facility (source) field that matches auth
# or authpriv* and it's forwarding to the file /var/log/auth.log
auth,authpriv.*                 /var/log/auth.log

So it is doing something!

Let’s try making a change

sudo vim /etc/rsyslog.d/50-default.conf

# Let's forward the logs syslog filters to a different path
auth,authpriv.*                 /var/log/spongebob.log

# Reload rsyslog's config
sudo systemctl restart rsyslog

# And boom!
$ cat /var/log/spongebob.log 
2026-06-04T21:15:59.529208-04:00 k3s sudo: pam_unix(sudo:session): session closed for user root
2026-06-04T21:16:03.960824-04:00 k3s sshd[1118358]: Received disconnect from 192.168.2.11 port 60762:11: disconnected by user
2026-06-04T21:16:03.960992-04:00 k3s sshd[1118358]: Disconnected from user mat 192.168.2.11 port 60762

`rsyslog` configurations

Formats

Rsyslog has 3 syntaxes

# sysklogd format (original/simplest), implicit:
auth,authpriv.*                 /var/log/auth.log

# RainerScript (modern), explicit
auth,authpriv.* action(type="omfile" file="/var/log/auth.log")

# Legacy rsyslog directives ($ syntax)
# Primarily for global config and module loading not filter/action rules

Modules

modules are written C, they parse and can mutate messages
modules follow the naming convention:
- im* input modules
- om* output modules
- mm* message modifiers

Examples of modules are:

imjournal systemd journal
imfile converts a plain text file to syslog format
imtcp & imudp accept messages over tcp and udp, useful
immark module produces timestamp messages at regular intervals, this can help you figure out that your machine crashed between random hours not just “some time last night”
omfile write messages to a file, most commonly used
omfwd forwards message to a remote syslog server (tcp/udp) used for centralized logging
ommysql send messages to a MySQL database

Config Examples

Simple

This reads from a log file and stores to another log file, contrived by a good sanity test before sending elsewhere.

# /etc/rsyslog.d/55-kubeview.conf  
module(load="imfile" mode="inotify")
input(
    type="imfile"
    Tag="kubeview"
    File="/var/log/kubeview.log"
    Severity="info"
)
if $programname startswith "kubeview" then {
  action(type="omfile" file="/var/log/kubeview-out.log")
}

TODO: send to a central server

https://docs.rsyslog.com/doc/configuration/modules/idx_output.html

Rsyslog TLS

Rsyslog can send and receive log messages over TLS on port 6514.

Edit this page