Migrating from syslog to rsyslog on Linux

Introduction

Traditional syslog served Linux logging for decades, but it has limitations: no reliable transport, limited filtering, and no encryption. rsyslog is the modern replacement that is backward compatible with syslog configuration while adding powerful features like TCP transport, database logging, and complex filter rules. Migrating to rsyslog improves reliability and opens up advanced logging capabilities.

Environment

The examples migrate from sysklogd (traditional syslog) to rsyslog 8.2306.0 on Ubuntu 22.04 LTS. The system currently logs to local files with basic facility/priority configuration.

rsyslogd -v
# rsyslogd 8.2306.0, compiled with:
#     PLATFORM: x86_64-pc-linux-gnu

dpkg -l | grep syslog
# ii  sysklogd     2.0.3-2   Traditional logging daemon

Problem

The current syslog configuration in /etc/syslog.conf is minimal and has several issues:

cat /etc/syslog.conf
# *.err                        /var/log/errors
# kern.*                       /var/log/kern.log
# mail.*                       /var/log/mail.log
# *.*                          /var/log/messages

Issues:

All logs go to local files with no remote forwarding
No log rotation configuration
No filtering for noisy messages
No encryption for remote logging
No reliable transport (UDP only)

Analysis

rsyslog is a drop-in replacement for syslog. Key advantages:

Protocol support: UDP, TCP, and RELP (Reliable Event Logging Protocol)
Encryption: TLS support for secure remote logging
Filtering: Complex filter rules based on facility, priority, program name, and content
Output flexibility: Files, databases, remote servers, and message queues
Reliability: Queue-based buffering and disk-assisted queues

The rsyslog configuration format is compatible with syslog.conf but extended with additional directives.

Solution

1. Install rsyslog

# On systems with sysklogd
sudo apt-get install rsyslog

# On systemd-based systems, rsyslog is usually pre-installed
sudo systemctl status rsyslog

2. Basic rsyslog configuration

# /etc/rsyslog.conf
# Traditional file-based logging (compatible with syslog.conf)
*.err                        /var/log/errors
kern.*                       /var/log/kern.log
mail.*                       /var/log/mail.log
*.*;auth,authpriv.none       /var/log/messages

# Enhanced logging with timestamps
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Create directories for log files
$FileCreateMode 0640
$DirCreateMode 0755

3. Remote logging over TCP

# Client side (send logs to remote server)
# /etc/rsyslog.d/remote.conf
*.* @@logserver.example.com:514

# Or for UDP (less reliable)
# *.* @logserver.example.com:514

# Server side (receive logs)
# /etc/rsyslog.d/remote.conf
module(load="imudp")
module(load="imtcp")

input(type="imudp" port="514")
input(type="imtcp" port="514")

4. Reliable logging with RELP

# Install RELP module
sudo apt-get install rsyslog-relp

# Client side
module(load="imrelp")
action(type="omrelp" target="logserver.example.com" port="2514")

# Server side
module(load="imrelp")
input(type="imrelp" port="2514")

5. Advanced filtering

# /etc/rsyslog.d/filter.conf
# Log only high-priority messages
if $syslogseverity <= 4 then /var/log/critical.log

# Filter by program name
if $programname == 'sshd' then /var/log/ssh.log
& stop

# Filter by message content
if $msg contains 'error' then /var/log/errors-filtered.log

# Facility-based routing
if $syslogfacility == 'auth' then {
    action(type="omfile" file="/var/log/auth.log")
}

6. Structured logging with templates

# /etc/rsyslog.d/template.conf
# JSON template
template(name="json" type="list") {
    constant(value="{")
    constant(value="\"timestamp\":\"")     property(name="timereported" dateFormat="rfc3339")
    constant(value="\",\"host\":\"")       property(name="hostname")
    constant(value="\",\"program\":\"")    property(name="programname")
    constant(value="\",\"facility\":\"")   property(name="syslogfacility-text")
    constant(value="\",\"severity\":\"")   property(name="syslogseverity-text")
    constant(value="\",\"message\":\"")    property(name="msg" format="jsonf")
    constant(value="\"}\n")
}

# Use the template
*.* action(type="omfile" file="/var/log/structured.json" template="json")

7. Log rotation with rsyslog

# /etc/logrotate.d/rsyslog
/var/log/messages
/var/log/syslog
/var/log/auth.log
/var/log/kern.log
{
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    sharedscripts
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

8. Queue-based reliability

# /etc/rsyslog.d/queue.conf
# Disk-assisted queue for reliability
main_queue(
    queue.filename="forwardingqueue"
    queue.maxdiskspace="1g"
    queue.saveonshutdown="on"
    queue.type="LinkList"
)

*.* action(type="omfwd" target="logserver.example.com" port="514" protocol="tcp")

9. Test the configuration

# Validate configuration
sudo rsyslogd -N1
# rsyslogd: version 8.2306.0, config validation run...

# Generate test messages
logger -p local0.info "Test message from migration"

# Check logs
tail -f /var/log/messages

10. Migrate and switch

# Stop old syslog
sudo systemctl stop sysklogd
sudo systemctl disable sysklogd

# Start rsyslog
sudo systemctl start rsyslog
sudo systemctl enable rsyslog

# Verify logging works
sudo systemctl status rsyslog

Lessons Learned

Migrating from syslog to rsyslog is straightforward because of backward compatibility. Start with the existing syslog.conf format, then incrementally add rsyslog features like remote logging, filtering, and structured templates. Use RELP instead of TCP for critical logging where reliability matters. And always test configuration changes with rsyslogd -N1 before restarting the service.

This blog does not accept any external sponsorships, affiliate marketing, or ad revenue.