topic Re: syslog differences between centos5 and 6 in Getting Data In

syslog differences between centos5 and 6

infinitiguy — Mon, 13 Feb 2012 22:31:21 GMT

Hi everyone,
I'm noticing that my centos 6 (rsyslog) hosts are showing up different in splunk compared to my cent5 (syslog) hosts.

cent6:
Feb 13 17:22:15 rsyslog6client.domain.com Feb 13 17:22:15 rsyslog6client sshd[30586]: pam_unix(sshd:session): session closed for user dmurphy

cent5: 
Feb 13 17:22:21 syslog5client.domain.com sshd[13812]: pam_unix(sshd:session): session closed for user dmurphy

Notice the double timestamp and host on the cent6 box. Any ideas what might be causing that? Not sure if it's syslog adding it, or splunk adding stuff when parsing.

Re: syslog differences between centos5 and 6

Linegod — Mon, 28 Sep 2020 11:23:58 GMT

Rsyslog replaced syslog in Cent OS 6.

Odds are, it is configured to use RSYSLOG_TraditionalFileFormat

http://www.rsyslog.com/doc/rsyslog_conf_templates.html

Re: syslog differences between centos5 and 6

infinitiguy — Mon, 28 Sep 2020 11:24:02 GMT

spot on.
So now the question is, which format do I want? I'm thinking either RSYSLOG_FileFormat or RSYSLOG_ForwardFormat? Do you know which will give me entries similar to the below in splunk?

Feb 13 17:22:21 syslog5client.domain.com sshd[13812]: pam_unix(sshd:session): session closed for user dmurphy

Re: syslog differences between centos5 and 6

infinitiguy — Tue, 14 Feb 2012 14:45:00 GMT

hrm - not so sure that is it. I just tried every format listed on that page - except for debug, and the timestamps never changed in splunk - still getting the duplicates.

Re: syslog differences between centos5 and 6

Linegod — Tue, 14 Feb 2012 22:44:51 GMT

And did you check the raw output from rsyslog, after you restarted it, to ensure it had only the one timestamp?

Re: syslog differences between centos5 and 6

infinitiguy — Wed, 15 Feb 2012 14:53:11 GMT

Is it possible that rsyslog is sending stuff over in a way that splunk doesn't know how it should be tagged so it's not doing any stripping? Doesn't seem right because both are appearing under sourcetype=syslog.

Re: syslog differences between centos5 and 6

ananyaulikkar — Thu, 07 Mar 2013 05:41:01 GMT

Check the blog for more details.

http://onlinedocs.info/setup-a-remote-syslog-server-in-centos-6/