Getting Data In

syslog differences between centos5 and 6

infinitiguy
Path Finder

Hi everyone,
I'm noticing that my centos 6 (rsyslog) hosts are showing up different in splunk compared to my cent5 (syslog) hosts.

cent6:
Feb 13 17:22:15 rsyslog6client.domain.com Feb 13 17:22:15 rsyslog6client sshd[30586]: pam_unix(sshd:session): session closed for user dmurphy

cent5: 
Feb 13 17:22:21 syslog5client.domain.com sshd[13812]: pam_unix(sshd:session): session closed for user dmurphy

Notice the double timestamp and host on the cent6 box. Any ideas what might be causing that? Not sure if it's syslog adding it, or splunk adding stuff when parsing.

Tags (1)

ananyaulikkar
New Member
0 Karma

infinitiguy
Path Finder

hrm - not so sure that is it. I just tried every format listed on that page - except for debug, and the timestamps never changed in splunk - still getting the duplicates.

0 Karma

infinitiguy
Path Finder

Is it possible that rsyslog is sending stuff over in a way that splunk doesn't know how it should be tagged so it's not doing any stripping? Doesn't seem right because both are appearing under sourcetype=syslog.

0 Karma

Linegod
Path Finder

And did you check the raw output from rsyslog, after you restarted it, to ensure it had only the one timestamp?

0 Karma

infinitiguy
Path Finder

spot on.
So now the question is, which format do I want? I'm thinking either RSYSLOG_FileFormat or RSYSLOG_ForwardFormat? Do you know which will give me entries similar to the below in splunk?

Feb 13 17:22:21 syslog5client.domain.com sshd[13812]: pam_unix(sshd:session): session closed for user dmurphy

0 Karma

Linegod
Path Finder

Rsyslog replaced syslog in Cent OS 6.

Odds are, it is configured to use RSYSLOG_TraditionalFileFormat

http://www.rsyslog.com/doc/rsyslog_conf_templates.html

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...