Graylog accepts remote syslog messages only if i manually set the protocol/format to RSYSLOG_SyslogProtocol23Format.

To do this you currently need to:

• activate the Remote Syslog Server in the Settings GUI
• Login via ssh as root and edit /etc/rsyslog.conf, add ";RSYSLOG_SyslogProtocol23Format" to the end of the syslog line

  *.* @@YOUR_REMOTE_SERVER_IP:514;RSYSLOG_SyslogProtocol23Format

• Change something in the WEBUI again (not touching the remote syslog options) to reload the rsyslog service

 

After editing the config like this the GUI Options for the Remote syslog server seem to no longer have an effect.

 

Can you add a dropdown for the rsyslog format template options?

Edited December 2, 20196 yr by ap-wtioit

I think, that this is not only a valid (and unanswered) question but also a valuable "enhancement request". Not only for Graylog use case ...

from me: +1

 

Because rsyslog config via GUI is very rudimentary, an option to use a custom rsyslog.conf could be helpful.

Is there a recommendation to tune rsyslog via snippets in /etc/rsyslog.d/*.conf

 

Best regards

Oliver

+1 from me as well.

I'm in agreement a better solution is needed than the current web GUI but given the absolute plethora of possibilities would it not be simpler/better to formally allow publishing an overridge file into /etc/rsyslog.d/, showing this in the web page and storing the file on the USB drive?

 

I've had to hack rsyslog for the couple of changes I needed, whilst its simple enough I'm clearly concerned about whether the config will preserve through upgrades but mainly whether I'll remember when the inevitable happens and I need to tshoot a years old fix.

So I just found my custom rsyslog changes had reset recently and then scratched my head for a little while to try and remember my hack again to get it working with Loki/Grafana.  Anyway on my short little trek I found https://github.com/unraid/webgui/pull/1486 which is a PR for the fix I suggested but which was actually merged into the master branch of unraid in Nov 2023!

 

Sharing because there does seem to be some light in the tunnel, just not sure when its going to reach the end.