rsyslogd

rsyslogd [-d] [-n] [-f config_file] [-i pid_file] [-c level] [-v] [-N level] [-D]

-d
    Run in debug mode.
This is intended for debugging rsyslogd itself and should not be used in production environments.

-n
    Run in foreground mode.
Prevents rsyslogd from detaching from the terminal.

-f config_file
    Specify an alternate configuration file.
The default configuration file is /etc/rsyslog.conf.

-i pid_file
    Specify an alternate PID file.
The default PID file is /var/run/rsyslogd.pid.

-c level
    Compatibility mode level.
Used for older configurations.

-v
    Display version information and exit.

-N level
    Test configuration and exit.
Level specifies the level of testing.

-D
    Run in dry-run mode.
Parses config but takes no action

rsyslogd is the system logger, providing an enhanced, multi-threaded implementation of syslogd. It supports a wide range of input and output modules, allowing it to collect logs from various sources and write them to diverse destinations. It can receive logs from local system processes, other machines over the network (using TCP, UDP, RELP, etc.), and even from databases. rsyslogd offers advanced filtering capabilities, enabling you to selectively process and route log messages based on criteria like facility, severity, and message content. Its configuration is managed through a powerful configuration file, usually located at /etc/rsyslog.conf or /etc/rsyslog.d/. This file dictates how logs are processed, where they are stored (e.g., local files, remote servers, databases), and what actions are taken on specific log events. rsyslogd is designed for high performance and reliability, making it suitable for demanding logging environments. It is a crucial component for system administration, security auditing, and troubleshooting. Its modular architecture allows for easy extension and customization to meet specific logging requirements.

rsyslogd relies heavily on its configuration file. Incorrect configuration can lead to lost logs or security vulnerabilities.
Care must be taken when configuring network logging to avoid potential security risks, such as spoofing or denial-of-service attacks.

The configuration file typically consists of modules, global directives, rulesets, and templates.
Modules define input and output methods.
Global directives configure general rsyslogd behavior.
Rulesets specify how messages are processed based on filters and actions.
Templates define the format of log messages.

Secure communication channels (e.g., TLS/SSL) should be used when forwarding logs over the network.
Access to log files should be restricted to authorized personnel only.
Regularly review and update the rsyslogd configuration to address potential security vulnerabilities.

rsyslogd is a modern evolution of the traditional syslogd, initially developed as a drop-in replacement with performance enhancements.
It has evolved significantly over time, adding support for various input and output modules, advanced filtering, and a more flexible configuration format.
The project aims to provide a robust and extensible logging solution for Linux and other Unix-like systems.
Key milestones include the introduction of RELP protocol support, database output capabilities, and advanced filtering features.

logger(1), syslog(3), journalctl(1)