Syslog

Sources:

• RSyslog Documentation
• How to Configure Remote Logging with Rsyslog on Ubuntu 18.04

This notes are intended for Ubuntu 18.04!

Install and Configure Rsyslog Server

dpkg -l | grep rsyslogd
apt-get update && apt-get install rsyslog

systemctl start rsyslog
systemctl enable rsyslog
systemctl status rsyslog

Check rsyslog version (v7 vs. v8!):

rsyslogd -v

General configuration

#
# /etc/rsyslog.conf
#

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" …

Modern Linux Systems have a mechanism called logrotate to rotate different log files.

The general configuration file is located under /etc/logrotate.conf and specific changes are under /etc/logrotate.d/

By default the logrotate job is started once a day by a O/S cron.daily job: /etc/cron.daily/logrotate

Because the default log rotation configuration does not exactly what I want I have adapted it a bit:

First I need a database user for log rotation:

CREATE USER 'logrotate'@'localhost' IDENTIFIED BY 'secret'; …

Problem

A customer recently showed up with the following problem:

*With your guidelines
[ 1
] I am now able to send the MySQL error log to the syslog and in particular to an external log server.
But I cannot see which user connects to the database in the error log.

How can I achieve this?*

Idea

During night when I slept my brain worked independently on this problem and in the morning he had prepared a possible solution for it.

What came out is the following:

• We create an UDF which allows an application to …

There are 2 different possible situations you can face when you have to deal with MySQL and syslog:

• MySQL is used as back-end for syslog to store the logging information.
  [ 6
  ]
• MySQL itself should report to the syslog.

In this blog article we look at the second situation: How can you make MySQL reporting to the syslog.

Since the version 5.1.20 MySQL is capable to log to the syslog
[ 1
],
[ 2
]. This is done by the MySQL angel process mysqld_safe.

You can enable the syslog when you add the syslog parameter …