Linux Log Management: rsyslog, logrotate & Centralized Logging Setup

SEO Metadata

SEO Title Options

1. Linux Log Management: rsyslog, logrotate & Centralized
2. Linux Log Management: rsyslog, logrotate: Practical 2026
3. Monitoring Playbook: Linux Log Management: rsyslog

Meta Description Options

1. Learn Linux Log Management: rsyslog, logrotate & Centralized Logging Setup with a practical Monitoring framework, expert mistakes, implementation steps.
2. Configures rsyslog for remote log forwarding, sets up logrotate policies, and introduces the ELK stack for centralized log aggregation.

URL Slug

linux-log-management-rsyslog-logrotate-centralized-logging-setup

Focus Keyword

Linux Log Management: rsyslog, logrotate & Centralized Logging Setup

Additional LSI Keywords

• Monitoring
• Linux
• Logging
• rsyslog
• logrotate
• ELK
• Linux Log Management: rsyslog, logrotate & Centralized Logging Setup
• production checklist
• implementation guide
• best practices
• architecture decisions
• testing strategy

Table of Contents

• Article overview
• What Linux Log Management: rsyslog, logrotate & Centralized Logging Setup means
• Why it matters now
• Implementation framework
• Practical comparison
• Expert workflow
• Common mistakes
• Media and link plan
• Original technical deep dive
• FAQ
• Structured data
• Conclusion

Article overview

Linux Log Management: rsyslog, logrotate & Centralized Logging Setup is the kind of topic that looks simple until it reaches production. Teams usually discover the real cost late: unclear boundaries, weak defaults, hidden maintenance work, and decisions that seemed harmless when the codebase was small.

The problem gets worse when the article, tutorial, or implementation guide only explains the happy path. This guide closes that gap with a practical framework, a comparison table, common mistakes, and a deep technical section you can use while planning real work.

Keep reading for the non-obvious part: the safest implementation is rarely the most impressive-looking one. It is the one your team can debug, test, document, and evolve without turning every future change into archaeology.

Key Takeaways

• Linux Log Management: rsyslog, logrotate & Centralized Logging Setup should be evaluated as a production decision, not only as a syntax or tooling choice.
• The best implementation keeps responsibilities visible, with clear ownership, tests, documentation, and rollback paths.
• Search visibility improves when practical depth, structured answers, and expert examples live on the same page.

[IMAGE: A mobile-first technical article layout showing the main concept, decision table, implementation checklist, and FAQ blocks. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup expert guide for Monitoring]

What Linux Log Management: rsyslog, logrotate & Centralized Logging Setup means

Linux Log Management: rsyslog, logrotate & Centralized Logging Setup means applying monitoring knowledge to a concrete engineering decision, then turning that decision into reliable code, documentation, and operational behavior. In practice, it combines the topic's core concepts with trade-off analysis, implementation boundaries, testing strategy, and maintenance discipline.

This is the definition worth optimizing for featured snippets because it avoids hype. It tells the reader what the topic does and what a professional implementation must include.

Why it matters now

The technical web is more crowded than it was a few years ago. Thin tutorials can still get indexed, but they rarely earn trust from senior developers, buyers, AI answer systems, or teams that need production guidance.

For monitoring topics, the strongest content now has three layers:

• a clear answer for fast scanning
• a practical framework for implementation
• expert context that explains what breaks later

That same structure helps search engines understand the page. It also helps readers decide whether the advice fits their project.

Implementation framework

Use this framework before adopting the approach described in this article.

1. Define the user problem and the production risk.
2. Identify the smallest reliable implementation boundary.
3. Keep configuration, secrets, and environment-specific behavior outside the article's core logic.
4. Add tests for the behavior that would hurt if it regressed.
5. Document the trade-off, not only the final code.
6. Measure the result with logs, metrics, or user-facing outcomes.
7. Revisit the decision after real usage exposes edge cases.

The sequence is deliberately conservative. It keeps the work grounded in outcomes instead of novelty.

[IMAGE: A seven-step implementation framework with discovery, boundary design, configuration, tests, documentation, measurement, and iteration. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup implementation framework]

Practical comparison

This table is intentionally practical. It gives a reviewer something to check before the implementation becomes expensive to change.

Expert workflow

Expert tip: "Treat Linux Log Management: rsyslog, logrotate & Centralized Logging Setup as a system boundary. If the next developer cannot find where the decision lives, how it is tested, and when it should be avoided, the implementation is not finished."

A useful workflow is simple:

• Start with the smallest working example.
• Add the constraints that exist in your real project.
• Remove anything that only demonstrates cleverness.
• Write down the failure modes.
• Add links to related decisions so future readers can navigate the topic cluster.

That last point matters for both humans and search systems. A single article can answer a question; a cluster proves authority.

Common mistakes

Mistake 1: Copying a pattern without its context

A pattern that works in a small demo can fail in a real application. The missing context is usually data volume, team experience, deployment process, security requirements, or observability.

Before copying the pattern, ask what assumption made it safe in the original example.

Mistake 2: Putting business logic in the wrong layer

This is the fastest way to make future debugging expensive. In Laravel, PHP, and server-rendered websites, presentation should receive prepared data, not discover rules on its own.

Keep decision logic in models, actions, services, policies, requests, jobs, or documented helpers where it can be tested directly.

Mistake 3: Optimizing for novelty instead of maintainability

Newer tools and language features can be valuable. They can also hide simple behavior behind unfamiliar syntax.

Use the option that makes the next production incident easier to understand.

Mistake 4: Publishing without a measurement plan

If the article describes a performance, SEO, security, or architecture improvement, define how success will be checked. Logs, tests, crawl diagnostics, analytics, and user behavior are all stronger than assumptions.

[IMAGE: A common-mistakes board with context loss, wrong layer, novelty bias, and missing measurement highlighted. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup common mistakes]

Media and link plan

Image placeholders

• [IMAGE: A concept diagram for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup with input, decision boundary, implementation, tests, and production feedback. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup concept diagram]
• [IMAGE: A mobile screenshot-style checklist for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup mobile checklist]
• [IMAGE: A comparison table visualization for strong versus weak implementation choices. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup comparison table]

Video placeholder

[VIDEO: Insert a 5-8 minute YouTube walkthrough that demonstrates the main decision, the implementation boundary, the test strategy, and the production caveats for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup.]

Trustworthy outbound links

• Linux manual pages - use this as the trust reference for operating-system reference.
• Google Search quality guidance - use this as the trust reference for people-first content and E-E-A-T alignment.

Internal linking opportunities

• Internal guide: Linux Monitoring With Prometheus & Grafana - use this when readers need a related Monitoring follow-up.
• Internal guide: Configuring PostgreSQL on Linux - use this when readers need a related Database follow-up.

Original Technical Deep Dive

The short version

Linux log management has three separate jobs:

For a small fleet, a practical baseline is:

applications write structured logs to files or stdout
rsyslog forwards system and selected app logs to a central receiver
logrotate rotates local files before disks fill
Filebeat or Elastic Agent ships selected files to Elasticsearch
Kibana is used for search, dashboards, and incident review

Start with these checks:

systemctl status rsyslog --no-pager
systemctl status logrotate.timer --no-pager 2>/dev/null || true
journalctl -u rsyslog -b --no-pager
ls -lah /var/log
du -sh /var/log/* 2>/dev/null | sort -h | tail -20

The goal is not to collect every byte forever. The goal is to keep enough evidence to debug incidents, detect attacks, satisfy retention requirements, and avoid filling disks.

Decide what belongs where

Before writing config, classify logs:

Then define:

which logs are business-critical
which logs contain personal data or secrets
which hosts are allowed to send logs
where logs are stored during network outages
who can read central logs
how long each dataset is retained

Do not centralize secrets. Fix application logging first if tokens, passwords, cookies, or full request bodies are being written.

Install the baseline packages

Ubuntu or Debian:

sudo apt update
sudo apt install -y rsyslog logrotate lsof netcat-openbsd
sudo systemctl enable --now rsyslog

RHEL, Rocky Linux, AlmaLinux, or Fedora:

sudo dnf install -y rsyslog logrotate lsof nmap-ncat
sudo systemctl enable --now rsyslog

Check versions:

rsyslogd -v
logrotate --version
systemctl status rsyslog --no-pager

Validate the current rsyslog config:

sudo rsyslogd -N1

Check logrotate scheduling:

systemctl status logrotate.timer --no-pager 2>/dev/null || true
systemctl list-timers logrotate.timer 2>/dev/null || true

Some distributions run logrotate from cron instead of logrotate.timer:

ls -l /etc/cron.daily/logrotate 2>/dev/null || true

Understand the local logging path

On systemd hosts, local logs often flow through more than one layer:

service stdout/stderr -> journald -> journalctl
syslog socket -> rsyslog -> /var/log/syslog or /var/log/messages
application file logger -> /var/log/myapp/*.log -> logrotate -> file shipper
remote syslog -> rsyslog listener -> central file or pipeline

Check journald:

journalctl -b --no-pager | tail -50
journalctl -p err -b --no-pager
journalctl -u ssh --since today --no-pager 2>/dev/null || journalctl -u sshd --since today --no-pager

Check classic files:

ls -lah /var/log
sudo tail -n 50 /var/log/syslog 2>/dev/null || true
sudo tail -n 50 /var/log/messages 2>/dev/null || true
sudo tail -n 50 /var/log/auth.log 2>/dev/null || true
sudo tail -n 50 /var/log/secure 2>/dev/null || true

Send a test syslog message:

logger -t log-test "hello from $(hostname -f 2>/dev/null || hostname)"

Find it:

journalctl -t log-test --since '5 minutes ago' --no-pager
sudo grep 'log-test' /var/log/syslog /var/log/messages 2>/dev/null || true

If it appears in journald but not in syslog files, your distribution may not route journald messages into rsyslog by default, or rsyslog may not be installed.

Add an application log rule in rsyslog

Use this when an application logs through syslog with a fixed tag:

sudo mkdir -p /var/log/myapp
sudo chown syslog:adm /var/log/myapp 2>/dev/null || sudo chown root:adm /var/log/myapp
sudo chmod 0750 /var/log/myapp

Create:

sudoedit /etc/rsyslog.d/30-myapp.conf

Use:

if ($programname == 'myapp') then {
    action(type="omfile" file="/var/log/myapp/myapp.log")
    stop
}

Validate and restart:

sudo rsyslogd -N1
sudo systemctl restart rsyslog

Test:

logger -t myapp "first myapp test message"
sudo tail -n 20 /var/log/myapp/myapp.log

The stop line prevents matching messages from continuing into later rules. Use it only when you intentionally do not want duplicate copies in generic files such as /var/log/syslog.

Configure a central rsyslog receiver

This example uses TCP on a private network. Do not expose plain syslog ports to the public internet.

On the log server:

sudo mkdir -p /var/log/remote
sudo chmod 0750 /var/log/remote

[IMAGE: Supporting visual 1 for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup, showing Linux Log Management: rsyslog, logrotate & Centralized Logging Setup decisions, examples, and Linux, Logging, rsyslog. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup linux-log-management-rsyslog-logrotate-centralized-logging-setup visual 1]

[IMAGE: Supporting visual 1 for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup, showing Linux Log Management: rsyslog, logrotate & Centralized Logging Setup decisions, examples, and Linux, Logging, rsyslog. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup linux-log-management-rsyslog-logrotate-centralized-logging-setup visual 1]

Create:

sudoedit /etc/rsyslog.d/10-remote-receiver.conf

Use:

module(load="imtcp")

template(
    name="RemotePerHostProgram"
    type="string"
    string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log"
)

ruleset(name="remote_tcp") {
    action(
        type="omfile"
        dynaFile="RemotePerHostProgram"
        createDirs="on"
        dirCreateMode="0750"
        fileCreateMode="0640"
    )
    stop
}

input(type="imtcp" port="514" ruleset="remote_tcp")

Validate:

sudo rsyslogd -N1
sudo systemctl restart rsyslog

Check the listener:

sudo ss -ltnp | grep ':514'

Open the firewall only for trusted senders.

UFW:

sudo ufw allow from 10.0.0.0/24 to any port 514 proto tcp

firewalld:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" port port="514" protocol="tcp" accept'
sudo firewall-cmd --reload

Configure rsyslog forwarding on clients

On each client, create:

sudoedit /etc/rsyslog.d/90-forward-to-loghost.conf

Use TCP with an action queue:

action(
    type="omfwd"
    target="loghost.internal"
    port="514"
    protocol="tcp"
    queue.type="linkedList"
    queue.filename="forward_to_loghost"
    queue.maxDiskSpace="1g"
    queue.saveOnShutdown="on"
    action.resumeRetryCount="-1"
)

Validate and restart:

sudo rsyslogd -N1
sudo systemctl restart rsyslog

Test from the client:

logger -t remote-test "remote syslog test from $(hostname)"

Check the server:

sudo find /var/log/remote -type f -mmin -5 -print
sudo grep -R 'remote syslog test' /var/log/remote 2>/dev/null | tail -20

Why the queue matters:

without an action queue, a blocked remote action can delay other rsyslog processing
with an action queue, forwarding can retry while local logging continues
with disk-assisted queue settings, short central outages are less likely to lose logs

For high-value logs, test outage behavior:

# On the log server, temporarily block the port or stop rsyslog.
sudo systemctl stop rsyslog

# On the client, generate messages.
for i in $(seq 1 100); do logger -t queue-test "message $i"; done

# Restore server and confirm delivery.
sudo systemctl start rsyslog

Do not assume "TCP" means no loss. If the sender runs out of queue disk space, crashes before queue persistence, or drops messages under pressure, logs can still be lost.

UDP vs TCP vs TLS vs RELP

Use the transport based on risk:

Plain UDP is easy to configure:

action(
    type="omfwd"
    target="loghost.internal"
    port="514"
    protocol="udp"
)

But UDP can drop messages silently during congestion or receiver downtime.

For production across networks you do not fully control, use TLS or a private tunnel. For logs that must be delivered with acknowledgment semantics, evaluate rsyslog RELP.

Keep local files bounded with logrotate

Check the main config:

sed -n '1,220p' /etc/logrotate.conf
ls -lah /etc/logrotate.d/

Test logrotate without changing files:

sudo logrotate --debug /etc/logrotate.conf

Run verbosely:

sudo logrotate --verbose /etc/logrotate.conf

Force a rotation only when testing a specific rule:

sudo logrotate --force --verbose /etc/logrotate.d/myapp

Do not routinely run --force in production. It bypasses normal rotation criteria.

Write a logrotate policy for app logs

Create:

sudoedit /etc/logrotate.d/myapp

Use:

/var/log/myapp/*.log {
    daily
    rotate 14
    missingok
    notifempty
    compress
    delaycompress
    dateext
    create 0640 myapp adm
    su myapp adm
    sharedscripts
    postrotate
        systemctl kill -s HUP myapp.service 2>/dev/null || true
    endscript
}

Meaning:

Validate:

sudo logrotate --debug /etc/logrotate.d/myapp

If the application logs through rsyslog, signal rsyslog instead of the app:

postrotate
    systemctl kill -s HUP rsyslog.service 2>/dev/null || true
endscript

[IMAGE: Supporting visual 2 for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup, showing Linux Log Management: rsyslog, logrotate & Centralized Logging Setup decisions, examples, and Linux, Logging, rsyslog. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup linux-log-management-rsyslog-logrotate-centralized-logging-setup visual 2]

If the application cannot reopen logs after SIGHUP, fix the application or its service configuration. Use copytruncate only when you cannot make the writer reopen the file.

Understand copytruncate

copytruncate copies the current file and truncates the original in place:

/var/log/legacy-app/*.log {
    daily
    rotate 7
    missingok
    notifempty
    compress
    copytruncate
}

[IMAGE: Supporting visual 2 for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup, showing Linux Log Management: rsyslog, logrotate & Centralized Logging Setup decisions, examples, and Linux, Logging, rsyslog. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup linux-log-management-rsyslog-logrotate-centralized-logging-setup visual 2]

Use it for:

legacy daemons that keep writing to the same file descriptor
third-party software that cannot reload or reopen logs
short-term containment while you plan a better fix

Avoid it when:

logs are high volume
you cannot tolerate a small loss window
the service can reopen files with HUP or reload
you can write logs to stdout and let the service manager collect them

The logrotate manual warns that there is a small window between copying and truncating where log data may be lost.

Rotate by time and size

Time-based:

/var/log/myapp/*.log {
    daily
    rotate 14
    compress
}

Size-based:

/var/log/myapp/*.log {
    size 100M
    rotate 20
    compress
}

Time plus emergency size cap:

/var/log/myapp/*.log {
    daily
    maxsize 250M
    rotate 14
    compress
    delaycompress
}

Use maxsize when a runaway service can create a huge file before the next daily rotation.

Use minsize when you want rotation only after both time and size thresholds make sense:

/var/log/myapp/*.log {
    weekly
    minsize 50M
    rotate 8
    compress
}

Find services holding deleted logs

A common disk leak happens after a log is deleted or rotated while a process still holds the old file descriptor.

Check:

sudo lsof +L1

Filter logs:

sudo lsof +L1 | grep '/var/log' || true

If a process holds a deleted log:

sudo systemctl reload SERVICE
sudo systemctl restart SERVICE

Then check disk usage again:

df -h
sudo du -sh /var/log/* 2>/dev/null | sort -h | tail -20

Do not remove active log files manually. Rotate them or tell the writer to reopen them.

Keep journald under control

If journald is persistent on your distribution, it stores journals under:

/var/log/journal/

Check size:

journalctl --disk-usage

Vacuum by size:

sudo journalctl --vacuum-size=1G

Vacuum by time:

sudo journalctl --vacuum-time=30d

For persistent policy, edit:

sudoedit /etc/systemd/journald.conf

Example:

[Journal]
SystemMaxUse=2G
SystemKeepFree=1G
MaxRetentionSec=30day
Compress=yes

Restart:

sudo systemctl restart systemd-journald

Do not rely on journald vacuuming as your only log management. Application file logs, database logs, web server logs, and remote logs still need explicit policies.

Introduce centralized logging with Elastic/ELK

Classic ELK means:

Elasticsearch stores and searches logs
Logstash receives, parses, enriches, and routes events
Kibana explores and visualizes the data
Beats or Elastic Agent ship data from hosts

A common Linux pipeline:

app host -> Filebeat or Elastic Agent -> Logstash -> Elasticsearch -> Kibana

Or, for simpler data:

app host -> Filebeat or Elastic Agent -> Elasticsearch ingest pipeline -> Kibana

Current Elastic documentation recommends Elastic Agent for most new use cases, while Filebeat remains common in classic ELK deployments and older operational runbooks. If you are maintaining a 2021-style ELK stack, Filebeat examples are still useful. If you are starting fresh, compare Elastic Agent first.

Minimum central logging architecture:

[IMAGE: Supporting visual 3 for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup, showing Linux Log Management: rsyslog, logrotate & Centralized Logging Setup decisions, examples, and Linux, Logging, rsyslog. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup linux-log-management-rsyslog-logrotate-centralized-logging-setup visual 3]

Do not start with a giant cluster. Start with one dataset, one service, and one dashboard.

Ship files with Filebeat to Logstash

Example Filebeat config for classic ELK:

filebeat.inputs:
  - type: filestream
    id: linux-system-logs
    paths:
      - /var/log/syslog
      - /var/log/auth.log
      - /var/log/myapp/*.log
    fields:
      environment: production
    fields_under_root: true

output.logstash:
  hosts: ["logstash.internal:5044"]

Validate:

sudo filebeat test config -e
sudo filebeat test output -e

Start:

sudo systemctl enable --now filebeat
systemctl status filebeat --no-pager
journalctl -u filebeat -b --no-pager

Avoid shipping Filebeat's own logs back into Filebeat. Elastic's docs warn this can create an ingestion loop.

Receive Filebeat in Logstash

Example Logstash pipeline:

sudoedit /etc/logstash/conf.d/linux-logs.conf

Use:

input {
  beats {
    port => 5044
  }
}

filter {
  if [log][file][path] =~ "myapp" {
    json {
      source => "message"
      skip_on_invalid_json => true
    }
  }

  mutate {
    add_field => {
      "service.environment" => "%{[environment]}"
    }
  }
}

output {
  elasticsearch {
    hosts => ["https://elasticsearch.internal:9200"]
    index => "linux-logs-%{+YYYY.MM.dd}"
    user => "logstash_internal"
    password => "${LOGSTASH_INTERNAL_PASSWORD}"
    ssl_enabled => true
    ssl_certificate_authorities => ["/etc/logstash/certs/ca.crt"]
  }
}

Test Logstash config:

sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash --config.test_and_exit

Restart:

sudo systemctl restart logstash
journalctl -u logstash -b --no-pager

Open port 5044 only to trusted shippers:

sudo ufw allow from 10.0.0.0/24 to any port 5044 proto tcp

For production, configure TLS between Filebeat and Logstash. Do not send logs and credentials over cleartext networks.

[IMAGE: Supporting visual 3 for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup, showing Linux Log Management: rsyslog, logrotate & Centralized Logging Setup decisions, examples, and Linux, Logging, rsyslog. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup linux-log-management-rsyslog-logrotate-centralized-logging-setup visual 3]

Structure application logs before shipping

Plain text works for humans. Structured logs work for search.

Prefer JSON lines:

{"timestamp":"2026-05-07T10:15:30Z","level":"error","service":"checkout","message":"payment capture failed","order_id":"ord_123","exception":"GatewayTimeout"}

Do not log:

passwords
access tokens
session cookies
full credit card numbers
private keys
large request bodies
unbounded stack traces on every request

Good field names:

If logs are already JSON, avoid parsing them with brittle regexes. Parse JSON at the shipper, Logstash, or ingest pipeline layer.

Build a useful dashboard

Start with operational questions:

Which services are producing errors?
Which hosts stopped sending logs?
Did authentication failures spike?
Which deploy introduced new exceptions?
Are logs delayed between host timestamp and ingest timestamp?
Which log source is growing fastest?

Useful visualizations:

Add alerts only after fields are stable. Alerting on raw text usually produces noisy rules.

Retention and privacy

Retention should be explicit:

hot searchable logs: 7-30 days
warm searchable logs: 30-90 days
archive: only if required
debug logs: short-lived
security logs: policy-driven

For Elastic, use data streams or index lifecycle management instead of manually deleting indices by hand.

Privacy checklist:

[ ] Sensitive fields are not emitted by applications.
[ ] Shippers drop or redact known sensitive fields.
[ ] Central logs have role-based access.
[ ] Retention matches legal and business requirements.
[ ] Debug logs are short-lived.
[ ] Production log access is audited.
[ ] Backups and snapshots follow the same retention rules.

Central logs often become a second database of user behavior. Treat access accordingly.

Troubleshooting rsyslog

Validate syntax:

sudo rsyslogd -N1

Check service logs:

journalctl -u rsyslog -b --no-pager

Check listener:

sudo ss -ltnp | grep ':514' || true
sudo ss -lunp | grep ':514' || true

Send a local message:

logger -t rsyslog-test "local test"

Send a remote TCP test:

printf '<13>tcp test from netcat\n' | nc loghost.internal 514

Check file permissions:

sudo namei -l /var/log/remote
sudo find /var/log/remote -maxdepth 3 -type f -ls | tail -20

Common causes:

[IMAGE: Supporting visual 4 for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup, showing Linux Log Management: rsyslog, logrotate & Centralized Logging Setup decisions, examples, and Linux, Logging, rsyslog. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup linux-log-management-rsyslog-logrotate-centralized-logging-setup visual 4]

Troubleshooting logrotate

Dry-run one rule:

sudo logrotate --debug /etc/logrotate.d/myapp

Verbose run:

sudo logrotate --verbose /etc/logrotate.d/myapp

Check state:

sudo grep myapp /var/lib/logrotate.status 2>/dev/null || true

Check timer:

systemctl status logrotate.timer --no-pager 2>/dev/null || true
journalctl -u logrotate.service -b --no-pager 2>/dev/null || true

Common causes:

Use precise globs:

/var/log/myapp/*.log

Avoid broad globs:

/var/log/myapp/*

Broad globs can match compressed files, old files, and temporary files.

[IMAGE: Supporting visual 4 for Linux Log Management: rsyslog, logrotate & Centralized Logging Setup, showing Linux Log Management: rsyslog, logrotate & Centralized Logging Setup decisions, examples, and Linux, Logging, rsyslog. Alt: Linux Log Management: rsyslog, logrotate & Centralized Logging Setup linux-log-management-rsyslog-logrotate-centralized-logging-setup visual 4]

Troubleshooting Elastic/ELK ingestion

Check Filebeat:

sudo filebeat test config -e
sudo filebeat test output -e
journalctl -u filebeat -b --no-pager

Check Logstash:

sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash --config.test_and_exit
journalctl -u logstash -b --no-pager
sudo ss -ltnp | grep ':5044'

Check Elasticsearch:

curl -k -u elastic 'https://elasticsearch.internal:9200/_cluster/health?pretty'
curl -k -u elastic 'https://elasticsearch.internal:9200/_cat/indices/linux-logs-*?v'

Check Kibana:

time picker includes the event time
data view matches the index or data stream
events have @timestamp
shipper clock is synchronized
pipeline did not reject fields because of mapping conflicts

Common causes:

Production checklist

Before rollout:

[ ] Log sources and retention classes are documented.
[ ] rsyslog config passes rsyslogd -N1.
[ ] Remote forwarding uses queues for TCP actions.
[ ] Plain syslog is restricted to trusted networks.
[ ] TLS or a private tunnel is used across untrusted networks.
[ ] logrotate rules are tested with --debug.
[ ] Applications reopen logs after rotation or use stdout/journald.
[ ] lsof +L1 is clean after rotation tests.
[ ] /var/log disk usage is monitored.
[ ] Central logging has access controls and retention policy.
[ ] Sensitive fields are removed before central storage.
[ ] Ingestion delay and dropped events are monitored.

Rollback rsyslog forwarding:

sudo mv /etc/rsyslog.d/90-forward-to-loghost.conf /root/90-forward-to-loghost.conf.disabled
sudo rsyslogd -N1
sudo systemctl restart rsyslog

Rollback a logrotate rule:

sudo mv /etc/logrotate.d/myapp /root/myapp.logrotate.disabled
sudo logrotate --debug /etc/logrotate.conf

Stop Filebeat:

sudo systemctl disable --now filebeat

FAQ

What is Linux Log Management: rsyslog, logrotate & Centralized Logging Setup?

Linux Log Management: rsyslog, logrotate & Centralized Logging Setup is a practical monitoring topic that should be evaluated through implementation scope, production risk, testing, documentation, and long-term maintainability.

When should a team use Linux Log Management: rsyslog, logrotate & Centralized Logging Setup?

Use Linux Log Management: rsyslog, logrotate & Centralized Logging Setup when it solves a real project constraint, improves clarity, or reduces operational risk. Avoid it when it only adds novelty or hides behavior from future maintainers.

What is the biggest risk with Linux Log Management: rsyslog, logrotate & Centralized Logging Setup?

The biggest risk is copying a pattern without its context. Production systems need clear boundaries, rollback options, tests, and observability before a technique becomes dependable.

How do you test Linux Log Management: rsyslog, logrotate & Centralized Logging Setup?

Test the smallest unit that owns the behavior, then add integration coverage for the path users or systems actually rely on. Include failure cases, configuration differences, and regression checks.

How does Linux Log Management: rsyslog, logrotate & Centralized Logging Setup affect SEO and AI search visibility?

It improves visibility when the article gives a direct answer, expert context, structured headings, internal links, trustworthy references, and FAQ content that matches the visible page.

Conclusion

Linux Log Management: rsyslog, logrotate & Centralized Logging Setup is worth doing when the implementation improves clarity, reliability, or delivery speed. It is not worth doing when it hides ownership, increases operational risk, or makes the system harder to explain.

Use the framework above as a review checklist. Then connect this topic to the rest of the project documentation so readers can move from concept to implementation without losing context.