---
title: Ship your rsyslog logs to Honeybadger Insights
description: Use rsyslog to forward system and application logs to Honeybadger Insights over syslog-TLS.
url: https://docs.honeybadger.io/guides/insights/integrations/rsyslog/
---

[rsyslog](https://www.rsyslog.com/) is the default syslog daemon on most Linux distributions. You can configure it to forward logs to Honeybadger Insights over syslog-TLS (RFC 5425), tagging each message with your project’s API key in the structured-data section of the RFC 5424 payload.

## Requirements

Install the TLS driver package for rsyslog. On Debian and Ubuntu:

```shell
sudo apt-get install rsyslog-gnutls
```

On RHEL, Fedora, and derivatives:

```shell
sudo dnf install rsyslog-gnutls
```

You’ll also need the CA certificate bundle for your system. On Debian/Ubuntu this is `/etc/ssl/certs/ca-certificates.crt`. On RHEL/Fedora it’s `/etc/pki/tls/certs/ca-bundle.crt`.

## Configuration

/etc/rsyslog.d/60-honeybadger.conf

```plaintext
# Load the TLS network stream driver. Set the CA file to match your OS:
#   Debian/Ubuntu: /etc/ssl/certs/ca-certificates.crt
#   RHEL/Fedora:   /etc/pki/tls/certs/ca-bundle.crt
global(DefaultNetstreamDriver="gtls"
       DefaultNetstreamDriverCAFile="/etc/ssl/certs/ca-certificates.crt")


# RFC 5424 template with Honeybadger structured data
template(name="HoneybadgerFormat" type="string"
         string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% [honeybadger@61642 api_key=\"PROJECT_API_KEY\" event_type=\"rsyslog\"] %msg%\n")


# Forward all logs to Honeybadger over syslog-TLS (RFC 5425)
action(type="omfwd"
       Target="in.honeybadger.io"
       Port="6514"
       Protocol="tcp"
       TCP_Framing="octet-counted"
       StreamDriver="gtls"
       StreamDriverMode="1"
       StreamDriverAuthMode="x509/name"
       StreamDriverPermittedPeers="*.honeybadger.io"
       template="HoneybadgerFormat")
```

Restart rsyslog to pick up the change:

```shell
sudo systemctl restart rsyslog
```

You can add additional key/value pairs to the structured-data section of the template. For example, to tag every event with an environment, replace the `string=` value inside the `template(name="HoneybadgerFormat" ...)` block above with the following:

```plaintext
string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% [honeybadger@61642 api_key=\"PROJECT_API_KEY\" event_type=\"rsyslog\" environment=\"production\"] %msg%\n"
```

## Shipping application log files with imfile

rsyslog’s [`imfile`](https://www.rsyslog.com/doc/configuration/modules/imfile.html) module can tail arbitrary log files and feed them through the same pipeline, which is handy if your application writes to its own log file instead of stdout. Add the following to the top of `/etc/rsyslog.d/60-honeybadger.conf` (before the `action(...)` block):

```plaintext
# Load the file input module
module(load="imfile" PollingInterval="10")


# Tail your application's log files
input(type="imfile"
      File="/var/log/myapp/*.log"
      Tag="myapp"
      Severity="info"
      Facility="local7")
```

Each line written to a matching file will be forwarded to Honeybadger using the `HoneybadgerFormat` template, with `APP-NAME` set to the `Tag` value (`myapp`). Adjust `File`, `Tag`, `Severity`, and `Facility` to match your application.

If you’d rather only forward the events captured by `imfile` (and not every other message rsyslog processes), wrap the action in a conditional:

```plaintext
if ($programname == "myapp") then {
  action(type="omfwd"
         Target="in.honeybadger.io"
         Port="6514"
         Protocol="tcp"
         TCP_Framing="octet-counted"
         StreamDriver="gtls"
         StreamDriverMode="1"
         StreamDriverAuthMode="x509/name"
         StreamDriverPermittedPeers="*.honeybadger.io"
         template="HoneybadgerFormat")
}
```

## Querying your data

Once your data is flowing, you can query it in [Insights](https://docs.honeybadger.io/guides/insights/) using [BadgerQL](https://docs.honeybadger.io/guides/insights/badgerql/). The following query will return events sent via rsyslog:

```sql
fields @ts, hostname::str, appname::str, severity::str, message::str
| filter event_type::str == "rsyslog"
| sort @ts
```

## Troubleshooting

If events aren’t showing up in Insights, check rsyslog’s own log for TLS or forwarding errors:

```shell
sudo journalctl -u rsyslog -f
```

A missing or incorrect CA file is the most common cause of connection failures — double-check the `DefaultNetstreamDriverCAFile` path against what’s installed on your system.

---

## Try Honeybadger for FREE

Intelligent logging, error tracking, and Just Enough APM™ in one dev-friendly platform. Find and fix problems before users notice.

[Start free trial](https://app.honeybadger.io/users/sign_up)

[See plans and pricing](https://www.honeybadger.io/plans/)