I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance when I type:

$ logger -t shell "Test log message from the command line"

nothing appears in /var/log/messages nor in /var/log/syslog. All I did was add a configuration file to /etc/rsyslog.d, just as follows:

# cat /etc/rsyslog.d/udp.conf
# Enable UDP listening
# http://www.rsyslog.com/tag/tcp/
$ModLoad imudp

# log every host in its own directory
$template RemoteHost,"/var/log/hosts/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"

# Remote Logging
$RuleSet remote
*.* ?RemoteHost

### Listeners

# Bind ruleset to udp listener and activate
$InputUDPServerBindRuleset remote
$UDPServerRun 514

I kept the stock /etc/rsyslogd.conf intact, assuming I didn't have to change anything. Here it is:

# purge /etc/rsyslog.conf    # 'purge' is 'cat with comments removed'
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice
        news.none;mail.none     -/var/log/debug
        mail,news.none          -/var/log/messages
*.emerg                         :omusrmsg:*
        *.=notice;*.=warn       |/dev/xconsole

With this configuration log lines from remote hosts also appear in /var/log/messages and /var/log/syslog (which is not what I want). Local logged lines just no more.

Does anyone know how to just add remote logging while keeping the initial functionalities of rsyslogd?


Your $RuleSet remote never gets terminated, so all the rules after that will get associated with the remote ruleset.

And as your /etc/rsyslog.d/udp.conf gets included to the main configuration at $IncludeConfig /etc/rsyslog.d/*.conf, it turns out the remote ruleset ends up covering the default rules specified in the main /etc/rsyslog.conf file too.

Since the remote ruleset has claimed all the rules for its own and is bound to remote log messages only, the effective result is that the list of rules for local log messages is now an empty list. And that is why only remote log messages get written to the log files.

The next question is, how do you terminate a rsyslog ruleset? There is no $EndRuleSet directive and no { ... } blocks in this version of rsyslog configuration syntax, after all.

And the answer to that is, you specify another $RuleSet directive.

Within your /etc/rsyslog.d/udp.conf, you should specify your remote logging rules like this:

# Remote Logging
$RuleSet remote
*.* ?RemoteHost

# End of remote logging rules
$RuleSet RSYSLOG_DefaultRuleset

### Listeners

You can find an example of this in Fedora 26's System Administrator's Guide.


I dropped the case. Even though it has a lot more dependencies, I installed syslog-ng, which I know better. This does not answer the question however as it is a last resort work around. I leave the question open to whom knows the answer though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy