I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance when I type:
$ logger -t shell "Test log message from the command line"
nothing appears in
/var/log/messages nor in
/var/log/syslog. All I did was add a configuration file to
/etc/rsyslog.d, just as follows:
# cat /etc/rsyslog.d/udp.conf # Enable UDP listening # http://www.rsyslog.com/tag/tcp/ $ModLoad imudp # log every host in its own directory $template RemoteHost,"/var/log/hosts/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log" # Remote Logging $RuleSet remote *.* ?RemoteHost ### Listeners # Bind ruleset to udp listener and activate $InputUDPServerBindRuleset remote $UDPServerRun 514
I kept the stock
/etc/rsyslogd.conf intact, assuming I didn't have to change anything. Here it is:
# purge /etc/rsyslog.conf # 'purge' is 'cat with comments removed' $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging support $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $FileOwner root $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 $WorkDirectory /var/spool/rsyslog $IncludeConfig /etc/rsyslog.d/*.conf auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog daemon.* -/var/log/daemon.log kern.* -/var/log/kern.log lpr.* -/var/log/lpr.log mail.* -/var/log/mail.log user.* -/var/log/user.log mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err /var/log/mail.err news.crit /var/log/news/news.crit news.err /var/log/news/news.err news.notice -/var/log/news/news.notice *.=debug;\ auth,authpriv.none;\ news.none;mail.none -/var/log/debug *.=info;*.=notice;*.=warn;\ auth,authpriv.none;\ cron,daemon.none;\ mail,news.none -/var/log/messages *.emerg :omusrmsg:* daemon.*;mail.*;\ news.err;\ *.=debug;*.=info;\ *.=notice;*.=warn |/dev/xconsole
With this configuration log lines from remote hosts also appear in
/var/log/syslog (which is not what I want). Local logged lines just no more.
Does anyone know how to just add remote logging while keeping the initial functionalities of rsyslogd?