1

I have been trying to start the rsyslog service on centos 7 but I wont work. Please see te configuration file-

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 10544


#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler
# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
        # ### end of the forwarding rule ###

Also below is the netstat output. No where I can see the rsyslog service running:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:5903            0.0.0.0:*               LISTEN      3124/Xvnc
tcp        0      0 0.0.0.0:6001            0.0.0.0:*               LISTEN      4368/X
tcp        0      0 0.0.0.0:6003            0.0.0.0:*               LISTEN      3124/Xvnc
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      996/sshd
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      2697/cupsd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1261/master
tcp6       0      0 :::6001                 :::*                    LISTEN      4368/X
tcp6       0      0 :::6003                 :::*                    LISTEN      3124/Xvnc
tcp6       0      0 :::22                   :::*                    LISTEN      996/sshd
tcp6       0      0 ::1:631                 :::*                    LISTEN      2697/cupsd
tcp6       0      0 ::1:25                  :::*                    LISTEN      1261/master
udp        0      0 0.0.0.0:39924           0.0.0.0:*                           654/avahi-daemon: r
udp        0      0 0.0.0.0:68              0.0.0.0:*                           716/dhclient
udp        0      0 0.0.0.0:123             0.0.0.0:*                           645/chronyd
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           654/avahi-daemon: r
udp        0      0 0.0.0.0:58092           0.0.0.0:*                           716/dhclient
udp        0      0 127.0.0.1:323           0.0.0.0:*                           645/chronyd
udp6       0      0 :::123                  :::*                                645/chronyd
udp6       0      0 ::1:323                 :::*                                645/chronyd
udp6       0      0 :::46946                :::*                                716/dhclient
[root@localhost etc]#
  • How did you attempt to start the service? – Wildcard Jan 7 '16 at 19:01
  • service rsyslog start ! – H4X Jan 7 '16 at 20:52
0

You may have SELinux enabled and it's blocking rsyslogd from binding to the non-standard syslog port 10544 you chose for the tcp listener. Disable SELinux completely or execute the following and restart rsyslog:

semanage port -a -t syslogd_port_t -p tcp 10544

There also could be errors in any included configuration files in /etc/rsyslog.d Execute the following to check config files while rsyslogd is not running:

rsyslogd -f /etc/rsyslog.conf -N 1   
0

Try to check rsyslog conf with: rsyslogd -f /etc/rsyslog.conf -N 1
If everything is ok , try to restart systemd-journald.socket with:

systemctl restart systemd-journald.socket 

you can use the command logger to check if rsyslog started or not:

logger "hello"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.