3

I'm debugging a strange issue with a logging SaaS solution. We appear to be duplicating logs sent to the SaaS. Logs are sent via an rsyslog forwarder over TLS. I'm trying to see if I can reproduce the issue by running a remote rsyslog server and forwarding a since instance's logs to that server to monitor. Let's call the server where logs originate guineapig and the remote rsyslog server watcher.

watcher is configured to listen on UDP port 514 using configuration like this:

$ModLoad imudp.so
$UDPServerRun 514

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# log everything to the /var/log/remotesyslog file
*.*    /var/log/remotesyslog 

guineapig is configured to forward everything to watcher using its IP address:

$ModLoad imuxsock
$ModLoad imjournal

$ModLoad imudp.so
$UDPServerRun 514

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$IMJournalStateFile imjournal.state

authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*      

                                      /var/log/boot.log

Inside /etc/rsyslog.d/22-remote-rsyslog.conf on guineapig:

# forward everything over UDP to watcher
*.* @@10.0.1.1:514

Unfortunately, when I then restart the SystemD rsyslog service and attempt to trigger a log message on guineapig, I don't see it appear in the file on watcher:

user@guineapig ~$ logger "please work"
# doesn't work

However, if I directly tell logger where to go, the log line shows up:

user@guineapig ~$ logger -n 10.0.1.1 "please work for real"
# works

I'm having a very difficult time trudging through rsyslog's documentation, but for some reason my logs aren't getting forwarded properly to watcher.

Is there an obvious issue in my configuration on guineapig? Both systems are on CentOS 7.

3

As noted here it appears that rsyslog uses a different syntax for forwarding over UDP than TCP.

For TCP forwarding:

*.* @@10.0.1.1:514

For UDP forwarding:

*.* @10.0.1.1:514

That change fixed my logging setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.