I'm debugging a strange issue with a logging SaaS solution. We appear to be duplicating logs sent to the SaaS. Logs are sent via an rsyslog forwarder over TLS. I'm trying to see if I can reproduce the issue by running a remote rsyslog server and forwarding a since instance's logs to that server to monitor. Let's call the server where logs originate guineapig and the remote rsyslog server watcher.

watcher is configured to listen on UDP port 514 using configuration like this:

$ModLoad imudp.so
$UDPServerRun 514

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# log everything to the /var/log/remotesyslog file
*.*    /var/log/remotesyslog 

guineapig is configured to forward everything to watcher using its IP address:

$ModLoad imuxsock
$ModLoad imjournal

$ModLoad imudp.so
$UDPServerRun 514

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$IMJournalStateFile imjournal.state

authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler


Inside /etc/rsyslog.d/22-remote-rsyslog.conf on guineapig:

# forward everything over UDP to watcher
*.* @@

Unfortunately, when I then restart the SystemD rsyslog service and attempt to trigger a log message on guineapig, I don't see it appear in the file on watcher:

user@guineapig ~$ logger "please work"
# doesn't work

However, if I directly tell logger where to go, the log line shows up:

user@guineapig ~$ logger -n "please work for real"
# works

I'm having a very difficult time trudging through rsyslog's documentation, but for some reason my logs aren't getting forwarded properly to watcher.

Is there an obvious issue in my configuration on guineapig? Both systems are on CentOS 7.

2 Answers 2


As noted here it appears that rsyslog uses a different syntax for forwarding over UDP than TCP.

For TCP forwarding:

*.* @@

For UDP forwarding:

*.* @

That change fixed my logging setup.

  • For anyone finding this: compile your own latest version of rsyslog. The documentation is terrible and is often for only the newer versions than shipped by your distro. It is worth upgrading for sanity's sake alone. Aug 25, 2019 at 23:07
*.* action(type="omfwd" target="" port="514" protocol="tcp")

From the documentation:

this is the simplest forwarding action:

*.* action(type="omfwd" target="" port="10514" protocol="tcp")

it is equivalent to the following obsolete legacy format line:

*.* @@ # do NOT use this any longer!

  • This fixed it for me! Ugh, lost several hours.
    – iphone007
    Apr 22, 2021 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .