1

I have trouble receive logs from router and other devices after migrating from CentOS 6.8 to CentOS 7.3. Could you please help take a look at it and show me how to fix it? These logs are very important to me since all my works are based on them. Thanks very much.

below info FYI

[user@host ~]$ rsyslogd -v

    rsyslogd 7.4.7, compiled with:
    FEATURE_REGEXP:                         Yes
    FEATURE_LARGEFILE:                      No
    GSSAPI Kerberos 5 support:              Yes
    FEATURE_DEBUG (debug build, slow code): No
    32bit Atomic operations supported:      Yes
    64bit Atomic operations supported:      Yes
    Runtime Instrumentation (slow code):    No
    uuid support:                           Yes

[user@host ~]$ cat /etc/centos-release

CentOS Linux release 7.3.1611 (Core)

[user@host ~]# ll -dZ /var/log/usb

drwxr-xr-x. root root system_u:object_r:var_log_t:s0   /var/log/usb

[user@hosts ~]# nc -vu 192.168.0.111 514

Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 192.168.0.111:514.

[user@host ~]# nc -vu 192.168.0.1 514

Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 192.168.0.1:514.

[user@host ~]$ ip route sh

default via 192.168.0.1 dev enp3s0  proto static  metric 100
192.168.0.0/24 dev enp3s0  proto kernel  scope link  src 192.168.0.111  metric 100
192.168.2.0/24 dev enp0s20u2c2  proto kernel  scope link  src 192.168.2.113  metric 100

[user@host ~]# journalctl --unit=rsyslog

-- Reboot --
Jan 07 01:46:49 host systemd[1]: Starting System Logging Service...
Jan 07 01:46:49 host systemd[1]: Started System Logging Service.

/etc/rsyslog.conf (only un-comment)

$ModLoad imuxsock 
$ModLoad imjournal
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerAddress 192.168.0.111
$UDPServerRun 514
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state

/etc/rsyslog.d/networklog.conf

$template router, "/var/log/usb/router/router.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.1" -?router
& ~

$template nas, "/var/log/usb/qnap/qnap.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.110" -?nas
& ~

$template switch, "/var/log/usb/switch/switch.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.2" -?switch
& ~

$template bridge, "/var/log/usb/bridge/bridge.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.5.3" -?bridge
$ ~

$template ap, "/var/log/usb/ap/ap.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.4" -?ap
$ ~

/etc/sysconfig/iptables

# Generated by iptables-save v1.4.7 on Tue Jul 28 19:40:14 2015
*filter
#:INPUT ACCEPT [229:17291]
#:FORWARD ACCEPT [0:0]
#:OUTPUT ACCEPT [133:14088]

# ssh daemon
-A INPUT -p tcp -i enp0s20u2c2 -d 192.168.2.113 -m state --state NEW,ESTABLISHED,RELATED -m tcp --dport 22 -j ACCEPT

# syslog daemon
-A INPUT -i enp3s0 -d 192.168.0.111 -p udp -m state --state NEW,ESTABLISHED,RELATED -m udp --dport 514 -j ACCEPT
-A OUTPUT -o enp3s0 -s 192.168.0.111 -p udp -m state --state NEW,ESTABLISHED,RELATED -m udp --sport 514 -j ACCEPT


# default DROP rule
-A INPUT -j DROP
COMMIT
# Completed on Tue Jul 28 19:40:14 2015

[user@host network-scripts]# cat ifcfg-enp3s0

TYPE=Ethernet
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=enp3s0
UUID=6201e661-dfc9-4c1a-aad9-3fc1330d79e4
DEVICE=enp3s0
ONBOOT=yes
IPADDR=192.168.0.111
PREFIX=24
GATEWAY=192.168.0.1
DNS1=8.8.8.8
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_PRIVACY=no
1

hello I m thread opener.

found out that CentOS 6.8 and CentOS 7.3 come with different version of rsyslogd it seems that my old conf code does not work with rsyslog 7 there are many sample conf on internet to start with.

To start debug disable rsyslog using service or systemctl and issue below commands

/path/to/rsyslogd -N 1  ##### check conf syntax
/path/to/rsyslogd -dn   ##### run in debug mode

Thanks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.