1

I'm currently sending logs to a rsyslog server (ironport proxy), the server receive udp packets on port 514. I know because i check with tcpdump on the port 514 and i see so much syslog messages.

But the problem is, i can't redirect theses messages into a file. I tried a lot of things I saw on the web (and here too) but it doesn't work. What is the proper way to do this ? If somebody here know the answer to my problem :roll:

Thanks in advance

Improve this question
2

On the server receiving syslog messages, on UDP port 514, you would need to add the following configuration:

$ModLoad imudp
$UDPServerRun 514
$AllowedSender UDP, 10.42.0.0/15 127.0.0.1

$template RemoteStore, "/var/log/remote/%HOSTNAME%/%timegenerated:1:10:date-rfc3339%"
:source, !isequal, "localhost" -?RemoteStore
:source, isequal, "last" ~

Make sure you allowed the right senders (replace 10.42.0.0/15), restart rsyslog. Then, you'll find your remote logs in /var/log/remote/$hostname/YYYY-MM-DD.

In addition / CentOS specifics: there's a fair chance your firewall is enabled. If so, it may be dropping inbound traffic to UDP port 514. Check for your firewall status (systemctl status firewall). If enabled, try to add a rule.

# firewall-cmd --get-default-zone
public
# firewall-cmd --zone=public --add-port=514/udp
# firewall-cmd --permanent
# firewall-cmd --reload

You might want to check for SELinux. If enabled, make sure it allows rsyslog to receive UDP traffic to port 514.

Improve this answer
  • Thank you, i already know theses lines except $AllowedSender. It still doesn't work .. i commented the last two lines and replaced by :star:dot:star: RemoteStore" and the directory was created but only with localhost logs – Poulpy Feb 9 '17 at 16:14
  • Do you have some firewall running on your instance? If so, make sure UDP:514 is opened. Do you have SElinux enabled on this instance? If so, make sure it allows UDP:514 as well. Are you sure rsyslog listens on UDP:514? Note that your local logs may be mentioning about discarding messages, or some reason not to listen, ... – SYN Feb 9 '17 at 16:52
  • 1
    It was SElinux ! i configured it with your link, thank you so much ! – Poulpy Feb 10 '17 at 11:12
0

I recently was scratching my head on this very same problem. I tried the two above suggestions from SYN - still no dice. :(

On RHEL 7 I finally found I needed to add an "ACCEPT" rule in /etc/sysconfig/iptables: 

-A INPUT -m state --state NEW -m udp --dport 514 -j ACCEPT

This must appear before any "REJECT" rules in the file. Once that was in place things were golden! :)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.