We have rsyslog conifigured and configured is as below

$ grep -vE '^#|^$' /etc/rsyslog.conf
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
$ModLoad imfile
auth,user.*                             /var/log/messages
kern.*                                  /var/log/kern.log
daemon.*                                /var/log/daemon.log
syslog.*                                /var/log/syslog
lpr,news,uucp,local0,local1,local2,local3,local4,local5.*       /var/log/unused.log
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log
$ModLoad imudp
$UDPServerRun 514
authpriv.* @<XXX.XXXX.XXX.XXX>
auth.notice @<XXX.XXXX.XXX.XXX>
auth.info @<XXX.XXXX.XXX.XXX>

We are sending these logs to another server where it feeds to another application. But we are getting complaints as still the servers are sending syslog events in TCP mode only but not in UDP.

How can I troubleshoot the issue and what wrong I mentioned in the configuration ?

Note: $IncludeConfig /etc/rsyslog.d/*.conf including only one file and there we are stating what server to use when there is a failover.

$ netstat -tnlpu | grep rsyslog
udp        0      0       *                               731/rsyslogd
udp        0      0 :::514                      :::*                                    731/rsyslogd

Please help.

Thank you.

  • It seams all to be ok in your configuration. I've just check in udp logs between rsyslog in Centos 7.4 (client) and Debian 7.8(server). In Debian in default rsyslog configuration I've uncommented $ModLoad imudp and $UDPServerRun 514. In Centos 7.4 I've added that line *.* @xxx.xxx.xxx.xxx:514. After all, I restart service on both machines. All works. To ensure I've run tcpdump udp -i <if> and saw received packets. Maybe on clients you've forgotten '@' instead '@@'? – Yurij Goncharuk Mar 14 '18 at 12:33
  • @YurijGoncharuk, you mean I should be adding "auth.info @@<XXX.XXXX.XXX.XXX>" or you are talking about Rsyslog server end configuration ? – rɑːdʒɑ Mar 14 '18 at 12:34
  • 1
    No, I assume that in rsyslog.conf at clients address address consist of two symbols '@@'. '@' - UDP, '@@' - TCP writing in documentation. – Yurij Goncharuk Mar 14 '18 at 12:45
  • @YurijGoncharuk I beleive single @ would do it sharadchhetri.com/2014/03/01/… – rɑːdʒɑ Mar 14 '18 at 12:48
  • Does your server listen only UDP port? 'netstat -lnu|grep 514' – Yurij Goncharuk Mar 14 '18 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.