I am receving logs on UDP 514 from another server and i have configured rsyslog.conf to save the logs to another custom directory but i am unable to do so, i confirmed through tcpdump logs are getting on 514 but not getting saved. Any thing i've missed?

Here's the config i've made in rsyslog.conf

$umask 0000

# ownership and permissions
$FileOwner punk
$FileGroup punk
$FileCreateMode 0640
$DirCreateMode 0755

# save that when possible
$PreserveFQDN on

# local ruleset (to control local syslogging)
$RuleSet local
$template CustomFormat,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate CustomFormat

$template prod1,"/ab/cs/edl/172.x.x.x/%$now%.log"

if $fromhost-ip == '172.x.x.x' then ?prod1

I'm not sure about legacy syntax, but you probably need to bind the udp input and port to the ruleset with:

$ModLoad imudp
$InputUDPServerBindRuleset local
$UDPServerRun 514
| improve this answer | |
  • i missed out the second line of this config, now it's done. – Esskay Apr 13 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.