0

I am receving logs on UDP 514 from another server and i have configured rsyslog.conf to save the logs to another custom directory but i am unable to do so, i confirmed through tcpdump logs are getting on 514 but not getting saved. Any thing i've missed?

Here's the config i've made in rsyslog.conf

$umask 0000

# ownership and permissions
$FileOwner punk
$FileGroup punk
$FileCreateMode 0640
$DirCreateMode 0755


# save that when possible
$PreserveFQDN on


# local ruleset (to control local syslogging)
$RuleSet local
$template CustomFormat,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate CustomFormat

$template prod1,"/ab/cs/edl/172.x.x.x/%$now%.log"



if $fromhost-ip == '172.x.x.x' then ?prod1

1 Answer 1

0

I'm not sure about legacy syntax, but you probably need to bind the udp input and port to the ruleset with:

$ModLoad imudp
$InputUDPServerBindRuleset local
$UDPServerRun 514
1
  • i missed out the second line of this config, now it's done.
    – Esskay
    Apr 13, 2020 at 16:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .