1

I just installed rsyslog on rhel8. So the /etc/rsyslog.conf file is stock. Here's my custom config:

/etc/rsyslog.d/10-remote.conf
module(load="imudp")

ruleset(name="remote_udp"){
    local5.info;local7.debug;local7.info action(type="omfile" file="/var/log/router_temp/v8temp.log" FileCreateMode="0644") & stop
}

input(type="imudp" port="514" ruleset="remote_udp")

I can see traffic coming in using

tcpdump -i ens224 udp port 514

I'm getting messages in the format of:

15:26:21.054704 IP testrouter.notell.net.syslog > myserver.notell.net.syslog: SYSLOG local7.info, length: 171

Nothing is being printed to /var/log/router_temp/v8temp.log. What am I missing here?

I do get messages however, if I run logger from another server:

logger -p local5.info -n myserver.notell.net -P 514 -d "sending over udp from another server"

1 Answer 1

0

My system was permitting traffic from a private network, 514/udp and 514/tcp. When I switched to public 514/udp 514/tcp, I started receiving logs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .