I've got logservers set up to receive from clients on UDP/514 and write to a file with hostname/IP as the name using a ruleset. I've had the same configuration on different servers and sometimes it doesn't work, I've had to muck around to get it to work. I've perused the documentation and can't find much that makes sense.

On RHEL 9 with rsyslog v8.2, input line in the default location, remote added.

` input(type="imudp" port="514" ruleset="remote")

& stop`

This works for the remotes but local logging stops, ie: nothing shows up in /var/log/messages or anywhere else things should go from the local host, the remotes go where "remote" specifies as expected.

However, in my latest go-around, I ended up with this working:

` input(type="imudp" port="514")

:inputname, isequal, "imudp" ?DynFile;TraditionalFormatWithPRI

& stop `

This is working as desired and sends the logs received on UDP/514 to the appropriate files and the regular local logging continues to work. Why does the first one eat local logging? What am I missing?


1 Answer 1


Local programs generally log via /dev/log rather than using UDP.

While Rsyslog can receive these messages using the imuxsock input module, these days /dev/log is managed by journald, so instead you need the imjournal module.

The stock rsyslog configuration on RHEL 9 includes the following:

module(load="imuxsock"    # provides support for local system logging (e.g. via logger command)
       SysSock.Use="off") # Turn off message reception via local log socket;
                          # local messages are retrieved through imjournal now.
module(load="imjournal"             # provides access to the systemd journal
       UsePid="system" # PID nummber is retrieved as the ID of the process the journal entry originates from
       StateFile="imjournal.state") # File to store the position in the journal

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .