Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I was using Ubuntu 10.4 until last week for storing the log informations of a external device with rsyslog.

After upgrading to ubuntu 12.4 the logging of TCP doesn't works anymore. (There are just no pakets visible - not even with tcpdump - aold ubuntu machine still sees the pakets.) UDP works with the identical configuration on the ubuntu machine and a "use UDP" on the external device.

Are there any changes in rsyslog, that could explain this?

My rsyslog.conf file looks like this (with more comments):

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

$KLogPath /proc/kmsg

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

###########################
#### GLOBAL DIRECTIVES ####
###########################

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

if $fromhost-ip startswith '192.168.0.10' then /var/log/caliDevice.log
& ~
# local/regular rules, like
'.' /var/log/syslog.log

$IncludeConfig /etc/rsyslog.d/*.conf
share|improve this question
add comment

1 Answer 1

Found the problem with some workarounds:

Options are:

  1. Run rsyslog as root by removing the $PrivDropToUser and $PrivDropToGroup options, or possibly overriding them in /etc/resolv.conf.d/ files (i'm not sure if this is possible or not).
  2. Use the 'Sleep' work around suggested on the thread (git commit 1).
  3. Listen on a port > 1024
  4. Pay upstream for 2 weeks work to get the fix done correctly.
share|improve this answer
    
If you have two accounts with the same name you can ask a moderator in chat to combine them for you. –  Tom Brossman Oct 16 '12 at 10:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.