Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.


I am going insane trying to get rsyslog to send a specific logfile to a remote server over UDP.
This is the rsyslog.conf file for the sending server:

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#                       For more information see
#                       /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################    

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability
$ModLoad imfile   # provides imfile module    

# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup adm

#
# Where to place spool files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/    
#
$IncludeConfig /etc/rsyslog.d/*.conf

I then added *.* @remoteserverIP at the end of /etc/rsyslog.d/50-default.conf.
After that I created the file /etc/rsyslog.d/test.conf with the following content:

$ModLoad imfile
$InputFileName /var/log/test
$InputFileTag test
$InputFileStateFile stat-test
$InputFileSeverity info
InputRunFileMonitor
*.* @remoteserverIP

finally I created /var/log/test and did chown syslog; chgrp adm;service rsyslog restart
My server is listening on UDP 514

tcpdump udp on sending server reveals that the logs are not being sent after doing cat "test" >> /var/log/test
logger -t test "My little pony" sends the data over UDP, is seen by tcpdump and appears on my remote server.
On sending server:

rsyslogd -v
rsyslogd 5.8.6, compiled with:
FEATURE_REGEXP:                         Yes
FEATURE_LARGEFILE:                      No
GSSAPI Kerberos 5 support:              Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported:      Yes
64bit Atomic operations supported:      Yes
Runtime Instrumentation (slow code):    No

Does anyone know what I am doing wrong?
Thanks for the help!

share|improve this question
    
Firewalls on either side or in between? Usually this would talk via udp 514 . –  belacqua Jul 10 '13 at 19:12
    
Typo on UDP port. Has been edited =) The sender at the moment has no iptable rules. Receiver has rule on Input chain: ACCEPT udp -- anywhere anywhere udp dpt:syslog –  user2284355 Jul 10 '13 at 19:17

1 Answer 1

up vote 0 down vote accepted

yes - a bit true. Sometimes it helps - or it is necessary - to do :

sudo apt-get install --reinstall rsyslogd*

or instead reboot the machine totally for to reload the daemons (encluded rsyslogd).

You can look if syslog is scrolling ( means then that rsyslogd is working as daemon ).

share|improve this answer
    
Consider a HUP/reload as well -- kill -HUP $(cat /var/run/rsyslogd.pid) –  belacqua Jul 10 '13 at 21:10
    
I had today a HUP-signal too - simply then rebooted. Then anything was normal again. –  dschinn1001 Jul 10 '13 at 21:15
    
Believe it ot not restalling rsyslog actually worked. Cheers! –  user2284355 Jul 11 '13 at 11:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.