[rsyslog] [basic] No remote logs getting thru

[Harry Putnam]

"Rainer Gerhards" <rgerhards at hq.adiscon.com> writes:


[...]

>> I must be missing something... (I am a novice with this) but I don't
>> see anything different in the suggested config from what I've already
>> posted in the client config.  Except it shows a second remote server
>> being sent logs... which I'm not trying to do.

[...]

>> I've seen nothing so far either in the stock rsyslog.conf example
>> configs or at: http://cookbook.rsyslog.com/node13.html to indicate
>> some better or more precise way to get the server to listen on 514
>
> see http://cookbook.rsyslog.com/node24.html
> and http://www.rsyslog.com/doc-imtcp.html

Thanks for your patience Rainer... ok I get it now.  But see comment
at the end.

Oh, and what about that dashed notation in the example file like:

  *.info;mail.none;authpriv.none;cron.none   -/var/log/messages
What role does the dash play?

[...]

Aaron Nichols <anichols at trumped.org> writes:

> On Mon, Feb 22, 2010 at 9:25 AM, Harry Putnam <reader at newsguy.com> wrote:
>> Also what is needed in the server to make rsyslog listen to port 514?
>> As I've mentioned, that (server) instance of rsyslog is being started
>> with -t514.
>
> You loaded the module but I don't see anything explicitly starting
> inputTCP (not sure if this is required or not). In my config I have:
>
> $ModLoad imtcp.so  # load module
> $InputTCPMaxSessions 1000 # Maximum TCP sessions (default 200)
> $InputTCPServerRun 514 # start up TCP listener at port 514

Yup, those were right on the money, and of course I do see the info at
`netstat -alnp | grep 514' you talked about... its listening now, and
with a restart at both ends... logs info is now comming across.

Many thanks... you input proved to be right on the money.

Oh, do you know if there are many things that can only log by udp?