[rsyslog-notify] Forum Thread: remote logs on centos 6.5 rsyslog 5.8 - (Mode 'post')

[noreply at adiscon.com]

User: makimoto 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24900#p24900

Message: 
----------
Hi all

Yesterday I posted a help plea for my setup to the mailing list. (I've
realised since the forum seems to be a far more appropiate place). I was
told to upgrade my rsyslog which was at v3.x (standard in repo on centos5)
to get access to $RuleSet which would actually be ideal for my needs.

So today I made a test server with centos 6.5 which comes with rsyslog
v5.8. Local logging works. I can use "logger" and it works, but the bit
about receiving logs from other machines seems to be out of my reach. :( 

I've not even activated $RuleSet yet. But I do not receive any logs from
client boxes. From my config (below) I understand I should be receiving
external logs to /var/log/messages. 

I'm listening to both TCP and UDP as there will be a phase where I need to
listen to both while I migrate clients sending logs over UDP tp TCP.

/etc/rsyslog.d is empty by the way, and selinux disabled and no FW rules.

The client config works. I know this because it's happily sending logs to a
machine which has syslog-ng, althought, it's losing most of them. Hence I
want to replace that with rsyslog :) 

The relevant client configs I've tried are:

[code:22awffws]*.* @172.26.23.151:514[/code:22awffws]

and 

[code:22awffws]*.* @@172.26.23.151:601[/code:22awffws]

__ANY__ help appreciated! :)


Here my server config:

[code:22awffws]# rsyslog v5 configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see
http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g.
via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by
rklogd)
$ModLoad imtcp    # Provides TCP syslog reception
$ModLoad imudp    # Provides UDP syslog reception

$UDPServerRun 514
$InputTCPServerRun 514

#### GLOBAL DIRECTIVES ####

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console
kern.*                                                 
/var/log/kernel_msg.log

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none               
/var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                 
-/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                         
/var/log/spooler

# Save boot messages also to boot.log
local7.*                                               
/var/log/boot.log
[/code:22awffws]