[rsyslog-notify] Forum Thread: Re: Rsyslog and syslog-ng - (Mode 'reply')

[noreply at adiscon.com]

User: snakeater 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25298#p25298

Message: 
----------
I do not have any logs. I have opened firewall ports.

My syslog-ng server (192.168.2.10) config:


#############################################################################
# Default syslog-ng.conf file which collects all local logs into a
# single file called /var/log/messages.
#

@version: 3.6
@include "scl.conf"

source s_local {
        system();
        internal();
};
source s_external {
        udp(ip(192.168.1.10) port(514) ); } ;

source s_network {
        udp();
};
destination d_local {
        file("/var/log/messages");};

# Destination hosts folders
destination d_hosts {
file("/var/log/HOSTS/$YEAR/$MONTH/$DAY/$FACILITY.$PRIORITY.log" owner(root)
group(root) perm(0600) dir_perm(0700) create_dirs(yes)); };

destination SIEM {
        udp("192.168.10.10" port(514) );
        };

log {source(s_local);source(s_external); destination(SIEM);
destination(d_hosts); };


My client`s (192.168.1.10) rsyslog.conf:

##### MODULES ####
$ModLoad imuxsock.so # provides support for local system logging (e.g. via
logger command)
$ModLoad imklog.so # provides kernel logging support (previously done by
rklogd)
$ModLoad immark.so # provides --MARK-- message capability


##### GLOBAL DIRECTIVES ####

## Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

## Mark messages are to be written to output modules (in seconds).
$MarkMessagePeriod 7200

##### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
kern.* /dev/console
#
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.err;kern.debug;daemon.notice;mail.crit /var/log/messages

# The authpriv file has restricted access.
authpriv.*;auth.* /var/log/secure

# Log all the mail messages in one place.
mail.* -/var/log/maillog

# Log cron stuff
cron.* /var/log/cron

# Everybody gets emergency messages
*.emerg *

# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log
local7.* /var/log/boot.log

### begin forwarding rule ###
$WorkDirectory /var/spool/rsyslog # where to place spool files
$ActionQueueFileName srvrfwd # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously
$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
*.* @192.168.2.10:514
### end of the forwarding rule ###


I have hope that logs from rsyslog client (192.168.1.10) will getr my
syslog-ng server (192.168.2.10) and then will send this logs to SIEM
(192.168.10.10). If I want to send logs from syslog-ng server to SIEM it is
working fine. I have tcpdump traffic on syslog-ng server but there is no
logs from rsyslog client.