MonitorWare Knowledge Base

I've been trying to set up an rsyslog server to be a centralized point for all our log files to go to. However, I cannot seem to get the server to collect the log messages coming from the client computers. I have managed to get the clients to send MySQL data. Although I think I managed to do this through mySQL, as the logged information never shows up in log files, only in the database.

Here is a clip of my server rsyslog.conf:
$ModLoad immark.so
$ModLoad imudp.so
$ModLoad imuxsock.so
$ModLoad imklog.so
$ModLoad ommysql.so
$ModLoad imtcp.so

# This line logs EVERYTHING to the SQL database.
#*.* :ommysql:<SERVER>,<DB>,<SQLuser>,<SQLpw>
#$template dbFormat,"insert into SystemEvents (Message, Facility,FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%',%syslogpriority

*.* /var/log/rsyslogtemp

and here is my client rsyslog.conf:
$ModLoad immark.so
$ModLoad imudp.so
$ModLoad imtcp.so
$ModLoad imuxsock.so
$ModLoad imklog.so
$ModLoad ommysql.so

$template traditional,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n"

*.* @myLogServer

I run rsyslogd with -c3 -m 0 parameters, although I have tried the deprecated -r, which does not help. Can anyone offer any suggestions?

Thanks,
Chris

MODERATOR EDIT: turned off smilies for better readibility

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

Two major things:
- On the server side, you need to configure the TCP server. Check the imtcp.so documentation for details: http://www.rsyslog.com/doc-imtcp.html

- Your client's action "*.* @myLogServer" is sending to myLogServer:514 (UDP). To send via TCP, use two @ signs:
*.* @@myLogServer

If you use a port other than the default 514, be sure to include that. Check the Actions section under http://www.rsyslog.com/doc-rsyslog_conf.html for more details.

-HKS

hi,
I suggest you to run rsyslog with -c3 -f option.
Apart from adding modules this single line is enough in server's configuration file

$InputTCPServerRun 514

Apart from adding module, you need not change anything in clients configuration file except specifying the path to server

*.* @@servers ip-address:514

Regards,
Prakash