MonitorWare Knowledge Base

Hello all!

I am working on configuring a central syslog server listening on TCP port 515. I am able to configure the server to listen on UDP:514 without any problems. However, getting the server to listen on TCP:515 is proving to be more problematic for me.

I am running rsyslog version:

Code: Select all

rsyslogd 2.0.0, compiled with:
        FEATURE_PTHREADS (dual-threading):      Yes
        FEATURE_REGEXP:                         Yes
        FEATURE_LARGEFILE:                      Yes
        FEATURE_NETZIP (message compression):   Yes
        SYSLOG_INET (Internet/remote support):  Yes
        FEATURE_GSSAPI (GSSAPI Kerberos 5 support):     No
        FEATURE_DEBUG (debug build, slow code): No


I can't seem to get it to start up and listen for TCP syslog messages. Here is a snip from my conf file:

Code: Select all

$ModLoad imtcp
$InputTCPServerRun 515


The rest of the conf file is all basic. Below is the error I get in /var/log/messages

Code: Select all

Jan 30 09:40:56 sandbox rsyslogd:could not load module '/usr/lib/rsyslog/imtcp', dlopen: /usr/lib/rsyslog/imtcp: cannot open shared object file: No such file or directory
Jan 30 09:40:56 sandbox rsyslogd:the last error occured in /etc/rsyslog.conf, line 1
Jan 30 09:40:56 sandbox rsyslogd:invalid or yet-unknown config file command - have you forgotten to load a module?


Now, everything works fine for UDP listening, but I need to run TCP. Also, I need to stick with version 2.0 because of company policy which prevents loading packages from third parties. What am I doing wrong?

Thanks.

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

It looks like imtcp is not build or is in a location other than the default path. Can you locate it somewhere on your system? If so, you can load it using the full path name ("$ModLoad /path/to/imtcp"). With your company policy, though, I can not offer any advise [except that v2 also supports TCP]

Thanks for the fast reply. imtcp doesn't exist on the file system. As a matter of fact, the directory /usr/lib/rsyslog is empty. I searched for other modules and couldn't find any of them. I am using CentOS 5.2 on sender and receiver. I installed rsyslog 2.0 via a yum package.

so you are you using v2 or v3? imtcp does NOT exist in v2. You need to specify a command line option with that version (I think it was -t port, but better check the man page...).

If you use v2, that doc is probably interesting for you, too:

http://www.rsyslog.com/doc-v3compatibility.html

You need to read it inverse, but then it tells you a lot of what is different in v2.

Thanks! The -t option did the trick. Now, one last sticky question.... Will I be able to do 'reliable' syslogging using V2? I want to do something similar to what is posted here: http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html I would like rsyslog v2 to queue the messages until the central server is back online. Is that possible?

I am sorry, but that's one of the important v3 features. Actually, this is what required the majority of code changes from v2 to v3.

Thanks for the heads up. I will see what options I have. Again, thanks for the fast responses.