MonitorWare Knowledge Base

Ok so I just started to get into using rsyslog. My main goal is to organize all of the system log files from both linux and Windows machines into one centralized database. So far, I am writing my rsyslog messages to my MySQL database just perfectly. However, I am having trouble when it comes to having a windows machine send its event logs to my rsyslog server.

I have narrowed the problem down to the fact that I cannot load the imudp.so and the imtcp.so modules. I put the ModLoad at the beginning of my rsyslog.conf file, but then when I try to start the service, my logs say that it cannot find the modules specified. I looked in the folder that they were supposed to be in and sure enough, they are not there. I thought I installed and set this up correctly, and the ommysql.so module file is in the correct spot so I don't see why the others are not.

Can someone please give me some advice as to what I can do to fix this? Is it just something I missed when I configured the install package, or is it something more?

Edit: I forgot to mention that I am using FC8, and had to use yum install rsyslog-mysql to get mysql support to work, is there something similar for tcp and udp?

brief, from the pda: F8, as far as i know, features the v2 branch of rsyslog. it does not have input plugins. listners are configured via -r and -t command line options.

check the doc set that comes with your version for details.

hth
rainer

I don't really understand your response. When I try to add the following at the top of my rsyslog.conf file:

$ModLoad imudp.so

I get an error that says that it cannot find the module that is specified. I don't understand what you mean by -r. Can you please be more specific or suggest another way of making my server listen on UDP port 514 for other servers sending me their syslog messages?

**Edit: Nevermind, I figured out that -r isn't exactly a command line option, but instead you need to add it to the file /etc/sysconfig/rsyslog. Thanks for the help.