MonitorWare Knowledge Base

[joeschmo]

Hey all,

So I had been using another syslog server for a long time and recently decided to make the move over to rsyslog and phplogcon so that we could have web searchable logs (I already run RANCID w/ CVS and cvsweb enabled so it seemed only fitting to get our syslog server on the webz too)

I have a few questions that span a few different versions...first I need to apologize in advance if any of these are noob questions, but I have searched for them and I can't find any answers that help me.

1) I have a copy of rsyslog 2.0.6 up and running without any issues, other than the fact that it can't receive udp messages without manual intervention. The only way I can get it to accept udp (network) syslog messages is to stop the service, and then run the rsyslog -r514 from command-line manually. Is there anyway to get it to use this option by default? I need it to start the service with that option enabled. And the "just run it manually" answers I have received in other forums aren't acceptable for me.

2) An extension of the above question: when I try to do the "obvious" solution and use the imudp module, I realized there IS NO imudp.so module in the plugins folder. Where would I even get this module for 2.0.6? The most I can find is a copy of imudp.c and its accompanying make files, but trying to make only outputs errors associated with missing files that belong to the C developers package (which I had installed some time ago off an official CentOS repo, no updates available).

3) Why is it that when I follow all the instructions for compiling and installing the newer versions of rsyslog (3.0.0+), I can get all the way through the process (I searched and found a way to correct the i686 GCC errors) but then it isn't actually installed? Does this have to do with CentOS 5.3 support or is there something I am missing? After doing the make install, etc, there is no rsyslog.conf file in /etc/ like when I install 2.0.6, nor any of the other accompanying directories, except the /usr/lib/rsyslog/ folder, which is fully populated with all the correct files. Admittidly, this may just be due to my inexperience with installing non-rpm packages (although I have done it many times in the past and have never had this much trouble as I have always been able to figure it out).

Any guidance would be GREATLY appreciated as I am getting very frustrated with the amount of time I have put into trying to get everything working correctly. And I thought setting up RANCID and cvsweb was difficult!

Thanks in advance!

[rgerhards]

Hi,

I understand your frustration. Unfortunately, all of this has almost nothing to do with rsyslog but how it is packaged under Centos and how Centos startup works. I do not know that. But I can advise you how to solve the problem: re-post the information to the rsyslog mailing list. Folks there run it on Centos and have answered similar questions in the past. I just don't remember their answers...

Rainer

PS: 2.0.6 is *ancient* I barely remember it existed

[joeschmo]

Ah, thanks for pointing me in the right direction! I took your advice and signed up for the mailing list.

Yea I know 2.0.6 is ancient but unfortunately its the only version with an RPM for centos that works, at least for me. Hopefully I can resolve my issues with getting the newer versions up and running. It'd be nice if someone started making RPMs for centos again. I notice someone was going them for 4.3 a while ago but the link is dead on the rsyslog main site.

Thanks again!