Information: Forum is in read-only mode
For details and other support options see https://www.adiscon.com/news/support-forum-set-to-read-only-mode/

Rsyslog not forwarding messages and not logging locally

This is the place for you, if you got rsyslog up and running but wonder how to make it do what you want.

Moderator: alorbach

Google Ads


Rsyslog not forwarding messages and not logging locally

Postby sloe » Fri Feb 16, 2018 5:05 pm

Hi,

I have this in my rsyslog.conf

What works: DynaFile logs the messages correctly into the right location.
What doesn't:
* No messages are relayed to the syslog1 and syslog2 servers.
* No message are relayed to the be1:10514 be2:10514 servers
* No messages are logged locally.

I don't know why not. Any ideas?

Here is the config ( with other bits snipped out )
Code: Select all
$ModLoad imsolaris      # for Solaris kernel logging
$ModLoad imtcp
$ModLoad imudp
$InputTCPMaxSessions 600
$InputTCPMaxListeners 60
$WorkDirectory /var/spool/rsyslog/work
$ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format
$template DynaFile,"/var/spool/rsyslog/%HOSTNAME%.log"
template json-template2, "{\"message\":\"%msg:::json%\",\"fromhost\":\"%HOSTNAME:::json%\",\"facility\":\"%syslogfacility-text%\",\"priority\":\"%syslogpriority-text%\",\"timereported\":\"%timereported:::date-rfc3339%\",\"timegenerated\":\"%timegenerated:::date-rfc3339%\"}"
$RuleSet Local
*.info        /var/adm/messages
*.emerg         :omusrmsg:*
*.alert         :omusrmsg:root
& stop
$RuleSet Remote
*.*     ?DynaFile
*.info          @syslog1
*.info          @syslog2
*.warn          @@(o)be1:10514;json-template2
*.warn          @@(o)be2:10514;json-template2
& stop
$DefaultRuleset Remote
$InputTCPServerBindRuleset Remote
$InputTCPServerRun 514
$InputUDPServerBindRuleset Remote
$UDPServerRun 514


Any tips greatly appreciated.

Soph.
sloe
Avarage
 
Posts: 10
Joined: Mon Feb 12, 2018 9:27 am

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Re: Rsyslog not forwarding messages and not logging locally

Postby rgerhards » Fri Feb 16, 2018 5:33 pm

I actually don't remember the specifics of the obsolete legacy format that you use, but I think the Local ruleset is neither bound nor otherwise used.

Regarding the forwarding, I do not see anything that looks like a problem, so maybe the incoming messages have wrong PRI? As a test, you could forward everything.

I would strongly recommend to change the config to current format - it makes understanding complex configurations much easier.

HTH
Rainer
rgerhards
Site Admin
 
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Google Ads



Return to Configuration

Who is online

Users browsing this forum: No registered users and 1 guest

cron