Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2720

Strange problem with rsyslog

Show all headers | View raw

I have a strange problem with rsyslog. I have experienced it on three
different machines with different OSes (Fedora, CentOS, Ubuntu) and
different rsyslog versions, have googled for solution to no avail. I
have no idea what might be going on, maybe someone can help?

The problem is, rsyslogd does not show in logs the messages coming in
from remote machines. Of course, I have the required directives $ModLoad
imudp and $UDPServerRun 514 in the config file, I have also put a
catch-all rule *.* /var/log/alllog on top of all the rules to not miss
any message. However, both in the alllog file and in the
other /var/log/* files there are only messages generated by the local
host.

Netstat shows that rsyslogd is listening on UDP port 514. Tcpdump shows
that messages from other machines are coming in at UDP port 514. But
rsyslogd even started in debug mode ("-d" switch) does not show any
trace of these messages (however, it informs precisely about any of the
local host generated messages).

What's more interesting, when I tried to send a test message from
another computer to rsyslog using a method I found on some forum:

echo "test message" | nc -w0 -u 192.168.2.5 514

(where 192.168.2.5 is the address of the problematic rsyslogd machine),
this message *is* logged by rsyslogd in the alllog file.

How to solve this???
-- 
Regards,
   Jaroslaw Rafa
   raj@ap.krakow.pl
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Back to comp.os.linux.networking | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Strange problem with rsyslog Jarosław Rafa <raj@ap.krakow.pl> - 2014-02-14 09:16 +0100
  Re: Strange problem with rsyslog Joe Beanfish <joebeanfish@nospam.duh> - 2014-02-14 14:35 +0000
    Re: Strange problem with rsyslog Jorgen Grahn <grahn+nntp@snipabacken.se> - 2014-02-15 06:34 +0000
  Re: Strange problem with rsyslog Eric Pozharski <whynot@pozharski.name> - 2014-02-15 13:32 +0200

csiph-web