6

i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check i followed the instructions in this article to set up another ec2 instance as the central server and found that messages are not being received. So I tried executing logger -p cron.info TEST on the client machine and found nothing is added to /var/log/cron! Something is clearly not working! But rsyslogd is running:

ps aux | grep rsys

outputs

root 25362 0.0 0.0 183768 1328 ? Sl 14:27 0:00 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5

for reference, here's the rsyslog.conf (removed the forwarding stuff for now until i get it working locally)

#### MODULES ####

$ModLoad imuxsock.so    # provides support for local system logging (e.g. via logger command)
$ModLoad imklog.so      # provides kernel logging support (previously done by rklogd)
#$ModLoad immark.so     # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp.so
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp.so  
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required, 
# not useful and an extreme performance hit
#$ActionFileEnableSync on


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
2
  • both TCP/UDP 514 are commented out.
    – gravyface
    Jul 15, 2012 at 14:40
  • right that's because this is the client config not the server config Jul 15, 2012 at 19:28

1 Answer 1

8

The only thing you need in rsyslog.conf to forward to a remote IP address is

*.* @@192.0.2.25:514;

Regarding your other question...

I tried executing logger -p cron.info TEST on the client machine and found nothing is added to /var/log/cron!

Be sure you restart rsyslogd after changing the configuration; you also need to be sure that /var/log/cron exists.

EDIT

To demonstrate what successful log entries look like, I started rsyslogd with rsyslogd -c4 -d; this sends all debugging to my ssh session. I am logging cron.info to /var/log/syslog. In a different ssh session, I ran logger -p cron.info "my test again"... this is what I see before it logs successfully to /var/log/syslog...

4578.692833385:b6d8fb70: Message from UNIX socket: #3
4578.692906216:b6d8fb70: logmsg: flags 4, from 'Bucksnort', msg Jul 15 10:02:58 mpenning: my test again
4578.692936284:b6d8fb70: Message has legacy syslog format.
4578.692977796:b6d8fb70: main Q: entry added, size now 1 entries
4578.693017277:b6d8fb70: wtpAdviseMaxWorkers signals busy
4578.693079869:b6d8fb70: main Q: EnqueueMsg advised worker start
4578.693117891:b6d8fb70: --------imuxsock calling select, active file descriptors (max 5): 3 5
4578.693210533:b7590b70: main Q: entry deleted, state 0, size now 0 entries
4578.693246128:b7590b70: testing filter, f_pmask 0
4578.693269892:b7590b70: testing filter, f_pmask 255
4578.693296429:b7590b70: Called action, logging to builtin-file
4578.693340007:b7590b70: file to log to: /var/log/syslog
4578.693369336:b7590b70: doWrite, pData->pStrm 0x96b6268, lenBuf 50
4578.693400172:b7590b70: strm 0x96b6268: file 7(syslog) flush, buflen 50
4578.693487314:b7590b70: strm 0x96b6268: file 7 write wrote 50 bytes
4578.693512965:b7590b70: testing filter, f_pmask 0
4578.693530524:b7590b70: testing filter, f_pmask 0
4578.693547988:b7590b70: testing filter, f_pmask 0
4578.693564966:b7590b70: testing filter, f_pmask 0
4578.693581783:b7590b70: testing filter, f_pmask 0
4578.693599197:b7590b70: testing filter, f_pmask 0
4578.693616153:b7590b70: testing filter, f_pmask 0
4578.693632854:b7590b70: testing filter, f_pmask 0
4578.693649647:b7590b70: testing filter, f_pmask 0
4578.693666837:b7590b70: testing filter, f_pmask 0
4578.693683852:b7590b70: testing filter, f_pmask 0
4578.693700593:b7590b70: testing filter, f_pmask 128
4578.693717070:b7590b70: testing filter, f_pmask 0
4578.693734486:b7590b70: testing filter, f_pmask 1
4578.693751624:b7590b70: testing filter, f_pmask 240
4578.693769534:b7590b70: Called action, logging to builtin-pipe
4578.693791155:b7590b70:  (/dev/xconsole)
4578.693820288:b7590b70: main Q:Reg/w0: worker IDLE, waiting for work.
3
  • i restarted rsyslogd (service rsyslog restart) and /var/log/cron does exist but is empty. i think the fact that nothing is forwarding is probably because nothing is even being written to logs. Jul 15, 2012 at 15:00
  • then start rsyslogd with -d and tell us what happens when you try logging again Jul 15, 2012 at 15:01
  • this seems to have been a stupid mistake on my part. i rewrote the config file by hand and restarted the service and it seems to work fine. thanks for your help! Jul 15, 2012 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .