I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy configuration file format to the new action-based format.
If I have the following for /etc/rsyslog.conf then everything works fine. The remote server receives the messages, and netstat shows an established TCP connection from the client to the remote server:
$ModLoad imuxsock.so
$ModLoad imklog.so
$DefaultNetstreamDriver gtls
$ActionSendStreamDriverAuthMode anon
$ActionSendStreamDriverMode 1
$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.pem
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/local-cert.pem
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/local-key.pem
*.* @@10.50.59.241:6514
From what I'm able to glean from the rsyslog documentation I should be able to do something along these lines:
$ModLoad imuxsock.so
$ModLoad imklog.so
$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.pem
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/local-cert.pem
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/local-key.pem
*.* action (type="omfwd" protocol="tcp" Target="10.50.59.241" Port="6514" StreamDriverMode="1" StreamDriver="gtls" StreamDriverAuthMode="anon")
But this second configuration doesn't work. rsyslogd restarts successfully so I know there's no syntax error with this configuration. But netstat never shows a connection even being attempted to the remote syslog server. What am I missing?