Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having a problem using syslog drains as described in

To summarize, I have an Ubuntu 10.04 instance on EC2 that is running rsyslogd. I've also set up the security groups as they describe, and added a syslog drain using a command like heroku drains:add syslog://

I can send messages from the Heroku console to my rsyslogd instance via nc. I see them appear in the log file, so I know there isn't a firewall/security group issue.  However, Heroku does not seem to be forwarding log messages to the server that heroku drains lists. I would expect to see HTTP requests, Rails messages, etc.

Is there something else I can try to do to figure this out? I'm new to rsyslogd, so I could easily be missing something.

share|improve this question
up vote 4 down vote accepted

I found out what I had done wrong, with the help of Heroku Support. (Thanks guys!)

I had used the wrong security group name (default instead of logplex). (Dynos run under default, so that's why nc worked.)

These are the appropriate values for the fields in the AWS Security Group web interface:

  • Create a new rule: Custom TCP rule
  • Port range: 514
  • Source: 098166147350/logplex (NOTE: not default)
share|improve this answer

Thanks for posting this. One thing got me though. I had to restart my app on heroku before it started writing to the new drains. (after I tried so many other things!)

share|improve this answer
Happy it helped! :) For what it's worth, this may be more appropriate as a comment on my answer rather than a standalone answer itself. – Benjamin Oakes Sep 21 '12 at 14:43
well, it is another answer to the question. but hairs splitting. :) anyway, happy i got it working - also installed splunk which seems to be pretty fantastic to digest the logs. – Tom Carchrae Sep 21 '12 at 21:24
Oh, I thought you were saying that you had to do what my answer was, in addition to your own... My misunderstanding. :) – Benjamin Oakes Sep 21 '12 at 21:49

My two cents here:

Notice that adding the port number (514) at the end of the drain URL is important. I initially though that the 'syslog://' prefix should suffice, but apparently it doesn't.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.