Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on port 514

# tcpdump port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
10:49:52.136520 IP IP_FROM_SERVER_B.55558 > IP_FROM_SERVER_A.syslog: SYSLOG local0.notice, length: 474
10:49:52.136792 IP IP_FROM_SERVER_B.55558 > IP_FROM_SERVER_A.syslog: SYSLOG user.notice, length: 671
10:49:52.136838 IP IP_FROM_SERVER_B.55558 > IP_FROM_SERVER_A.syslog: SYSLOG, length: 79

This is what the file looks like that it should be logging to (I call it /var/log/test.log).

May 16 10:43:19 SERVER_A kernel: imklog 3.22.1, log source = /proc/kmsg started.
May 16 10:43:19 SERVER_A rsyslogd: [origin software="rsyslogd" swVersion="3.22.1" x-pid="12974" x-info=""] (re)start
May 16 10:49:08 SERVER_A kernel: device eth0 entered promiscuous mode
May 16 10:49:53 SERVER_A kernel: device eth0 left promiscuous mode

And here is my rsyslog.conf

# Use traditional timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Provides kernel logging support (previously done by rklogd)
$ModLoad imklog
# Provides support for local system logging (e.g. via logger command)
$ModLoad imuxsock

$ModLoad imtcp
$ModLoad imudp

$InputTCPServerRun 514
$UDPServerRun 514

# Write everything to test.log
*.*                                                     /var/log/test.log

*.info;mail;.none;authpriv.none;cron.none               /var/log/messages


# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                         /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

I have made sure to restart rsyslog every time I edit rsyslog.conf and I am running the start daemon with the -r and -t flags, even though they are deprecated in my current version.

So why isn't anything coming in on port 514 being written to test.log?

Edit: MadHatter requested to see my iptables output:

# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   33  2988            udp  --  eth0   *       IP_ADDRESS_A           
 725K  420M RH-Firewall-1-INPUT  all  --  *      *             

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RH-Firewall-1-INPUT  all  --  *      *             

Chain OUTPUT (policy ACCEPT 231K packets, 189M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain RH-Firewall-1-INPUT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 135K   92M ACCEPT     all  --  lo     *             
   17  1808 ACCEPT     icmp --  *      *             icmp type 255 
    0     0 ACCEPT     esp  --  *      *             
    0     0 ACCEPT     ah   --  *      *             
   66  9195 ACCEPT     udp  --  *      *           udp dpt:5353 
    0     0 ACCEPT     udp  --  *      *             udp dpt:631 
    0     0 ACCEPT     tcp  --  *      *             tcp dpt:631 
90284   11M ACCEPT     all  --  *      *             state RELATED,ESTABLISHED 
    7   420 ACCEPT     tcp  --  *      *             state NEW tcp dpt:22 
 500K  317M REJECT     all  --  *      *             reject-with icmp-host-prohibited 
share|improve this question
You're sure there's no firewall in the way on the receiving syslog server? – MadHatter May 16 '13 at 15:58
I ran iptables -L. It seems to be accepting tcp, but also rejecting other things. (I am new to firewalls, so please excuse my naivety here). ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited – KStensland May 16 '13 at 16:13
I think the config that you have shown here is from the server where the logs are being stored. Right? Can you paste the config from the logging server as well (server_B). And also, iptables rules from server_B. If that also doesn't work, we might need to run rsyslog in debug mode. BTW, which OS and which package of rsyslog. Did it came by rpm or source build? If from source, is it from official adiscon repo or somewhere else. – Soham Chakraborty May 16 '13 at 18:33

I'm no rsyslog expert, but reading the docs you might need

$UDPServerRun 514

as you only have a similar directive for TCP.

share|improve this answer
I actually had that in there. Must have accidentally got deleted during the copy over. Regardless, I tried it again with it and the same problems occurred. – KStensland May 16 '13 at 15:53

Run ps -eaf | grep syslog to make sure it run with option -r.

Otherwise, you should edit /etc/default/rsyslog with option:


Restart syslogd and check.

share|improve this answer
Umm, the OP already said he's running it with -r. – MadHatter May 16 '13 at 16:12
I checked. It is definitely running with those flags. – KStensland May 16 '13 at 16:13

You've clarified that your firewall isn't accepting arbitrary inbound UDP, at least not on port 514, and that will definitely be a problem.

If you would care to paste the output of iptables -L -n -v into your question, we can suggest an iptables line to open up incoming UDP for rsyslog. Failing that, something like

iptables -I INPUT 1 -p udp --dport 514 -j ACCEPT

will probably do the job.

Edit: thanks for the iptables output, but although you permit UDP coming from server_A, you only permit it in the eth0 interface; can you confirm that that's the right interface?

share|improve this answer
I added my iptables -L -n -v output. – KStensland May 16 '13 at 17:05
up vote -1 down vote accepted

I was able to figure out a way to make it work. It may not be the best solution, but my boss suggested I turn off iptables, which made everthing work fine. To stop this from happening again, I ran chkconfig iptables off. That way it will not run again on restart of the server.

Is this a bad idea, even if server A does not have access outside of a small network of servers.

share|improve this answer
I often lose my front door key, so to make things easier I just removed my front door. Now I never have any issues. – Rory Jul 11 '14 at 13:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.