Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have fully working remote syslog server which receiving logs from servers and devices. I have try to setup cPanel/WHM syslog to forward logs to that remote server but so far I'm not seeing anything forwarded from cPanel/WHM server.

rsyslog.conf on the cPanel server is default + those changes:

$ModLoad imuxsock 
$ModLoad imklog
*.* @@<remote-syslog-server-ip>

When I remove cPanel server from the allowed senders on the remote syslog server I see that something is trying to connect to it. When I will put it back that message disappear but not getting any logs.

UPDATE1: I have try to send syslog message from a console using NC command:

nc -w0 -u <remote-rsyslog-server-ip> 514 <<< "testing again from server xyz"

and this is wasn't received by a remote syslog (neither Splunk)

Then I have tested over TCP

 nc -w0 -u <remote-rsyslog-server-ip> 514 <<< "testing again from server xyz"

And this one is not coming on a syslog but I can see on Splunk indexes.

Any clue what is going on?

Thanks

share|improve this question
    
Is the remote server listening for TCP or UDP messages? Specifying @@ tells rsyslog to use TCP. Use a single @ for UDP. –  EEAA Sep 12 '13 at 18:24
    
Listening to both and I have tested both from cPanel - no luck. For an example Webmin server or clean CentOS has no issue to forward via TCP or UDP. –  JackTheKnife Sep 12 '13 at 18:28
    
Well in that case, for this (and many other reason), ditch cPanel. Serious. Kick that POS to the curb. –  EEAA Sep 12 '13 at 18:29
    
This is what I have got from cPanel Support Team: cPanel, by default, does not provide any configuration of syslog or rsyslog for sending logs to a remote server, but it also does not change the configuration in such a way that would prevent that –  JackTheKnife Sep 12 '13 at 18:33

1 Answer 1

OK guys - I have that resolved. Issue was with forwarding logs to a remote syslog server via TCP using private IP (cPanel is not supporting NAT by default)

Here is a workaround:

Edit local /etc/rsyslog.conf and add that line:

*.info;mail.none;authpriv.none @<remote-syslog-server-public-ip>:514

Edit remote /etc/rsyslog.conf and add that line:

$AllowedSender UDP, X.Y.Z.0/24
$AllowedSender TCP, X.Y.Z.0/24

where X.Y.Z is your public IP from where logs are forwarded.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.