1

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp port 514.

$ModLoad imuxsock
$ModLoad imklog

*.* @server-ip:514

And I also configured server's rsyslog.conf that would accept them.

:source, isequal, "client-host-ip" /var/log/clientlog.log
:source, isequal, "client-host-ip" ~

I checked my firewall settings and it does pass udp 514 but for some reason things are still not working. What I am missing to do?

1 Answer 1

0

On server:

module(load="imudp") # needs to be done just once 
input(type="imudp" port="514")

Check with netstat -nulp on server.

http://www.rsyslog.com/doc/rsyslog_conf.html

http://www.rsyslog.com/receiving-messages-from-a-remote-system/

2
  • Sorry, I forgot to mention that I already have these lines aswell. $ModLoad imudp $UDPServerRun 514 netstat -nulp says port is open udp | 0 | 0 0.0.0.0:514 | 0.0.0.0:* | 3082/rsyslogd Oct 18, 2013 at 6:27
  • Run a tcpdump on client and server like so: tcpdump -i any port 514 and udp. Check any firewall in between client and server. Make sure you understand any NAT that may be involved as well.
    – dmourati
    Oct 18, 2013 at 6:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .