Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup an rsyslog server (based on CentOS 6) that works fine with some remote hosts. But, when I added a Cisco ASA firewall, it does log its messages!

The rsyslog.conf is the following:

# rsyslog v5 configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see
### MODULES ####
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

The configuration file is the following:

##RSYSLOG configuration file for Remote Logs
$FileCreateMode 0640 
$template PerHostLog,"/var/log/remote/%HOSTNAME%.log"

if ($fromhost-ip startswith '10.1.5' or $fromhost-ip startswith '10.2.8') then -?PerHostLog
& ~

Is there anything wrong with those rules? TCPdumps show that messages from host reach the server, but syslog chose to ignore them. Why??

share|improve this question
My first guess would be to keep things simple, use two if statements each with only one $fromhost-ip startswith. Also, I'd suggest always using if ... then { stuff } because the { } just keep things explicitly defined. – etherfish Jan 23 '14 at 12:22
I did. This is just an example. I used separate /etc/rsyslog.d/test.conf file. If I specify an explicit file (eg /var/log/remote/, the log file is created but remains empty. Is it possible that the source message is ignored for some reason, like because it is local6 ? – Peter Jan 23 '14 at 12:40
I think you're missing the a . before the -?PerHostLog, but.. I'm learning a whole new side of rsyslog today. Also, I read that it's better to use %FROMHOST% because sometimes %HOSTNAME% can be missing/incorrect. I'd throw in a . /var/log/test before your stop just to confirm that the problem is the syntax. – etherfish Jan 23 '14 at 13:02

I solved it. It was a routing(!) error. Server could not reach the message originator, thus, the message was not processed from rsyslog... Go figure...

share|improve this answer
Just a tip, but I always will use tcpdump on the syslog server to see if the network stack is even getting the log packets. (With appropriate filters for your expected source host.) – Aaron Copley Jan 23 '14 at 15:28
tcpdump was receiving packages! – Peter Jan 24 '14 at 7:56
Something else must have been going on. rsyslog does not send any packages (it's UDP after all), so it cannot know whether it's able to reach the originator. – Matthias Urlichs Jan 24 '14 at 10:53
Syslog traffic can certainly be TCP. Though, I am not sure if it's an option for Cisco. – Aaron Copley Jan 24 '14 at 15:23
Well, the syslog is TRANSFERED via UDP. Since I solved the problem with a simple "route add", obviously it's working and it was a requirement. Just to note that I had the same understanding myself too. – Peter Jan 27 '14 at 18:41

I was having the same issue. Receiving logs from dozens of ASA devices but not from specific one. Tcpdump showed that the packets were arriving. My problem was that the kernel was filtering its packets. Solved by modifying these two keys in /etc/sysctl.conf:

net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0

I had to restart the server because sysctl -p was returning errors from a couple of keys that I didn't want to modify

share|improve this answer

I do believe I have your answer:

 $AllowedSender UDP,, [::1]/128,,

After reading enough of the documentation, I'd confirm that the messages are in fact getting received and then refining the filters/match rules.

Please do let me know if/how you get this fixed; you've definitely piqued my curiosity.

Good Luck.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.