Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup a syslog server but it doesn't appear to be working as intended. My client does not seem to be logging to it.

Server Ubuntu 12.04 (

Client Ubuntu 14.04 (

Server Config /etc/rsyslog.conf:

$ModLoad imuxsock 
$ModLoad imklog  
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$RepeatedMsgReduction on
$FileOwner syslog
$FileGroup adm

$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

$template TmplAuth, "/var/log/%HOSTNAME%/%PROGRAMNAME%.log"

I did chown syslog:syslog on the /var/log directory and subdirectories.

Client Config /etc/rsyslog.conf:

Added this to the top of the conf file

*.* @

Restarted rsyslog daemon on both hosts, however no logs seem to be populating on the server in /var/logs

Any thoughts on what I may be doing wrong?

share|improve this question
Perform a packet capture on the server (and probably the client) to see if logs are being forwarded properly. – EEAA Jul 1 '14 at 20:26
Verify your config with rsyslogd -f /etc/rsyslog.conf -N1,also try to run rsyslog in debug mode. Stop the daemon and start with /sbin/rsyslogd -c3 -dn > logfile – b13n1u Jul 1 '14 at 20:35

In my case (Ubuntu 12.04) with a similar configuration directories were also not being created. Events were being logged into the existing files but without the hostname being tagged so it was not obvious that it was (almost) working.

I suggest:

  1. verify that traffic is being received: On the server, try:

    sudo tcpdump tcp port 514

  2. Configure the client to send the correct hostname. Add this line to /etc/rsyslog.conf:

    $LocalHostName [client]

  3. Verify that log entries from [client] are appearing in [server] log files.

  4. Your server config file defines a template named TmplAuth, but nothing is using it. Add this line immediately after it:

    *.* ?TmplAuth

Of course, whenever you change a config file, you'll need to restart rsyslog on that machine.

After the above, my TmplAuth was being applied to all logs (including local): directories were created and a log file for each program generated. This isn't quite what I was after, but represents a big step forward. I'm now looking at changing the template instead of puzzling about why it wasn't working.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.