New answers tagged rsyslog
This bug was fixed in version 2.24.2-1 of logger(1). A workaround is to specify a socket (which is then ignored): logger -n <ip> -d -P 514 -u /tmp/ignored Message That worked for me, using logger from util-linux 2.20.1 on Ubuntu 14.04. See link from hackru's answer, especially message #15.
Try this LEGACY rsyslog formatted version: # Forward apache logs to graylog2 server $ModLoad imfile # needs to be done just once $InputFileName /var/log/httpd/access.log $InputFileTag ApacheAccessLog: $InputFileStateFile access.log.statefile $InputFileFacility local4 $InputFileSeverity info $InputRunFileMonitor $InputFileName /var/log/httpd/error.log ...
I am not sure what changed, but now it's working. Here are a some details that might help others: logger "hello" was enough. no need to pass any parameters. echo hello | nc -u 172.17.42.1 514 is actually a better test since this should work from a docker container. from some reason loger "hello" doesn't work inside a container.
Not exactly a solution, but good enough workaround. For rsyslog, yes, nightly cron job with a little 'sed' command For graylog: You can use drools rules to rewrite the message before it reaches graylog engine. (source: https://www.graylog.org/documentation/general/rewriting/ )
There's no big difference to setting this up if your cert is "legit". A widely trusted certificate is characterized by having its trust anchor (aka the root or CA certificate) seeded in the OS's or browser's trust store. Assume you have server.example.com.key and server.example.com.csr. Your CA sends you back your certificate, server.example.com.crt, and ...
tcpdump (and its replacement tshark) defaults to the "lowest numbered" interface. Typically this is eth0. In order to capture traffic on the OpenVPN interface tun0 you need something like this, tcpdump -i tun0 port 6514. (The interface name any can be used to capture on all interfaces.) See if you get any syslog traffic there. Another thing to try is to see ...
Top 50 recent answers are included