3

I installed rsyslogd on ubuntu server, started it and everything looks fine, but the port the server should listen on is not opened.

ubuntu@node7:~$ sudo service rsyslog restart
rsyslog stop/waiting
rsyslog start/running, process 14114

Netstat shows it is not listening:

ubuntu@node7:~$ netstat -tlan
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0    320 172.22.0.17:22          10.8.8.38:61335         ESTABLISHED
tcp6       0      0 :::22                   :::*                    LISTEN     
tcp6       0      0 :::2776                 :::*                    LISTEN     
tcp6       0      0 :::2777                 :::*                    LISTEN     
tcp6       0      0 172.22.0.17:2777        172.22.0.11:56554       ESTABLISHED
tcp6       0      0 172.22.0.17:2776        172.22.0.11:39780       ESTABLISHED

This is how /etc/rsyslog.conf looks like (most comments omitted):

ubuntu@node7:~$ cat /etc/rsyslog.conf     
#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)

$ModLoad imtcp
$InputTCPServerRun 514

###########################
#### GLOBAL DIRECTIVES ####
###########################

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on
$WorkDirectory /var/spool/rsyslog

$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup adm

$IncludeConfig /etc/rsyslog.d/*.conf

In /etc/rsyslog.d/35-server-per-host.conf I have following lines, and I suspect this can be the cause. What does it mean?

# Stop processing of all non-local messages. You can process remote messages
# on levels less than 35.
:fromhost-ip,!isequal,"127.0.0.1" ~

and if it is, how could I change it to have server listening and receiving and logging messages?

UPDATE:

I commented out suspected line, but still it's not listening on port 514

4 Answers 4

6

AppArmor is possibly blocking rsyslogd from listening on this port. You can verify this by looking in the system log:

grep apparmor /var/log/syslog

If you see lines mentioning rsyslog then this is probably the cause. Edit /etc/apparmor.d/local/usr.sbin.rsyslogd (or /etc/apparmor.d/usr.sbin.rsyslogd if that doesn't exist) and add this between the curly braces:

network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,

Then run service apparmor reload and service rsyslog restart.

1
  • No "apparmor" in /var/log/syslog. ps aux | grep apparmor also doesn't snow it running.
    – amorfis
    Commented Nov 21, 2012 at 8:46
5

By default rsyslod listen on unix socket, not on TCP socket. Uncomment or add this two lines:

module(load="imtcp")
input(type="imtcp" port="514")

That's all, have fun !

Arno

1
  • Thank you so much for this sample of rsyslog's advanced syntax for loading-a-module-with-parameters! It's a PITA to spot in the official docs; and many module parameters (like address for imtcp) don't have an obsolete legacy equivalents a-la $UDPServerAddress.
    – ulidtko
    Commented Dec 11, 2018 at 15:21
4

Solution (or workaround) was to set port to big value. It works on port 10514.

For example in RHEL 7.9 change file

/etc/rsyslog.conf

# listen to get log from nifi
module(load="imudp")
input(type="imudp" port="10514")

module(load="imtcp")
input(type="imtcp" port="10514")
1
  • 3
    This implies that for whatever reason, the daemon isn't starting as root, and so can't bind a port below 1024. Commented Nov 21, 2012 at 14:26
0

rsyslog runs as user syslog: solution for me to stop this and let it run as root. Then it listens on port 514

Comment out this in /etc/ryslogd.conf

$PrivDropToUser syslog

1
  • 1
    Can you post a link to the rsyslog documentation that describes that configuration option? Commented Dec 5, 2018 at 13:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .