1

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp port 514.

$ModLoad imuxsock
$ModLoad imklog

*.* @server-ip:514

And I also configured server's rsyslog.conf that would accept them.

:source, isequal, "client-host-ip" /var/log/clientlog.log
:source, isequal, "client-host-ip" ~

I checked my firewall settings and it does pass udp 514 but for some reason things are still not working. What I am missing to do?

0

On server:

module(load="imudp") # needs to be done just once 
input(type="imudp" port="514")

Check with netstat -nulp on server.

http://www.rsyslog.com/doc/rsyslog_conf.html

http://www.rsyslog.com/receiving-messages-from-a-remote-system/

  • Sorry, I forgot to mention that I already have these lines aswell. $ModLoad imudp $UDPServerRun 514 netstat -nulp says port is open udp | 0 | 0 0.0.0.0:514 | 0.0.0.0:* | 3082/rsyslogd – Kirill Pashkov Oct 18 '13 at 6:27
  • Run a tcpdump on client and server like so: tcpdump -i any port 514 and udp. Check any firewall in between client and server. Make sure you understand any NAT that may be involved as well. – dmourati Oct 18 '13 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.