I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over TCP on port 514, set the facility to local4 for routers and local5 for switches, and am trapping debug for testing.

In /etc/rsyslog.conf, I've enabled TCP and set local4.* to log to /var/log/cisco/routers.log and local5.* to log to /var/log/cisco/switches.log.

I checked SELinux and it didn't report any violations. I've tested with the firewall on (port 514 allowed through) and iptables off. I can see the connections are established and tcpdump shows syslog packets are coming into the server, but syslog does not log anything to the files. It doesn't log anything received to /var/log/messages either.

When I tested with UDP, it works perfectly fine. And this was without modifying $AllowedSender. Any ideas what could be the problem?

  • Use the command 'tcpdump port 514' and it will show whether the events are coming into your server. If they're showing up, then the issue is likely with your rsyslog.conf. – Tom Damon Oct 11 '14 at 18:23

Looks like you need to configure the $imtcp portion of the config.

module(load="imtcp" MaxSessions="500")
input(type="imtcp" port="514")

Add that to the beginning of the rsyslog.conf, then restart the service.


Depending on the cisco gear and the IOS version you use it might not be possible to actually send from the gear via TCP to a syslog server.

In short: use UDP. If that is no option this whitepaper might help you on details how you could setup the logging regardless.


short partly relevant qoute from the paper:

"One technique is to deploy a tool like syslog-ng, an open source implementation of the Syslog protocol for UNIX (Solaris) and UNIX-like systems (Linux). It extends the original syslog daemon model with content-based filtering, rich filtering capabilities, and flexible configuration options, and adds important features to Syslog, like using TCP for its transport protocol between syslog-ng servers. (Many hardware vendors do not support TCP transport at this time."

(please note the paper is from 2009)

TCP Support ...[is available in] Cisco IOS Software Releases after 12.4(11)T, 12.2(33)SRB, 12.2(33)SB, and Cisco IOS XE Release 2.1 12.2(33)SXI.


Check rsyslogd really listens on the TCP port using netstat -tplne Maybe you didn't enable TCP socket properly. you also run rsyslog to figure out what s going on (-d)

  • The TCP connections show up as established and tcpdump shows the server is receiving the syslog packets. rsyslog isn't saving what it receives into any file ONLY when TCP mode is on. With UDP mode, it works flawlessly. – Python Novice Oct 11 '14 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.