Syslog does not record logs received over TCP to a file

Question

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over TCP on port 514, set the facility to local4 for routers and local5 for switches, and am trapping debug for testing.

In /etc/rsyslog.conf, I've enabled TCP and set local4.* to log to /var/log/cisco/routers.log and local5.* to log to /var/log/cisco/switches.log.

I checked SELinux and it didn't report any violations. I've tested with the firewall on (port 514 allowed through) and iptables off. I can see the connections are established and tcpdump shows syslog packets are coming into the server, but syslog does not log anything to the files. It doesn't log anything received to /var/log/messages either.

When I tested with UDP, it works perfectly fine. And this was without modifying $AllowedSender. Any ideas what could be the problem?

Answer 1

Looks like you need to configure the $imtcp portion of the config.

module(load="imtcp" MaxSessions="500")
input(type="imtcp" port="514")

Add that to the beginning of the rsyslog.conf, then restart the service.

Answer 2

Depending on the cisco gear and the IOS version you use it might not be possible to actually send from the gear via TCP to a syslog server.

In short: use UDP. If that is no option this whitepaper might help you on details how you could setup the logging regardless.

https://www.cisco.com/c/en/us/products/collateral/services/high-availability/white_paper_c11-557812.html

short partly relevant qoute from the paper:

"One technique is to deploy a tool like syslog-ng, an open source implementation of the Syslog protocol for UNIX (Solaris) and UNIX-like systems (Linux). It extends the original syslog daemon model with content-based filtering, rich filtering capabilities, and flexible configuration options, and adds important features to Syslog, like using TCP for its transport protocol between syslog-ng servers. (Many hardware vendors do not support TCP transport at this time."

(please note the paper is from 2009)

TCP Support ...[is available in] Cisco IOS Software Releases after 12.4(11)T, 12.2(33)SRB, 12.2(33)SB, and Cisco IOS XE Release 2.1 12.2(33)SXI.

Answer 3

Check rsyslogd really listens on the TCP port using netstat -tplne Maybe you didn't enable TCP socket properly. you also run rsyslog to figure out what s going on (-d)