I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over TCP on port 514, set the facility to local4 for routers and local5 for switches, and am trapping debug for testing.
In /etc/rsyslog.conf, I've enabled TCP and set local4.* to log to /var/log/cisco/routers.log and local5.* to log to /var/log/cisco/switches.log.
I checked SELinux and it didn't report any violations. I've tested with the firewall on (port 514 allowed through) and iptables off. I can see the connections are established and tcpdump shows syslog packets are coming into the server, but syslog does not log anything to the files. It doesn't log anything received to /var/log/messages either.
When I tested with UDP, it works perfectly fine. And this was without modifying $AllowedSender. Any ideas what could be the problem?