Good morning! I'm playing with Graylog today and everything is working well on Ubuntu, but the two CentOS 7.1 servers I've attempted to attach to it are acting strange. I've been keeping notes as I've gone along and have pasted them below. Thank you for taking the time to read through this!
When forwarding to rsyslog the logs are written to the remotes /var/log files
When forwarding to Graylog the service will not send the logs, but if rsyslog is started by sudo rsyslogd instead of the syslog service it will work
Here is the output of ps aux | grep sysl for each process:
From the service:
[user]$ ps aux | grep sysl
root 12362 0.0 0.1 311228 2804 ? Ssl 10:19 0:00 /usr/sbin/rsyslogd -n
user+ 12369 0.0 0.0 112640 928 pts/0 S+ 10:19 0:00 grep --color=auto sysl
From sudo rsyslogd:
[user]$ ps aux | grep sysl
root 12320 0.0 0.1 313300 2336 ? Ssl 10:18 0:00 rsyslogd
user+ 12354 0.0 0.0 112640 932 pts/0 S+ 10:18 0:00 grep --color=auto sysl
The application should be the same as noted here:
[user]$ which rsyslogd
/usr/sbin/rsyslogd
The only difference then is the use of the -n flag.
Contents of the rsyslog systemd service file:
[Unit]
Description=System Logging Service
;Requires=syslog.socket
[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/rsyslog
ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS
StandardOutput=null
[Install]
WantedBy=multi-user.target
;Alias=syslog.service
$SYSLOGD_OPTIONS is "" according to /etc/sysconfig/rsyslog
Running sudo /usr/sbin/rsyslogd -n sends messages, but locks the terminal session (CTRL-C will not get out, have to close the tmux pane and reconnect, but rsyslogd will stay running)
Removing -n $SYSLOGD_OPTIONS from the service will cause the service to not startup (it crashes, I did run sudo systemctl daemon-reload)
