0

Good morning! I'm playing with Graylog today and everything is working well on Ubuntu, but the two CentOS 7.1 servers I've attempted to attach to it are acting strange. I've been keeping notes as I've gone along and have pasted them below. Thank you for taking the time to read through this!

When forwarding to rsyslog the logs are written to the remotes /var/log files When forwarding to Graylog the service will not send the logs, but if rsyslog is started by sudo rsyslogd instead of the syslog service it will work

Here is the output of ps aux | grep sysl for each process: From the service:

[user]$ ps aux | grep sysl

root 12362 0.0 0.1 311228 2804 ? Ssl 10:19 0:00 /usr/sbin/rsyslogd -n

user+ 12369 0.0 0.0 112640 928 pts/0 S+ 10:19 0:00 grep --color=auto sysl

From sudo rsyslogd:

[user]$ ps aux | grep sysl

root 12320 0.0 0.1 313300 2336 ? Ssl 10:18 0:00 rsyslogd

user+ 12354 0.0 0.0 112640 932 pts/0 S+ 10:18 0:00 grep --color=auto sysl

The application should be the same as noted here:

[user]$ which rsyslogd

/usr/sbin/rsyslogd

The only difference then is the use of the -n flag.

Contents of the rsyslog systemd service file:

[Unit]

Description=System Logging Service

;Requires=syslog.socket

[Service]

Type=notify

EnvironmentFile=-/etc/sysconfig/rsyslog

ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS

StandardOutput=null

[Install]

WantedBy=multi-user.target

;Alias=syslog.service

$SYSLOGD_OPTIONS is "" according to /etc/sysconfig/rsyslog

Running sudo /usr/sbin/rsyslogd -n sends messages, but locks the terminal session (CTRL-C will not get out, have to close the tmux pane and reconnect, but rsyslogd will stay running)

Removing -n $SYSLOGD_OPTIONS from the service will cause the service to not startup (it crashes, I did run sudo systemctl daemon-reload)

1
  • I do not see an edit button, but I would like to note autocorrect butchered the title a bit, it should be CentOS not Cents :)
    – Keith
    Jan 6, 2016 at 15:51

1 Answer 1

0

I figured it out. I was being dumb. SELinux does not allow syslog to send logs over a non-standard port, which is what I was trying to do. Installing policycoreutils-python and running sudo semanage port -a -t syslogd_port_t -p tcp 5514 fixed it :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.