I have a situation where I want to receive UDP traffic on two different ports on the same machine (two different services) and would like to avoid double sending of data.

So, this is the idea:

(rsyslog client) ----(network)---> (10540 rsyslog and 11540 logstash)

rsyslog and logstash are on the same machine.

I need something in front of those two services that could serve them both with the same data. Ideally this would be located on the same machine as mentioned services. Something like L4 balancer that can send all data to multiple destinations or some kind of port mirroring mechanism. Or anything else that could serve the purpose.

The reason for this is that I'm collecting linux audit logs, and want to save some of them to Graylog (using logstash) and other to the filesystem. I've tried to do that with logstash but it messes with format of logs stored on disk and they are not readable for aureport, ausearch and ausummary tools.

Haven't found a way to fix the format whitin logstash to be readable by those tools.

I'm using CentOS7. I don't have access to network devices.

Thanks for your suggestions.


With rsyslog you can use the omfwd module to send the logs to logstash. Add something like this to your rsyslog server (not the client):

action(type="omfwd" Target="" Port="11540" Protocol="udp")
  • Thanks, this solved my problem. Instead of sending to logstash and then to rsyslog, I've started sending to rsyslog first. Did some configuration changes for logstash and thing are working like charm now. – user373333 Aug 31 '16 at 21:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.