0

On Ubuntu 18.04 and rsyslogd 8.32 logs are sent correctly over tcp without RELP with the next configuration:

Server [192.168.1.201] (/etc/rsyslog.conf):

module(load="imuxsock") # provides support for local system logging

$ModLoad imudp
$UDPServerRun 514

$ModLoad imtcp
$InputTCPServerRun 514

module(load="imklog" permitnonkernelfacility="on")

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$RepeatedMsgReduction on

$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

:programname, isequal, "example" {
    $template RemoteServer, "/var/log/remote/%FROMHOST-IP%/%HOSTNAME%/%SYSLOGFACILITY-TEXT%_%PROGRAMNAME%.log"
    *.* ?RemoteServer
    stop
}

Client (/etc/rsyslog.d/50-default.conf)

auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
kern.*              -/var/log/kern.log
mail.*              -/var/log/mail.log

mail.err            /var/log/mail.err

module(load="imfile" mode="inotify")

input(type="imfile"
      File="/home/user/*.log"
      Tag="david"
      Ruleset="uprule"
      addMetadata="on"
      Facility="local0")

ruleset(name="uprule"){
    :syslogtag, isequal, "example" {
        :msg, contains, "HELLO" {
            local0.* /var/log/testlog_error.log
            local0.* @@192.168.1.201:514
        }
        stop
    }
}

When I try to implement the RELP protocol it doesn't send the logs to the server.

On the client load the omrelp module(load="omrelp") And edit the line local0.* @@192.168.1.201:514 by local0.* :omrelp:192.168.1.201:514

On the server:

module(load="imrelp")
input(type="imrelp" port="514" ruleset="RemoteLogProcess")

ruleset(name="RemoteLogProcess") {
   #Actions with the message...
}

Any suggestions to make it work?

Thanks!

0

Without seeing the complete config file you are using on the server, my first suggestion is make sure you are not loading the imtcp and imrelp on the same port. Since they both use TCP that would cause an issue.

Do have you checked the logs? Do you get any error messages? You can check this by running journalctl -r -u rsyslog

  • Yes, it works! thanks @csark – DM Mass Jan 16 at 8:42
  • Glad it helped! Can you mark this as the accepted answer so others can easily see the solution to your question? – csark Jan 17 at 17:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.