rsyslog over RELP fails on Ubuntu 18.04

Question

On Ubuntu 18.04 and rsyslogd 8.32 logs are sent correctly over tcp without RELP with the next configuration:

Server [192.168.1.201] (/etc/rsyslog.conf):

module(load="imuxsock") # provides support for local system logging

$ModLoad imudp
$UDPServerRun 514

$ModLoad imtcp
$InputTCPServerRun 514

module(load="imklog" permitnonkernelfacility="on")

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$RepeatedMsgReduction on

$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

:programname, isequal, "example" {
    $template RemoteServer, "/var/log/remote/%FROMHOST-IP%/%HOSTNAME%/%SYSLOGFACILITY-TEXT%_%PROGRAMNAME%.log"
    *.* ?RemoteServer
    stop
}

Client (/etc/rsyslog.d/50-default.conf)

auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
kern.*              -/var/log/kern.log
mail.*              -/var/log/mail.log

mail.err            /var/log/mail.err

module(load="imfile" mode="inotify")

input(type="imfile"
      File="/home/user/*.log"
      Tag="david"
      Ruleset="uprule"
      addMetadata="on"
      Facility="local0")

ruleset(name="uprule"){
    :syslogtag, isequal, "example" {
        :msg, contains, "HELLO" {
            local0.* /var/log/testlog_error.log
            local0.* @@192.168.1.201:514
        }
        stop
    }
}

When I try to implement the RELP protocol it doesn't send the logs to the server.

On the client load the omrelp module(load="omrelp") And edit the line local0.* @@192.168.1.201:514 by local0.* :omrelp:192.168.1.201:514

On the server:

module(load="imrelp")
input(type="imrelp" port="514" ruleset="RemoteLogProcess")

ruleset(name="RemoteLogProcess") {
   #Actions with the message...
}

Any suggestions to make it work?

Thanks!

Answer 1

Without seeing the complete config file you are using on the server, my first suggestion is make sure you are not loading the imtcp and imrelp on the same port. Since they both use TCP that would cause an issue.

Have you checked the logs? Do you get any error messages? You can check this by running journalctl -r -u rsyslog