How to confirm if rsyslog transmit only UDP mode
Clash Royale CLAN TAG#URR8PPP
up vote
0
down vote
favorite
We have rsyslog conifigured and configured is as below
$ grep -vE '^#|^$' /etc/rsyslog.conf
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ModLoad imfile
auth,user.* /var/log/messages
kern.* /var/log/kern.log
daemon.* /var/log/daemon.log
syslog.* /var/log/syslog
lpr,news,uucp,local0,local1,local2,local3,local4,local5.* /var/log/unused.log
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg *
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
$ModLoad imudp
$UDPServerRun 514
authpriv.* @<XXX.XXXX.XXX.XXX>
auth.notice @<XXX.XXXX.XXX.XXX>
auth.info @<XXX.XXXX.XXX.XXX>
We are sending these logs to another server where it feeds to another application. But we are getting complaints as still the servers are sending syslog events in TCP mode only but not in UDP.
How can I troubleshoot the issue and what wrong I mentioned in the configuration ?
Note: $IncludeConfig /etc/rsyslog.d/*.conf including only one file and there we are stating what server to use when there is a failover.
$ netstat -tnlpu | grep rsyslog
udp 0 0 0.0.0.0:514 0.0.0.0:* 731/rsyslogd
udp 0 0 :::514 :::* 731/rsyslogd
Please help.
Thank you.
rhel tcp rsyslog udp
asked Mar 14 at 11:52
Ten-Coin
2,33972347
 |Â
show 2 more comments
up vote
0
down vote
favorite
We have rsyslog conifigured and configured is as below
$ grep -vE '^#|^$' /etc/rsyslog.conf
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ModLoad imfile
auth,user.* /var/log/messages
kern.* /var/log/kern.log
daemon.* /var/log/daemon.log
syslog.* /var/log/syslog
lpr,news,uucp,local0,local1,local2,local3,local4,local5.* /var/log/unused.log
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg *
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
$ModLoad imudp
$UDPServerRun 514
authpriv.* @<XXX.XXXX.XXX.XXX>
auth.notice @<XXX.XXXX.XXX.XXX>
auth.info @<XXX.XXXX.XXX.XXX>
We are sending these logs to another server where it feeds to another application. But we are getting complaints as still the servers are sending syslog events in TCP mode only but not in UDP.
How can I troubleshoot the issue and what wrong I mentioned in the configuration ?
Note: $IncludeConfig /etc/rsyslog.d/*.conf including only one file and there we are stating what server to use when there is a failover.
$ netstat -tnlpu | grep rsyslog
udp 0 0 0.0.0.0:514 0.0.0.0:* 731/rsyslogd
udp 0 0 :::514 :::* 731/rsyslogd
Please help.
Thank you.
rhel tcp rsyslog udp
asked Mar 14 at 11:52
Ten-Coin
2,33972347
It seams all to be ok in your configuration. I've just check in udp logs between rsyslog in Centos 7.4 (client) and Debian 7.8(server). In Debian in default rsyslog configuration I've uncommented$ModLoad imudpand$UDPServerRun 514. In Centos 7.4 I've added that line*.* @xxx.xxx.xxx.xxx:514. After all, I restart service on both machines. All works. To ensure I've runtcpdump udp -i <if>and saw received packets. Maybe on clients you've forgotten '@' instead '@@'?
– Yurij Goncharuk
Mar 14 at 12:33
@YurijGoncharuk, you mean I should be adding "auth.info @@<XXX.XXXX.XXX.XXX>" or you are talking about Rsyslog server end configuration ?
– Ten-Coin
Mar 14 at 12:34
1
No, I assume that in rsyslog.conf at clients address address consist of two symbols '@@'. '@' - UDP, '@@' - TCP writing in documentation.
– Yurij Goncharuk
Mar 14 at 12:45
@YurijGoncharuk I beleive single @ would do it sharadchhetri.com/2014/03/01/…
– Ten-Coin
Mar 14 at 12:48
Does your server listen only UDP port? 'netstat -lnu|grep 514'
– Yurij Goncharuk
Mar 14 at 12:54
 |Â
show 2 more comments
up vote
0
down vote
favorite
up vote
0
down vote
favorite
We have rsyslog conifigured and configured is as below
$ grep -vE '^#|^$' /etc/rsyslog.conf
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ModLoad imfile
auth,user.* /var/log/messages
kern.* /var/log/kern.log
daemon.* /var/log/daemon.log
syslog.* /var/log/syslog
lpr,news,uucp,local0,local1,local2,local3,local4,local5.* /var/log/unused.log
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg *
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
$ModLoad imudp
$UDPServerRun 514
authpriv.* @<XXX.XXXX.XXX.XXX>
auth.notice @<XXX.XXXX.XXX.XXX>
auth.info @<XXX.XXXX.XXX.XXX>
We are sending these logs to another server where it feeds to another application. But we are getting complaints as still the servers are sending syslog events in TCP mode only but not in UDP.
How can I troubleshoot the issue and what wrong I mentioned in the configuration ?
Note: $IncludeConfig /etc/rsyslog.d/*.conf including only one file and there we are stating what server to use when there is a failover.
$ netstat -tnlpu | grep rsyslog
udp 0 0 0.0.0.0:514 0.0.0.0:* 731/rsyslogd
udp 0 0 :::514 :::* 731/rsyslogd
Please help.
Thank you.
rhel tcp rsyslog udp
asked Mar 14 at 11:52
Ten-Coin
2,33972347
We have rsyslog conifigured and configured is as below
$ grep -vE '^#|^$' /etc/rsyslog.conf
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ModLoad imfile
auth,user.* /var/log/messages
kern.* /var/log/kern.log
daemon.* /var/log/daemon.log
syslog.* /var/log/syslog
lpr,news,uucp,local0,local1,local2,local3,local4,local5.* /var/log/unused.log
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg *
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
$ModLoad imudp
$UDPServerRun 514
authpriv.* @<XXX.XXXX.XXX.XXX>
auth.notice @<XXX.XXXX.XXX.XXX>
auth.info @<XXX.XXXX.XXX.XXX>
We are sending these logs to another server where it feeds to another application. But we are getting complaints as still the servers are sending syslog events in TCP mode only but not in UDP.
How can I troubleshoot the issue and what wrong I mentioned in the configuration ?
Note: $IncludeConfig /etc/rsyslog.d/*.conf including only one file and there we are stating what server to use when there is a failover.
$ netstat -tnlpu | grep rsyslog
udp 0 0 0.0.0.0:514 0.0.0.0:* 731/rsyslogd
udp 0 0 :::514 :::* 731/rsyslogd
Please help.
Thank you.
rhel tcp rsyslog udp
asked Mar 14 at 11:52
Ten-Coin
2,33972347
edited Mar 14 at 12:58
asked Mar 14 at 11:52
Ten-Coin
2,33972347
asked Mar 14 at 11:52
Ten-Coin
2,33972347
asked Mar 14 at 11:52
Ten-Coin
2,33972347
2,33972347
It seams all to be ok in your configuration. I've just check in udp logs between rsyslog in Centos 7.4 (client) and Debian 7.8(server). In Debian in default rsyslog configuration I've uncommented$ModLoad imudpand$UDPServerRun 514. In Centos 7.4 I've added that line*.* @xxx.xxx.xxx.xxx:514. After all, I restart service on both machines. All works. To ensure I've runtcpdump udp -i <if>and saw received packets. Maybe on clients you've forgotten '@' instead '@@'?
– Yurij Goncharuk
Mar 14 at 12:33
@YurijGoncharuk, you mean I should be adding "auth.info @@<XXX.XXXX.XXX.XXX>" or you are talking about Rsyslog server end configuration ?
– Ten-Coin
Mar 14 at 12:34
1
No, I assume that in rsyslog.conf at clients address address consist of two symbols '@@'. '@' - UDP, '@@' - TCP writing in documentation.
– Yurij Goncharuk
Mar 14 at 12:45
@YurijGoncharuk I beleive single @ would do it sharadchhetri.com/2014/03/01/…
– Ten-Coin
Mar 14 at 12:48
Does your server listen only UDP port? 'netstat -lnu|grep 514'
– Yurij Goncharuk
Mar 14 at 12:54
 |Â
show 2 more comments
It seams all to be ok in your configuration. I've just check in udp logs between rsyslog in Centos 7.4 (client) and Debian 7.8(server). In Debian in default rsyslog configuration I've uncommented$ModLoad imudpand$UDPServerRun 514. In Centos 7.4 I've added that line*.* @xxx.xxx.xxx.xxx:514. After all, I restart service on both machines. All works. To ensure I've runtcpdump udp -i <if>and saw received packets. Maybe on clients you've forgotten '@' instead '@@'?
– Yurij Goncharuk
Mar 14 at 12:33
@YurijGoncharuk, you mean I should be adding "auth.info @@<XXX.XXXX.XXX.XXX>" or you are talking about Rsyslog server end configuration ?
– Ten-Coin
Mar 14 at 12:34
1
No, I assume that in rsyslog.conf at clients address address consist of two symbols '@@'. '@' - UDP, '@@' - TCP writing in documentation.
– Yurij Goncharuk
Mar 14 at 12:45
@YurijGoncharuk I beleive single @ would do it sharadchhetri.com/2014/03/01/…
– Ten-Coin
Mar 14 at 12:48
Does your server listen only UDP port? 'netstat -lnu|grep 514'
– Yurij Goncharuk
Mar 14 at 12:54
It seams all to be ok in your configuration. I've just check in udp logs between rsyslog in Centos 7.4 (client) and Debian 7.8(server). In Debian in default rsyslog configuration I've uncommented
$ModLoad imudp and $UDPServerRun 514. In Centos 7.4 I've added that line *.* @xxx.xxx.xxx.xxx:514. After all, I restart service on both machines. All works. To ensure I've run tcpdump udp -i <if> and saw received packets. Maybe on clients you've forgotten '@' instead '@@'?– Yurij Goncharuk
Mar 14 at 12:33
It seams all to be ok in your configuration. I've just check in udp logs between rsyslog in Centos 7.4 (client) and Debian 7.8(server). In Debian in default rsyslog configuration I've uncommented
$ModLoad imudp and $UDPServerRun 514. In Centos 7.4 I've added that line *.* @xxx.xxx.xxx.xxx:514. After all, I restart service on both machines. All works. To ensure I've run tcpdump udp -i <if> and saw received packets. Maybe on clients you've forgotten '@' instead '@@'?– Yurij Goncharuk
Mar 14 at 12:33
@YurijGoncharuk, you mean I should be adding "auth.info @@<XXX.XXXX.XXX.XXX>" or you are talking about Rsyslog server end configuration ?
– Ten-Coin
Mar 14 at 12:34
@YurijGoncharuk, you mean I should be adding "auth.info @@<XXX.XXXX.XXX.XXX>" or you are talking about Rsyslog server end configuration ?
– Ten-Coin
Mar 14 at 12:34
1
1
No, I assume that in rsyslog.conf at clients address address consist of two symbols '@@'. '@' - UDP, '@@' - TCP writing in documentation.
– Yurij Goncharuk
Mar 14 at 12:45
No, I assume that in rsyslog.conf at clients address address consist of two symbols '@@'. '@' - UDP, '@@' - TCP writing in documentation.
– Yurij Goncharuk
Mar 14 at 12:45
@YurijGoncharuk I beleive single @ would do it sharadchhetri.com/2014/03/01/…
– Ten-Coin
Mar 14 at 12:48
@YurijGoncharuk I beleive single @ would do it sharadchhetri.com/2014/03/01/…
– Ten-Coin
Mar 14 at 12:48
Does your server listen only UDP port? 'netstat -lnu|grep 514'
– Yurij Goncharuk
Mar 14 at 12:54
Does your server listen only UDP port? 'netstat -lnu|grep 514'
– Yurij Goncharuk
Mar 14 at 12:54
 |Â
show 2 more comments
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f430155%2fhow-to-confirm-if-rsyslog-transmit-only-udp-mode%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
It seams all to be ok in your configuration. I've just check in udp logs between rsyslog in Centos 7.4 (client) and Debian 7.8(server). In Debian in default rsyslog configuration I've uncommented
$ModLoad imudpand$UDPServerRun 514. In Centos 7.4 I've added that line*.* @xxx.xxx.xxx.xxx:514. After all, I restart service on both machines. All works. To ensure I've runtcpdump udp -i <if>and saw received packets. Maybe on clients you've forgotten '@' instead '@@'?– Yurij Goncharuk
Mar 14 at 12:33
@YurijGoncharuk, you mean I should be adding "auth.info @@<XXX.XXXX.XXX.XXX>" or you are talking about Rsyslog server end configuration ?
– Ten-Coin
Mar 14 at 12:34
1
No, I assume that in rsyslog.conf at clients address address consist of two symbols '@@'. '@' - UDP, '@@' - TCP writing in documentation.
– Yurij Goncharuk
Mar 14 at 12:45
@YurijGoncharuk I beleive single @ would do it sharadchhetri.com/2014/03/01/…
– Ten-Coin
Mar 14 at 12:48
Does your server listen only UDP port? 'netstat -lnu|grep 514'
– Yurij Goncharuk
Mar 14 at 12:54