Mailing List Archive

trouble with Rsyslog imptcp module - no errors but messages not added to log file
Subject: trouble with Rsyslog imptcp module - no errors but messages not added to log file

Hello, the goal for the RSyslog configuration is that it will listen on three ports - UDP 514, TCP/TLS on 6514, and plain TCP on port 20514. The ports 514 and 6514 are working OK, but when I send to 20514 the messages sent (via LOGGER) are not showing in /var/log/messages (using tailf /var/log/messages). There is no error from Logger and I checked I am able to Telnet to 20514.

To test the rsyslog ports I use: logger "test message" -- port 20514 -- tcp - -server <ipaddress>

Any suggestions appreciated!

Some Details:

I have attached the rsyslog.conf.

The environment is running on Redhat 7 and selinux is enabled. I have checked the selinux troubleshooting by turning SELinux OFF and restart the rsyslog service, this did not make a difference.

Firewall ports open:
# firewall-cmd --list-ports
514/udp 514/tcp 25224/udp 25226/tcp 80/tcp 6514/tcp 10514/tcp 20514/tcp

Semanage ports open:
# semanage port -l |grep syslog
syslog_tls_port_t tcp 6514, 10514
syslog_tls_port_t udp 6514, 10514
syslogd_port_t tcp 25224, 25226, 601, 20514
syslogd_port_t udp 514, 601, 20514


thank you.

----------------------------------------------------------------------
This message is intended only for the person(s) to which it is addressed
and may contain privileged, confidential and/or insider information.
If you have received this communication in error, please notify us
immediately by replying to the message and deleting it from your computer.
Any disclosure, copying, distribution, or the taking of any action concerning
the contents of this message and any attachment(s) by anyone other
than the named recipient(s) is strictly prohibited.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: trouble with Rsyslog imptcp module - no errors but messages not added to log file [ In reply to ]
Adding the rsyslog.conf file here.


From: Walton, Glenn
Sent: Friday, October 16, 2020 5:06 PM
To: rsyslog@lists.adiscon.com
Subject: trouble with Rsyslog imptcp module - no errors but messages not added to log file

Subject: trouble with Rsyslog imptcp module - no errors but messages not added to log file

Hello, the goal for the RSyslog configuration is that it will listen on three ports - UDP 514, TCP/TLS on 6514, and plain TCP on port 20514. The ports 514 and 6514 are working OK, but when I send to 20514 the messages sent (via LOGGER) are not showing in /var/log/messages (using tailf /var/log/messages). There is no error from Logger and I checked I am able to Telnet to 20514.

To test the rsyslog ports I use: logger "test message" -- port 20514 -- tcp - -server <ipaddress>

Any suggestions appreciated!

Some Details:

I have attached the rsyslog.conf.

The environment is running on Redhat 7 and selinux is enabled. I have checked the selinux troubleshooting by turning SELinux OFF and restart the rsyslog service, this did not make a difference.

Firewall ports open:
# firewall-cmd --list-ports
514/udp 514/tcp 25224/udp 25226/tcp 80/tcp 6514/tcp 10514/tcp 20514/tcp

Semanage ports open:
# semanage port -l |grep syslog
syslog_tls_port_t tcp 6514, 10514
syslog_tls_port_t udp 6514, 10514
syslogd_port_t tcp 25224, 25226, 601, 20514
syslogd_port_t udp 514, 601, 20514


thank you.

----------------------------------------------------------------------
This message is intended only for the person(s) to which it is addressed
and may contain privileged, confidential and/or insider information.
If you have received this communication in error, please notify us
immediately by replying to the message and deleting it from your computer.
Any disclosure, copying, distribution, or the taking of any action concerning
the contents of this message and any attachment(s) by anyone other
than the named recipient(s) is strictly prohibited.
Re: trouble with Rsyslog imptcp module - no errors but messages not added to log file [ In reply to ]
one issue is that you are mixing the legacy syntax with the new syntax, and as a
result are defining things multiple times in different ways.

I would suggest that you convert entirely to the new syntax (module(), input(),
etc) and eliminate the $foo syntax, at least for your module loading and inputs.

I suspect that in cleaning this up and eliminating the duplicate definitions,
you may end up resolving your problem. If it doesn't, it will be much easier to
understand.

David Lang

On Sat, 17 Oct 2020, Walton, Glenn via rsyslog wrote:

> Date: Sat, 17 Oct 2020 00:06:48 +0000
> From: "Walton, Glenn via rsyslog" <rsyslog@lists.adiscon.com>
> To: "rsyslog@lists.adiscon.com" <rsyslog@lists.adiscon.com>
> Cc: "Walton, Glenn" <e_gwalton@tpg.com>
> Subject: Re: [rsyslog] trouble with Rsyslog imptcp module - no errors but
> messages not added to log file
>
> Adding the rsyslog.conf file here.
>
>
> From: Walton, Glenn
> Sent: Friday, October 16, 2020 5:06 PM
> To: rsyslog@lists.adiscon.com
> Subject: trouble with Rsyslog imptcp module - no errors but messages not added to log file
>
> Subject: trouble with Rsyslog imptcp module - no errors but messages not added to log file
>
> Hello, the goal for the RSyslog configuration is that it will listen on three ports - UDP 514, TCP/TLS on 6514, and plain TCP on port 20514. The ports 514 and 6514 are working OK, but when I send to 20514 the messages sent (via LOGGER) are not showing in /var/log/messages (using tailf /var/log/messages). There is no error from Logger and I checked I am able to Telnet to 20514.
>
> To test the rsyslog ports I use: logger "test message" -- port 20514 -- tcp - -server <ipaddress>
>
> Any suggestions appreciated!
>
> Some Details:
>
> I have attached the rsyslog.conf.
>
> The environment is running on Redhat 7 and selinux is enabled. I have checked the selinux troubleshooting by turning SELinux OFF and restart the rsyslog service, this did not make a difference.
>
> Firewall ports open:
> # firewall-cmd --list-ports
> 514/udp 514/tcp 25224/udp 25226/tcp 80/tcp 6514/tcp 10514/tcp 20514/tcp
>
> Semanage ports open:
> # semanage port -l |grep syslog
> syslog_tls_port_t tcp 6514, 10514
> syslog_tls_port_t udp 6514, 10514
> syslogd_port_t tcp 25224, 25226, 601, 20514
> syslogd_port_t udp 514, 601, 20514
>
>
> thank you.
>
> ----------------------------------------------------------------------
> This message is intended only for the person(s) to which it is addressed
> and may contain privileged, confidential and/or insider information.
> If you have received this communication in error, please notify us
> immediately by replying to the message and deleting it from your computer.
> Any disclosure, copying, distribution, or the taking of any action concerning
> the contents of this message and any attachment(s) by anyone other
> than the named recipient(s) is strictly prohibited.
>