Ytdyklly

I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance when I type:

$ logger -t shell "Test log message from the command line"

nothing appears in /var/log/messages nor in /var/log/syslog. All I did was add a configuration file to /etc/rsyslog.d, just as follows:

# cat /etc/rsyslog.d/udp.conf

# Enable UDP listening

# http://www.rsyslog.com/tag/tcp/

$ModLoad imudp



# log every host in its own directory

$template RemoteHost,"/var/log/hosts/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"



# Remote Logging

$RuleSet remote

*.* ?RemoteHost



### Listeners



# Bind ruleset to udp listener and activate

$InputUDPServerBindRuleset remote

$UDPServerRun 514

I kept the stock /etc/rsyslogd.conf intact, assuming I didn't have to change anything. Here it is:

# purge /etc/rsyslog.conf    # 'purge' is 'cat with comments removed'

$ModLoad imuxsock # provides support for local system logging

$ModLoad imklog   # provides kernel logging support

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$FileOwner root

$FileGroup adm

$FileCreateMode 0640

$DirCreateMode 0755

$Umask 0022

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

auth,authpriv.*                 /var/log/auth.log

*.*;auth,authpriv.none          -/var/log/syslog

daemon.*                        -/var/log/daemon.log

kern.*                          -/var/log/kern.log

lpr.*                           -/var/log/lpr.log

mail.*                          -/var/log/mail.log

user.*                          -/var/log/user.log

mail.info                       -/var/log/mail.info

mail.warn                       -/var/log/mail.warn

mail.err                        /var/log/mail.err

news.crit                       /var/log/news/news.crit

news.err                        /var/log/news/news.err

news.notice                     -/var/log/news/news.notice

*.=debug;

        auth,authpriv.none;

        news.none;mail.none     -/var/log/debug

*.=info;*.=notice;*.=warn;

        auth,authpriv.none;

        cron,daemon.none;

        mail,news.none          -/var/log/messages

*.emerg                         :omusrmsg:*

daemon.*;mail.*;

        news.err;

        *.=debug;*.=info;

        *.=notice;*.=warn       |/dev/xconsole

With this configuration log lines from remote hosts also appear in /var/log/messages and /var/log/syslog (which is not what I want). Local logged lines just no more.

Does anyone know how to just add remote logging while keeping the initial functionalities of rsyslogd?

I dropped the case. Even though it has a lot more dependencies, I installed syslog-ng, which I know better. This does not answer the question however as it is a last resort work around. I leave the question open to whom knows the answer though.

Your $RuleSet remote never gets terminated, so all the rules after that will get associated with the remote ruleset.

And as your /etc/rsyslog.d/udp.conf gets included to the main configuration at $IncludeConfig /etc/rsyslog.d/*.conf, it turns out the remote ruleset ends up covering the default rules specified in the main /etc/rsyslog.conf file too.

Since the remote ruleset has claimed all the rules for its own and is bound to remote log messages only, the effective result is that the list of rules for local log messages is now an empty list. And that is why only remote log messages get written to the log files.

The next question is, how do you terminate a rsyslog ruleset? There is no $EndRuleSet directive and no { ... } blocks in this version of rsyslog configuration syntax, after all.

And the answer to that is, you specify another $RuleSet directive.

Within your /etc/rsyslog.d/udp.conf, you should specify your remote logging rules like this:

[...]

# Remote Logging

$RuleSet remote

*.* ?RemoteHost



# End of remote logging rules

$RuleSet RSYSLOG_DefaultRuleset



### Listeners

[...]

You can find an example of this in Fedora 26's System Administrator's Guide.