Rsyslog not pushing the logs

adrianrus · September 26, 2022, 8:27pm

I’m trying in any way to get this done :))

so, input is

rsyslog file


# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

#module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="1514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
$template GRAYLOGRFC5424,"<%PRI%>%PROTOCOL-VERSION% %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"
*.* @10......39:1514;RSYSLOG_SyslogProtocol23Format

gsmith · September 26, 2022, 10:17pm

Hello @adrianrus

Perhaps this may help

Here is my Rsyslog Default configuration On CentOS 7

[root@graylog server]# cat /etc/rsyslog.conf | egrep -v "^\s*(#|$)"
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
$ModLoad imudp
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
kern.debug /var/log/firewall.log
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log
*.*@8.8.8.8:5140
[root@graylog server]#

Here is my Rsyslog Default configuration Ubuntu 20

root@ansible:/usr/local/bin# cat /etc/rsyslog.conf | egrep -v "^\s*(#|$)"
module(load="imuxsock") # provides support for local system logging
*.* @10.10.10.10:8514
module(load="imklog" permitnonkernelfacility="on")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
root@ansible:/usr/local/bin#

Results:

adrianrus · September 27, 2022, 7:05am

UBUNTU here, yes.

Can you telnet from the ‘client server’ to Graylog Server on 1514 ?
i can telnet the elasticsearch port 9200

also the api

but on 1514 there is no one home

As seen, firewall is also off.

So, does yours respond to telnet on 1514 please?

I also tried on Graylog server itself to telnet itself on 1514 and is not.

But, i also know that in some situations this is normal and things still work, anyway, i’m trying to compare how the things are on yours, which is working.

Thank you

Karlis · September 27, 2022, 8:54am

No, unable to connect. On working Graylog server.
Try to change bind address to 0.0.0.0

adrianrus · September 27, 2022, 9:26am

tried 0.0.0.0, same issue.

so my iptables is like this:

# Generated by iptables-save v1.8.4 on Mon Sep 26 20:04:24 2022
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 514 -j REDIRECT --to-ports 1514
-A PREROUTING -p udp -m udp --dport 514 -j REDIRECT --to-ports 1514
COMMIT
# Completed on Mon Sep 26 20:04:24 2022
# Generated by iptables-save v1.8.4 on Mon Sep 26 20:04:24 2022
*filter
:INPUT ACCEPT [27282:7586167]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [24883:5772066]
COMMIT
# Completed on Mon Sep 26 20:04:24 2022

RSYSLOG


# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
$template GRAYLOGRFC5424,"<%PRI%>%PROTOCOL-VERSION% %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"
*.* @10.....39:1514;RSYSLOG_SyslogProtocol23Format

status


root@ipt-fr-log-01-v2:~# systemctl status rsyslog
● rsyslog.service - System Logging Service
     Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2022-09-27 09:26:55 UTC; 11s ago
TriggeredBy: ● syslog.socket
       Docs: man:rsyslogd(8)
             https://www.rsyslog.com/doc/
   Main PID: 2105 (rsyslogd)
      Tasks: 5 (limit: 9508)
     Memory: 1.3M
     CGroup: /system.slice/rsyslog.service
             └─2105 /usr/sbin/rsyslogd -n -iNONE

Sep 27 09:26:55 ipt-fr-log-01-v2 systemd[1]: rsyslog.service: Succeeded.
Sep 27 09:26:55 ipt-fr-log-01-v2 systemd[1]: Stopped System Logging Service.
Sep 27 09:26:55 ipt-fr-log-01-v2 systemd[1]: Starting System Logging Service...
Sep 27 09:26:55 ipt-fr-log-01-v2 rsyslogd[2105]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from >
Sep 27 09:26:55 ipt-fr-log-01-v2 systemd[1]: Started System Logging Service.
Sep 27 09:26:55 ipt-fr-log-01-v2 rsyslogd[2105]: rsyslogd's groupid changed to 110
Sep 27 09:26:55 ipt-fr-log-01-v2 rsyslogd[2105]: rsyslogd's userid changed to 104
Sep 27 09:26:55 ipt-fr-log-01-v2 rsyslogd[2105]: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="2105" x-info="htt>
lines 1-20/20 (END)

^^^all these on the GRAYLOG SERVER ^^^^^

on the CLIENT Server iptables is the same and

RSYSLOG is like this:


module(load="imuxsock") # provides support for local system logging
*.* @10.204.68.39:1514
module(load="imklog" permitnonkernelfacility="on")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf

Karlis · September 27, 2022, 1:39pm

On client this should be in last position. On server rsyslog config is irrevelant, unless you want to collect logs from Graylog server itself.

So, your iptables looks like this? Or you have any rules?

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

adrianrus · September 28, 2022, 7:18am

Solved.
on Graylod Server side:

root@i:~# cat /etc/rsyslog.conf


# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
~

the issue was this: input(type=“imudp” port=“514”)
I was rerouting all to the 1514 by iptables, but, is it late that i understood that is for the incoming from the clients… damn thing.


# Generated by iptables-save v1.8.4 on Mon Sep 26 20:04:24 2022
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 514 -j REDIRECT --to-ports 1514
-A PREROUTING -p udp -m udp --dport 514 -j REDIRECT --to-ports 1514
COMMIT
# Completed on Mon Sep 26 20:04:24 2022
# Generated by iptables-save v1.8.4 on Mon Sep 26 20:04:24 2022
*filter
:INPUT ACCEPT [27282:7586167]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [24883:5772066]
COMMIT
# Completed on Mon Sep 26 20:04:24 2022

on the client side i have it like this:


module(load="imuxsock") # provides support for local system logging
*.* @10.......9:1514
module(load="imklog" permitnonkernelfacility="on")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf

system · October 12, 2022, 7:18am

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Selecting wich log to send using rsyslog Graylog Central (peer support)	1	541	March 29, 2018
Configuring Rsyslog Graylog Central (peer support) sidecar , nxlog , nodatanx	21	26295	December 25, 2017
RSyslog Not working Graylog Central (peer support)	4	1243	September 29, 2022
Inputs Syslog UDP/TCP - FAILED Graylog Central (peer support)	2	4298	August 16, 2017
[SOLVED] Rsyslog - issues GTLS module not found and other Graylog Central (peer support)	3	2664	October 19, 2022

Rsyslog not pushing the logs

Related topics