Rsyslog not sending logs

Amine-elhijazi · February 23, 2018, 11:48am

Hello everyone
Well it’ve been while i’m facing this probleme

I am trying hard to send logs from my ubuntu 14.04 ( using Rsyslog) (ip : 192.168.2.36)
To ===> my Graylog Server (192.168.2.37)
well this is the input configuration

and this my rsyslog conf

And when i run Wireshark with this filter i recive nothing

i’ll be thankfull if someone can help me !
thank u all !

N.B I am using Vmwar

jochen · February 23, 2018, 12:01pm

Check the firewall rules and network configuration on the machine running Graylog.

Amine-elhijazi · February 23, 2018, 12:03pm

Thank u for your answer i think the port 1514 is listning

and i just install this machine for test in vmwar i did not set up any firwall

Thank you again for your help Mr Jochen

jochen · February 23, 2018, 1:05pm

What’s the output of the following commands on the machine running Graylog?

# sudo ufw status verbose
# sudo ufw app list 
# sudo ufw show raw

Amine-elhijazi · February 23, 2018, 1:54pm

Of the Server :

Of the Rsyslog machine :

IPV4 (raw):

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
Chain PREROUTING (policy ACCEPT 525 packets, 47963 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 22 packets, 1878 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 3 packets, 354 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 3 packets, 354 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
Chain PREROUTING (policy ACCEPT 643 packets, 70086 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 140 packets, 24001 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 5 packets, 434 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 7 packets, 748 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
Chain PREROUTING (policy ACCEPT 643 packets, 70086 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 5 packets, 434 bytes)
    pkts      bytes target     prot opt in     out     source               destination         


IPV6:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
Chain PREROUTING (policy ACCEPT 62 packets, 4330 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 62 packets, 4330 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4 packets, 498 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 6 packets, 852 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
Chain PREROUTING (policy ACCEPT 62 packets, 4330 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4 packets, 498 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Amine-elhijazi · February 23, 2018, 2:21pm

here i used ncat to send msg over udp port 1514 and i found in elastic

echo “Testy” | ncat -u 192.168.2.36 1514

so i think it must be a rsyslog issue

jtkarvo · February 23, 2018, 5:24pm

Did you check rsyslog config so that it is actually running and loads your config file? Like rsyslogd -N1

Also: do you run SElinux? If you do, you need to make port 1541 a rsyslogd port with semanage, or else SElinux will not allow rsyslogd to send data there.

Amine-elhijazi · February 23, 2018, 5:29pm

the output of

> rsyslogd -N1

rsyslogd: version 7.4.4, config validation run (level 1), master config /etc/rsyslog.conf
    rsyslogd: error: extra characters in config line ignored: '”<%PRI%>%PROTOCOL-VERSION% %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n”'
    rsyslogd:  Could not find template 'GRAYLOGRFC5424' - action disabled [try http://www.rsyslog.com/e/3003 ]
    rsyslogd: error during parsing file /etc/rsyslog.d/graylog_syslog.conf, on or before line 2: errors occured in file '/etc/rsyslog.d/graylog_syslog.conf' around line 2 [try http://www.rsyslog.com/e/2207 ]
    rsyslogd:  Could not find template 'GRAYLOGRFC5424' - action disabled [try http://www.rsyslog.com/e/3003 ]
    rsyslogd: error during parsing file /etc/rsyslog.d/graylog_syslog.conf, on or before line 3: errors occured in file '/etc/rsyslog.d/graylog_syslog.conf' around line 3 [try http://www.rsyslog.com/e/2207 ]
    rsyslogd: End of config validation run. Bye.

Maybe now i have somthing to solve ? thank u sire

Amine-elhijazi · February 23, 2018, 5:44pm

amine-el-hijazi@ClientSys:~$ rsyslogd -N1
rsyslogd: version 7.4.4, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.

I think the probleme is fixed but still i don’t recive anything in the sever i have a very stupide how can i make sur that i m genereting logs that will be sent to the server , cauz i tried to restart services and other and nothing is working so any idea ?

jtkarvo · February 23, 2018, 6:13pm

You can try running rsyslogd in debugging mode with -d.

jochen · February 23, 2018, 6:22pm

Also make sure to read the syslog guide:

github.com

Graylog2/graylog-guide-syslog-linux/blob/master/README.md#rsyslog

## Sending syslog from Linux systems into Graylog

The two most popular syslog deamons (the programs that run in the background to accept and write or forward logs) are *rsyslog* and *syslog-ng*. One of these will most likely be running on your Linux distribution. (Please refer to your distribution documentation if you are unsure)

### rsyslog

Forwarding syslog messages with rsyslog is easy. The only important thing to get the most out of your logs is following
[RFC 5424](http://www.ietf.org/rfc/rfc5424.txt). The following examples configure your `rsyslog` daemon to send
RFC 5424 date to Graylog syslog inputs:

##### UDP:

    *.* @graylog.example.org:514;RSYSLOG_SyslogProtocol23Format

##### TCP:

    *.* @@graylog.example.org:514;RSYSLOG_SyslogProtocol23Format

(The difference between UDP and TCP is using `@` instead of `@@` as target descriptor.)

This file has been truncated. show original

Amine-elhijazi · February 26, 2018, 11:59am

Well the probléme is solved !
thank u all very much
what helped me in this topic :
1 cheking my firwall rull
2 cheking the work of Rsyslog rsyslogd -N1
and i just find a stupide mistake in my configuration
And that is !
Thank u all for your help !

system · March 12, 2018, 11:59am

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Can't send rsyslog Graylog Central (peer support)	14	2911	September 9, 2017
New Remote Server Doesn't send rsyslog to established Graylog Server Graylog Central (peer support)	4	576	November 22, 2020
Send data with rsyslog Graylog Central (peer support)	7	4419	September 3, 2019
Graylog inputs do not seem to be working Graylog Central (peer support)	5	2970	September 7, 2018
[solved] How i get rsyslog messages in graylog? misunderstanding Graylog Central (peer support)	5	9120	February 1, 2019

Rsyslog not sending logs

Related topics