[SOLVED] Send syslog log to rsyslog server? is possible?

JohnV2 · 10-11-2011, 05:04 PM

Hello,

I have a server with debian and rsyslog and I have another server with slackware and syslog.

I saw slackware don't have rsyslog neither on slackbuilds (why?

). So how I can send log from syslog (slackware) to a rsyslog (debian)? I did some tests, but were not satisfactory.

Previously I configure two another server (with other distros) with rsyslog both, and I can send log through both.

Thanks.

John

acid_kewpie · 10-11-2011, 05:17 PM

sure, you just use "@ip.of.ser.ver" instead of a file name in syslog.conf. This will send by UDP to the remote host.

http://linux.about.com/od/commands/l...l8_syslogd.htm

not that there should be no such thing as interoperability between different syslog server types. they both speak syslog therefore you can send data from one to another using a common standard.

JohnV2 · 10-11-2011, 05:35 PM

Hi acid,

Hey thanks for the reply, I already do that. But I don't know why do not receive any log in rsyslog (debian). Check this:

Quote:

slackware /etc/syslog.conf
local0.* @@192.168.0.150:514

Quote:

debian /etc/rsyslog.conf
if $syslogfacility-text == 'local0'and $programname == 'postgres' then /var/log/postgresql

I use this because another process use local0.

Quote:

debian /etc/rsyslog.conf
# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

Note: @@TCP and @UDP (already test both and nothing)

John

Richard Cranium · 10-11-2011, 07:59 PM

Quote:

Originally Posted by JohnV2

Hi acid,

Hey thanks for the reply, I already do that. But I don't know why do not receive any log in rsyslog (debian).

Well, I'd guess that your syntax is wrong.

Code:

local0.* @@192.168.0.150:514

isn't correct.

Code:

local0.* @192.168.0.150

is, assuming there is a tab between "*" and "@".

You should read the man page that's on the slackware box when you are configuring the slackware syslog.conf.

You should also ensure that rsyslogd on the debian box is listening on 192.168.0.150:514.

JohnV2 · 10-11-2011, 08:56 PM

Quote:

Originally Posted by Richard Cranium

Well, I'd guess that your syntax is wrong.

Code:

local0.* @@192.168.0.150:514

isn't correct.

Code:

local0.* @192.168.0.150

Oh thanks Richard, I always configure rsyslog with @@192.168.0.150:514 (using TCP and the port) because of that, I used the same syntax in the syslog.conf. I already tested with @@ and @ but always using the port (@192.168.0.150:514).

I'll check that later, I'm not at work right now, thanks again...

John

JohnV2 · 10-13-2011, 09:10 AM

It's works Richard... thanks both of you Richard and Acid

In conclusion, Syslog can send log to rsyslog, using the follow syntax:

Quote:

local0.* @192.168.0.150

Not

Quote:

local0.* @192.168.0.150:port

I don't tested if I can use @@TCP with syslog just test the @UDP.

John

Richard Cranium · 10-13-2011, 09:46 AM

Quote:

Originally Posted by JohnV2

It's works Richard... thanks both of you Richard and Acid

In conclusion, Syslog can send log to rsyslog, using the follow syntax:

Not

I don't tested if I can use @@TCP with syslog just test the @UDP.

John

The version of syslogd with Slackware doesn't support TCP.

JohnV2 · 10-13-2011, 10:20 AM

Quote:

Originally Posted by Richard Cranium

The version of syslogd with Slackware doesn't support TCP.

Aff

is good to know.... I was kinda busy yesterday to do the test again. Thanks men...

best regards,
John

ponce · 10-13-2011, 11:08 AM

sorry, I spotted this only now.

I actually had some testing with rsyslog on slackware and it seems to work pretty fine, if you want to try it you can find the latest build script here

http://cgit.ponce.cc/slackbuilds/pla...log/?h=rsyslog

http://github.com/Ponce/slackbuilds/...ystem/rsyslog/

JohnV2 · 10-13-2011, 01:37 PM

Quote:

Originally Posted by ponce

sorry, I spotted this only now.

I actually had some testing with rsyslog on slackware and it seems to work pretty fine, if you want to try it you can find the latest build script here

http://cgit.ponce.cc/slackbuilds/pla...log/?h=rsyslog

http://github.com/Ponce/slackbuilds/...ystem/rsyslog/

Ciao ponce!

Yeah I saw you link a couple of days when I was searching for a slackbuild of rsyslog, nice! I tested in my PC. But I decided to use the syslog what come with slackware, for stability purpose, you know, because is for a client. And mostly because the server with slackware is of the client. But the next time I'll use you slackbuild, I need to be sure first.

thanks,

John