Hello,

I am attempting to configure a CentOS 7 box to be a syslog server, however I have yet to see any logs from client machines. I will describe what I have done so far.

On the CentOS 7 box:

1.) Uncommented these lines:
# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

So that they now look like this:
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

2.) I then restarted the service by typing the following:
[root@localhost ~]# systemctl restart rsyslog.service

3.) I finally verified that rsyslogd was running with a netstat -antup | grep 514, which produced the following results:
tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 4263/rsyslogd
tcp6 0 0 :::514 :::* LISTEN 4263/rsyslogd
udp 0 0 0.0.0.0:514 0.0.0.0:* 4263/rsyslogd
udp6 0 0 :::514 :::* 4263/rsyslogd

On each of the client machines (which are running Slackware 14.1 and FreeBSD 10.1-RELEASE):

1.) added this line to the syslog.conf files
*.* @10.0.0.2
(10.0.0.2 is indeed the IP address of the CentOS 7 box)

2.) On the FreeBSD box, I added these lines to the /etc/rc.conf file:
syslogd_enable="YES"
syslogd_flags="-s -vv"

and then restarted syslogd:
# /etc/rc.d/syslogd restart

3.) On the Slackware box, I restarted syslogd:
# kill -SIGHUP `cat /var/run/syslogd.pid`

I ran some tests with the logger command, and the logs I generated appeared in the clients' log files, but not in the CentOS 7 box's log files.

Would anyone have any idea what I am doing wrong?

Thank you.

Check any firewall / iptables rules and ensure you are allowing TCP/UDP traffic on port 514

1 members found this post helpful.

Thank you TenTenths. That was exactly the problem.