LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 09-22-2017, 07:07 AM   #1
spiri13
Member
 
Registered: Jun 2016
Posts: 57

Rep: Reputation: Disabled
rsyslog: omfile not working


Hi,

I try to write the log file of my modem-router to /var/log/router.log but the file remains empty.

There is no firewall problem. And traffic is coming via UDP on port 514.

Code:
[]$ tcpdump -i enp0 udp port 514 and host router
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0, link-type EN10MB (Ethernet), capture size 262144 bytes
13:02:38.829972 IP router.64165 > somebody.syslog: SYSLOG local0.critical, length: 134
13:02:40.536516 IP router.64166 > somebody.syslog: SYSLOG local0.critical, length: 133
13:02:44.444502 IP router.64167 > somebody.syslog: SYSLOG local0.critical, length: 139

Syslog server is running in udp mode on port 514:

Code:
[]$ss -nlup | egrep rsyslog
UNCONN     0      0            *:514                      *:*                   users:(("rsyslogd",pid=2256,fd=4))
UNCONN     0      0            *:514                      *:*                   users:(("rsyslogd",pid=2256,fd=5))

And my config file looks like the following:

Code:
[]$ cat /etc/rsyslog.conf
module(load="imudp")
input(type="imudp" port="514" ruleset="udp_rule")

ruleset(name="udp_rule"
	queue.type="fixedArray"
	queue.size="1048576"
	queue.highwatermark="10"
	queue.workerThreads="2"){

	action(type="omfile"
		file="/var/log/router.log"
		ioBufferSize="64k"
		flushOnTXEnd="off"
		asyncWriting="on")

	if $fromhost-ip startswith '1.1.1.' then /var/log/router.log
	& ~
}
But the file /var/log/router.log does not have any content. What am I doing wrong?

I tried both actions (the if-statement and the action definition) but nothing is writing the tcpdump logs to /var/log/router.log. Why?

There's also no error in the journal.

Last edited by spiri13; 09-22-2017 at 07:09 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Help with Rsyslog Crash2720 Linux - General 16 04-20-2016 05:42 AM
rsyslog voncrud Linux - Software 4 02-04-2014 06:17 PM
[SOLVED] Rsyslog remote logging via tcp not working - plz help sh_lnx Linux - Server 9 06-14-2013 08:22 AM
Logging a samba share using rsyslog.d on ubuntu 12.04 - not working, help! RiotSloth Linux - Newbie 0 04-09-2013 03:44 PM
[SOLVED] rsyslog upstart script not working as expected grail Ubuntu 3 03-23-2011 08:47 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 12:45 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration