Installing rsyslog on Rhel 5, can't ship files

[stecino]

Hi,

I have setup rsyslog on Rhel 5

[root@sbur2a1 ~]# bash setup-linux.sh -s 10.67.1.246 -p 5544
Detected rsyslog 3.22.1
Detected rsyslog work directory /var/spool/rsyslog
Destination Log Server: 10.67.1.246:5544
Creating /etc/rsyslog.d/99-nagioslogserver.conf...
SELinux is disabled.
rsyslog configuration check passed.
Restarting rsyslog service with 'service'...
Shutting down system logger: [ OK ]
Starting system logger: [ OK ]
Okay.
rsyslog is running with the new configuration.
Visit your Nagios Log Server dashboard to verify that logs are being received.

My version

[root@sbur2a1 ~]# rpm -qa | grep rsyslog
rsyslog-3.22.1-7.el5

There is connectivity

[root@sbur2a1 ~]# telnet 10.67.1.246 5544
Trying 10.67.1.246...
Connected to admin306.ebcolo.com (10.67.1.246)

[root@sbur2a1 ~]# rsyslogd -N1
rsyslogd: version 3.22.1, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: WARNING: rsyslogd is running in compatibility mode. Automatically generated config directives may interfer with your rsyslog.conf settings. We suggest upgrading your config and adding -c3 as the first rsyslogd option.
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad immark
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: MarkMessagePeriod 1200
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad imuxsock
rsyslogd: End of config validation run. Bye.

Tried to send sample data, but it doesn't get shipped

Here is what I have in my config

### Begin forwarding rule for Nagios Log Server NAGIOSLOGSERVER
$WorkDirectory /var/spool/rsyslog # Where spool files will live NAGIOSLOGSERVER
$ActionQueueFileName nlsFwdRule0 # Unique name prefix for spool files NAGIOSLOGSERVER
$ActionQueueMaxDiskSpace 1g # 1GB space limit (use as much as possible) NAGIOSLOGSERVER
$ActionQueueSaveOnShutdown on # Save messages to disk on shutdown NAGIOSLOGSERVER
$ActionQueueType LinkedList # Use asynchronous processing NAGIOSLOGSERVER
$ActionResumeRetryCount -1 # Infinite retries if host is down NAGIOSLOGSERVER
# Remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional NAGIOSLOGSERVER
*.* @@10.67.1.246:5544 # NAGIOSLOGSERVER
### End of Nagios Log Server forwarding rule NAGIOSLOGSERVER

[stecino]

Ended up adding this to rsyslog.conf

$ModLoad immark # provides --MARK-- message capability
$ModLoad imudp # provides UDP syslog reception
$ModLoad imtcp # provides TCP syslog reception
$ModLoad imgssapi # provides GSSAPI syslog reception
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

and it's now working

[scottwilkerson]

Glad you got it working, thanks for posting your results.

I'm passing the info on to the devs to have a look at incorporating your changes in future versions of the setup-linux.sh script for supporting RHEL 5

[stecino]

Thanks