Page 1 of 1

Problem receiving different logs from same IP

Posted: Mon Feb 27, 2017 2:30 pm
by uma K
Team,
Currently I would like to receive logs from same IP address through different ports in LINUX. I am able to receive only TEST1.out logs. Please advise

99-nagioslogserver.conf:

$ModLoad imfile
$InputFilePollInterval 10
$PrivDropToGroup adm
$WorkDirectory /var/spool/rsyslog
# Input for test1.out
$InputFileName /var/lib/logs/test1.out
$InputFileTag test1_out:
$InputFileStateFile state-test1_out # Must be unique for each file being polled
# Uncomment the folowing line to override the default severity for messages from this file.
#$InputFileSeverity info
$InputFilePersistStateInterval 2000
$InputRunFileMonitor
# Forward to Nagios Log Server and then discard, otherwise these messages will end up in the syslog file (/var/log/messages) unless there are other overriding rules.
if $programname == 'test1_out' then @@***.***.***.**:5550
if $programname == 'test1_out' then ~

# Input for test2_out:
$InputFileName /var/lib/logs/test2.out
$InputFileTag test2_out:
$InputFileStateFile state-test2_out # Must be unique for each file being polled
# Uncomment the folowing line to override the default severity for messages from this file.
#$InputFileSeverity info
$InputFilePersistStateInterval 2000
$InputRunFileMonitor
# Forward to Nagios Log Server and then discard, otherwise these messages will end up in the syslog file (/var/log/messages) unless there are other overriding rules.
if $programname =='test2_out' then @@***.***.***.**:5551
if $programname =='test2_out' then ~

Re: Problem receiving different logs from same IP

Posted: Mon Feb 27, 2017 3:50 pm
by mcapra
Can you share the output of the following commands executed from the CLI of your Nagios Log Server machine:

Code: Select all

netstat -an | grep 5550
netstat -an | grep 5551
iptables -S
grep '' /usr/local/nagioslogserver/logstash/etc/conf.d/*

Re: Problem receiving different logs from same IP

Posted: Mon Feb 27, 2017 4:25 pm
by uma K
I have attached the outputs

Re: Problem receiving different logs from same IP

Posted: Mon Feb 27, 2017 4:31 pm
by uma K
I am able to see that my port is established in logstash. and please find the requested output attached herewith.

Thanks

Re: Problem receiving different logs from same IP

Posted: Tue Feb 28, 2017 1:16 am
by rkennedy
Do you see anything shown in a tcpdump about data being received?

Re: Problem receiving different logs from same IP

Posted: Wed Mar 01, 2017 2:29 pm
by tmcdonald
Just checking in since we have not heard from you in a while. Did @rkennedy's post clear things up or has the issue otherwise been resolved?

Re: Problem receiving different logs from same IP

Posted: Thu Mar 02, 2017 2:25 pm
by uma K
Issue is resolved.. Thanks for your support.