"mysyslog" is a sample, real name works well and syslog is actually receiving and storing auth & authpriv messages But /var/log/messages is empty using rsyslog
-----Messaggio originale----- Da: rsyslog <[email protected]> Per conto di David Lang Inviato: mercoledì 2 maggio 2018 21:28 A: rsyslog-users <[email protected]> Oggetto: Re: [rsyslog] R: rsyslog logins ONLY This means that you config is effectively $ModLoad imuxsock auth,authpriv.* action(type="omfwd" target="mysyslog" port="514" protocol="udp") if "mysyslog" is actually a name, and you can't resolve it in DNS, you won't get any logs processed and after a while, the queue will fill up and rsyslog will stop accepting new messages. David Lang On Wed, 2 May 2018, Nicola Piazzi wrote: > Date: Wed, 2 May 2018 08:28:40 +0000 > From: Nicola Piazzi <[email protected]> > Reply-To: rsyslog-users <[email protected]> > To: rsyslog-users <[email protected]> > Subject: [rsyslog] R: rsyslog logins ONLY > > This is the full conf file > $ModLoad imuxsock > $WorkDirectory /tmp > $ActionQueueType LinkedList > $ActionQueueFileName srvrfwd > $ActionResumeRetryCount 2 > $ActionQueueSaveOnShutdown on > auth,authpriv.* action(type="omfwd" target="mysyslog" port="514" > protocol="udp") > > i found ita s an example to redirect login messages to syslog I found > that /var/log/messages and other files are at 0 after rsyslog > installation > > > > > Nicola Piazzi > CED - Sistemi > COMET s.p.a. > Via Michelino, 105 - 40127 Bologna - Italia Tel. +39 051.6079.293 > Cell. +39 328.21.73.470 > Web: www.comet.it > > > -----Messaggio originale----- > Da: rsyslog <[email protected]> Per conto di David > Lang > Inviato: mercoledì 2 maggio 2018 10:24 > A: rsyslog-users <[email protected]> > Oggetto: Re: [rsyslog] rsyslog logins ONLY > > well, all your $stuff doesn't apply to the action, it applies to the > next legacy style config item in your config file. If you use > action(), you have to include all the parameters in the action() > statement, no side effects from other lines allowed (this is the > reason for the new style config, you don't have to puzzle out what the > config is doing) > > there is no reason why output to a udp destination should block (unless you > have dns problems), how do you know this is what's causing your problem? > > please post your full config > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This > is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our > control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
