2018-05-03 8:39 GMT+02:00 Nicola Piazzi <[email protected]>: > "mysyslog" is a sample, real name works well and syslog is actually receiving > and storing auth & authpriv messages > But /var/log/messages is empty using rsyslog
Well, if what you posted was indeed to sole config, then you simply do not tell rsyslog to write to /var/log/messages. Actually, you do not tell it to write to anything but the remote server. So you should add the lines from a default config again, and then you should see those other files being written. HTH Rainer > > > -----Messaggio originale----- > Da: rsyslog <[email protected]> Per conto di David Lang > Inviato: mercoledì 2 maggio 2018 21:28 > A: rsyslog-users <[email protected]> > Oggetto: Re: [rsyslog] R: rsyslog logins ONLY > > This means that you config is effectively > > $ModLoad imuxsock > auth,authpriv.* action(type="omfwd" target="mysyslog" port="514" > protocol="udp") > > if "mysyslog" is actually a name, and you can't resolve it in DNS, you won't > get any logs processed and after a while, the queue will fill up and rsyslog > will stop accepting new messages. > > David Lang > > On Wed, 2 May 2018, Nicola Piazzi wrote: > >> Date: Wed, 2 May 2018 08:28:40 +0000 >> From: Nicola Piazzi <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: rsyslog-users <[email protected]> >> Subject: [rsyslog] R: rsyslog logins ONLY >> >> This is the full conf file >> $ModLoad imuxsock >> $WorkDirectory /tmp >> $ActionQueueType LinkedList >> $ActionQueueFileName srvrfwd >> $ActionResumeRetryCount 2 >> $ActionQueueSaveOnShutdown on >> auth,authpriv.* action(type="omfwd" target="mysyslog" port="514" >> protocol="udp") >> >> i found ita s an example to redirect login messages to syslog I found >> that /var/log/messages and other files are at 0 after rsyslog >> installation >> >> >> >> >> Nicola Piazzi >> CED - Sistemi >> COMET s.p.a. >> Via Michelino, 105 - 40127 Bologna - Italia Tel. +39 051.6079.293 >> Cell. +39 328.21.73.470 >> Web: www.comet.it >> >> >> -----Messaggio originale----- >> Da: rsyslog <[email protected]> Per conto di David >> Lang >> Inviato: mercoledì 2 maggio 2018 10:24 >> A: rsyslog-users <[email protected]> >> Oggetto: Re: [rsyslog] rsyslog logins ONLY >> >> well, all your $stuff doesn't apply to the action, it applies to the >> next legacy style config item in your config file. If you use >> action(), you have to include all the parameters in the action() >> statement, no side effects from other lines allowed (this is the >> reason for the new style config, you don't have to puzzle out what the >> config is doing) >> >> there is no reason why output to a udp destination should block (unless you >> have dns problems), how do you know this is what's causing your problem? >> >> please post your full config >> >> David Lang >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This >> is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our >> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites >> beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE >> THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This > is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our > control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
