the 'typical' cause of this is iptables rules blocking access
if you can't send logs to the target on port 1516, the queue will build
enable impstats and see what the queue looks like (it helps to add name='foo' to
the actions so the impstats output has the names rather than just action #)
David Lang
On Mon, 22 Feb 2021, ryan woods via rsyslog wrote:
Date: Mon, 22 Feb 2021 19:14:31 +0000
From: ryan woods via rsyslog <[email protected]>
To: [email protected]
Cc: ryan woods <[email protected]>
Subject: [rsyslog] Weird issue not able to log to file or remote
Hey all,
So I have AudioCodes Mediant VE SBC devices shipping logs to a Linux syslog
forwarder running rsyslog here is the config I'm using:
$ModLoad imudp
ruleset(name="rulesettt"){
action(type="omfwd" Target="REDACTED" Port="1516" Protocol="tcp"
Template="RSYSLOG_SyslogProtocol23Format")
action(type="omfile" File="/tmp/output.log")
}
input(type="imudp" port="5155" ruleset=" rulesettt ")
The remote host never receives anything from this and the /tmp/output.log
is never created. I've taken a packet capture from the syslog forwarder and
I can see all the traffic from the devices getting to the forwarder and see
all the syslog messages. I am completely lost as to what this could be.....
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
