I also tried the rsyslog assistant AI at https://rsyslog.ai on your question and the answer looks correct to me:
*What’s going on* - In omfwd, the device= parameter *binds the socket to a Linux network device (e.g., eth0) or VRF*, not to an IP alias string like lo:1. The docs explicitly say “Bind socket to given device (e.g., eth0).” rsyslog.com <https://www.rsyslog.com/doc/configuration/modules/omfwd.html?utm_source=chatgpt.com> - For *UDP only*, omfwd also has an address= parameter to bind a specific *local IP* and an accompanying ipFreeBind toggle; *these do not apply to TCP*. So for TCP you can’t pick a source IP with address=—you must let the kernel choose based on routing, or bind to an actual egress *device*. rsyslog.com <https://www.rsyslog.com/doc/configuration/modules/omfwd.html?utm_source=chatgpt.com> - An alias like lo:1 is *not a real device* from the kernel’s perspective; it’s a historical syntax for assigning an additional address to lo. Binding the TCP sender to lo (loopback) while connecting to a remote host will fail, because packets cannot egress via lo. That’s why rsyslog logs “unable to bind.” *Fixes that are supported by rsyslog’s docs* 1. *If you just need TCP and don’t care which source IP is picked* Don’t set device= at all; let the kernel pick the source IP for the route to eyes. Keep your framing for syslog-ng: action( type="omfwd" target="eyes" port="514" protocol="tcp" TCP_Framing="octet-counted" queue.type="linkedList" ) (TCP framing options documented here.) rsyslog.com <https://www.rsyslog.com/doc/configuration/modules/omfwd.html?utm_source=chatgpt.com> 2. *If you must constrain which interface is used for TCP* Bind to the *real egress device*, e.g. eth0, not lo:1: action( type="omfwd" target="eyes" port="514" protocol="tcp" TCP_Framing="octet-counted" device="eth0" queue.type="linkedList" ) (device= usage and semantics.) rsyslog.com <https://www.rsyslog.com/doc/configuration/modules/omfwd.html?utm_source=chatgpt.com> 3. *If you need a specific source IP for UDP* Use address= (UDP-only) and optionally ipFreeBind: action( type="omfwd" target="eyes" port="514" protocol="udp" address="192.168.3.200" ipFreeBind="2" ) (Address/IpFreeBind apply to UDP, not TCP.) rsyslog.com <https://www.rsyslog.com/doc/configuration/modules/omfwd.html?utm_source=chatgpt.com> *Why lo:1 can’t work here (short version)* lo:1 is an *alias of the loopback device*. Binding the sender to loopback makes the kernel try to use the loopback path, which cannot reach a remote host. omfwd expects device= to be a real egress interface name (e.g., eth0) or a VRF name; otherwise binding fails. rsyslog.com <https://www.rsyslog.com/doc/configuration/modules/omfwd.html?utm_source=chatgpt.com> *Documentation support* - omfwd parameters, including *Device*, *TCP_Framing*, *Address* (UDP-only), *IpFreeBind*: rsyslog official docs. rsyslog.com <https://www.rsyslog.com/doc/configuration/modules/omfwd.html?utm_source=chatgpt.com> HTH Rainer El sáb, 4 oct 2025 a las 18:06, Rainer Gerhards (<[email protected]>) escribió: > quick answer to one question: > > > btw I tried to search the logs, but it seems they are private/not indexed >> by >> google. >> > > I guess you meant "docs", it is here: > > https://www.rsyslog.com/doc/ > > Which search did you do that google did not find it? We are usually on > spot 1 or 2. > > Rainer > >> -- >> Bryan Fields >> >> 727-409-1194 - Voice >> http://bryanfields.net >> >> _______________________________________________ >> rsyslog mailing list >> https://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
