1

I've this sub configuration :

UDP configuration : Works

template(name="template1" type="string" string="/var/log/rsyslog/%$YEAR%/%$MONTH%/%HOSTNAME%/%HOSTNAME%-%FROMHOST-IP%.log")
ruleset(name="rule1"){
                action(type="omfile" dynaFile="template1")
                action(type="omfwd" protocol="udp" target="10.10.10.1" port="1025")
}
input(type="imudp" port="1025" ruleset="rule1")

TCP configuration :

Configuration 1 : Failed 

template(name="template1" type="string" string="/var/log/rsyslog/%$YEAR%/%$MONTH%/%HOSTNAME%/%HOSTNAME%-%FROMHOST-IP%.log")
ruleset(name="rule1"){
                action(type="omfile" dynaFile="template1")
                action(type="omfwd" protocol="tcp" target="10.10.10.1" port="1025")
}
input(type="imudp" port="1025" ruleset="rule1")

Configuration 2 : Failed 

template(name="template1" type="string" string="/var/log/rsyslog/%$YEAR%/%$MONTH%/%HOSTNAME%/%HOSTNAME%-%FROMHOST-IP%.log")
ruleset(name="rule1"){
                action(type="omfile" dynaFile="template1")
                action(type="omfwd" queue.type="linkedlist" queue.filename="queueing" action.resumeRetryCount="-1" queue.saveOnShutdown="on" protocol="tcp" target="10.10.10.1" port="1025")
}
input(type="imudp" port="1025" ruleset="rule1")

Someone can help me ?

Thanks

celine
  • 13
  • 5
  • on host ```10.10.10.1``` do a ```netstat -an | grep 1025``` and make sure it's listening for TCP requests. Just because the remote end is listening for UDP does not mean it's listening for TCP. – Fubar May 15 '20 at 15:58
  • Yes, I've an open UDP AND TCP socket on 1025 on the remote machine. – celine May 15 '20 at 17:44
  • Are you using SELinux? Check file /var/log/audit/audit.log for any indications on traffic being blocked. Can you telnet to port 1025 on the remote from the client host? Any firewall rules on the client host? – Fubar May 15 '20 at 18:06
  • I disabled SELinux and firewalld on "client and server" – celine May 15 '20 at 18:14

0 Answers0