0

I have a ubuntu 14.04 server with Rsyslog running. The ruleset in 50-default.conf:

ruleset(name="eventlog"){
    action(type="omfile" file="/var/log/eventlog.log")
}

ruleset(name="networklog"){
    action(type="omfile" file="/var/log/networklog.log")
}


input(type="imudp" port="10514" ruleset="eventlog")

input(type="imudp" port="11514" ruleset="networklog")

The problem:

While 90% of the traffic destined to port 10514 gets written to the 'eventlog' about 10% still gets written to syslog. The ruleset should write ALL traffic to the eventlog.log file that is received on udp port 10514, correct?

Thanks!

Update: tcpdump does show the traffic arriving on port 10514 not 514

Update #2: The version is 7.4.4 and those are the only two rulesets. Traffic that doesn't apply to the ruleset is written to syslog correctly.

Update #3: Upgraded to the latest stable rsyslog. Changed config to:

ruleset(name="eventlog"){
    *. * /var/log/eventlog.log
}

ruleset(name="networklog"){
    *.* /var/log/networklog.log
}


input(type="imudp" port="10514" ruleset="eventlog")

input(type="imudp" port="11514" ruleset="networklog")

It's still writing about 90% to eventlog.log and about 10% to syslog. The traffic is definitely coming in on the right port as there is no rhyme or reason what gets written to syslog for the 'eventlog' traffic. I think it just can't keep up.

uid500
  • 53
  • 8

0 Answers0