Cdtjkyj

I once wanted rsyslogd (5.8.11) on a Debian 7 container (under OpenVZ) to also receive logs from remote hosts. In that, it works. What no longer works is log messages from the local host. For instance when I type:

$ logger -t shell "Test log message from the command line"

nothing appears in /var/log/messages nor in /var/log/syslog. All I did was add a configuration file to /etc/rsyslog.d, just as follows:

# cat /etc/rsyslog.d/udp.conf

# Enable UDP listening

# http://www.rsyslog.com/tag/tcp/

$ModLoad imudp



# log every host in its own directory

$template RemoteHost,"/var/log/hosts/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"



# Remote Logging

$RuleSet remote

*.* ?RemoteHost



### Listeners



# Bind ruleset to udp listener and activate

$InputUDPServerBindRuleset remote

$UDPServerRun 514

I kept the stock /etc/rsyslogd.conf intact, assuming I didn't have to change anything. Here it is:

# purge /etc/rsyslog.conf    # 'purge' is 'cat with comments removed'

$ModLoad imuxsock # provides support for local system logging

$ModLoad imklog   # provides kernel logging support

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$FileOwner root

$FileGroup adm

$FileCreateMode 0640

$DirCreateMode 0755

$Umask 0022

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

auth,authpriv.*                 /var/log/auth.log

*.*;auth,authpriv.none          -/var/log/syslog

daemon.*                        -/var/log/daemon.log

kern.*                          -/var/log/kern.log

lpr.*                           -/var/log/lpr.log

mail.*                          -/var/log/mail.log

user.*                          -/var/log/user.log

mail.info                       -/var/log/mail.info

mail.warn                       -/var/log/mail.warn

mail.err                        /var/log/mail.err

news.crit                       /var/log/news/news.crit

news.err                        /var/log/news/news.err

news.notice                     -/var/log/news/news.notice

*.=debug;

        auth,authpriv.none;

        news.none;mail.none     -/var/log/debug

*.=info;*.=notice;*.=warn;

        auth,authpriv.none;

        cron,daemon.none;

        mail,news.none          -/var/log/messages

*.emerg                         :omusrmsg:*

daemon.*;mail.*;

        news.err;

        *.=debug;*.=info;

        *.=notice;*.=warn       |/dev/xconsole

With this configuration log lines from remote hosts also appear in /var/log/messages and /var/log/syslog (which is not what I want). Local logged lines just no more.

Does anyone know how to just add remote logging while keeping the initial functionalities of rsyslogd?

I dropped the case. Even though it has a lot more dependencies, I installed syslog-ng, which I know better. This does not answer the question however as it is a last resort work around. I leave the question open to whom knows the answer though.