<div dir="ltr"><div>This list is not official support for Balabit's products and I am not really an rsyslog expert, but let me try to help.</div><div><br></div><div>I think the issue might be related to "framing", e.g. syslog-ng configured to expect framing whereas rsyslog not doing it. This page: <br></div><div><br></div><div><a href="https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html">https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html</a></div><div><br></div><div>contains a parameter which is TCP_framing that defaults to "no".</div><div><br></div><div>In that case, syslog-ng will drop the connection if the framing is not there. See <a href="https://tools.ietf.org/html/rfc5425#section-4.3">https://tools.ietf.org/html/rfc5425#section-4.3</a> for a description on what framing is and how it works.<br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div>
<br><div class="gmail_quote">On Mon, Jun 25, 2018 at 3:21 AM, Lachlan Musicman <span dir="ltr"><<a href="mailto:datakid@gmail.com" target="_blank">datakid@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div><div>I don't understand why this isn't working? I'm not seeing any data in our Balabit appliance.<br><br></div>I
have a regular default installation of CentOS 7.5, and have followed
the RedHat 7 rsyslog directions with regard to setting up a new message
filter:<br><br></div>I've added a singe file to /etc/rsyslog.d/<br><br></div><div>[root@host02 /etc/rsyslog.d]# cat tcp601.conf<br>*.* action(type="omfwd"<br>queue.type="LinkedList"<br>queue.filename="example_fwd_<wbr>tcp_601"<br>action.resumeRetryCount="-1"<br>queue.saveonshutdown="on"<br>template="RSYSLOG_<wbr>SyslogProtocol23Format"<br>target="10.126.19.45" Port="601" Protocol="tcp")<br><br></div>But I'm not getting anything at the appliance? <br><br></div>The
Appliance Log Source seems to be set up correctly (no licensing issues,
port 601 is set, Syslog format (I was told that is RFC 5425) selected).<br><br></div>Ports are open, but on the server that's configured as per above, I'm seeing this:<br><br>[root@host02 log]# netstat -tnp| grep 601<br>tcp 1 0 <a href="http://10.126.19.66:39768" target="_blank">10.126.19.66:39768</a> <a href="http://10.126.19.45:601" target="_blank">10.126.19.45:601</a> CLOSE_WAIT 2400/rsyslogd<br><br></div>The
data works fine if I send over UDP/port 514, with the template being
either RSYSLOG_SyslogProtocol23Format or RSYSLOG_TraditionalFileFormat<br><br></div>I'm also seeing - in host02's /var/log/messages a *large* number of errors that state:<br><br><div>Jun 25 11:14:14 host02 rsyslogd: action 'action 2' resumed (module 'builtin:omfwd') [v8.24.0 try <a href="http://www.rsyslog.com/e/2359" target="_blank">http://www.rsyslog.com/e/2359</a> ]<br><br></div><div>Can someone tell me where I've gone wrong and/or indicate what I might do next to debug this issue?<br><br></div><div>Cheers<span class="HOEnZb"><font color="#888888"><br></font></span></div><span class="HOEnZb"><font color="#888888">L.<div><div dir="ltr" class="m_2874057290988123613gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><br></div></div></div></div></div></div></div></div></div></div></div></div></font></span></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>