Hi Anatoly,

I appreciate the trust you bestowed to me by sending me the bundle.
From syslog-ng perspective your setup looks all sane, and I couldn't spot any problems.
Upon checking the debug logs, I saw, that syslog-ng did not report either of the incoming UDP packages as "Incoming messages" even though they were recorded in the pcap file.
Given that SELinux is disabled, I and your firewall rules are all ALLOW, there are very few things that could prevent the reception of the messages.
That led me to suspect a networking problem: a routing issue.

You seem to have two interfaces active: A and B.
A has a single IP configured, and B has two.
Only two locally connected networks are present in the routing table, and a default route, that points to a host located in the subnet that interface A is connected to.
The problem is that the packets arrive to interface B, and the IP address they arrive from should be in the direction of interface A, at least from routing perspective.
Due to this the kernel will silently discard these packets.
In order to fix this I would recommend you to review your routing table, or reconfigure your setup so that these packets arrive to interface A's configured IP address.

If you want to verify this theory of mine, I can point you to the following article on how to make the kernel log these unroutable packets:

https://www.cyberciti.biz/faq/linux-log-suspicious-martian-packets-un-routable-source-addresses/

Best Regards,
János

--
Janos SZIGETVARI
RHCE, License no. 150-053-692

LinkedIn: linkedin.com/in/janosszigetvari

__@__˚V˚
Make the switch to open (source) applications, protocols, formats now:
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice
- msn -> jabber protocol (Pidgin, Google Talk)
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp


Anatoly Pugachev <matorola@gmail.com> ezt írta (időpont: 2020. febr. 25., K, 10:58):
On Wed, Feb 19, 2020 at 6:46 PM SZIGETVÁRI János <jszigetvari@gmail.com> wrote:
>
> Hi Anatoly,
>
> Thank you for the debug log!
> It clearly shows that syslog-ng does not get the remote log at all.
> Could you please run the syslog-ng-debun script with the following parameters, and send me the resulting tgz file?
>
> # syslog-ng-debun -r -P "port 3514" -D "-Fedv" -t 90
>
> This will run syslog-ng in debug mode for 90 seconds, and will also create a network traffic dump of the syslog traffic. Please try sending the test logs from the other VM while it is running.


Janos,

sorry for the delay, please see attached files.

Thanks.

tcpdump command was:

localhost# tcpdump -n -w udp-3514.pcap -i ens224 udp and port 3514

this captured 2 packets coming from 2 different machines, which was run :

vm1# logger -d -i -n 172.16.3.50 -P 3514 "test from vm1"
vm2# logger -d -i -n 172.16.3.50 -P 3514 "test from vm2"