[syslog-ng] syslog-ng 3.0.8, 3.0.9 not sending logs to centralized log host

21 Dec 2010

      I have syslog-ng 3.0.9 (also tried 3.0.8) on a CentOS 5.5 system, firewall (iptables) turned off, and SELinux disabled. For some reason it refuses to send logs to my log host, though it will put them in my messages file. I've even broken out tcpdump to monitor the port while generating logs to see if I can see any network traffic generated, but it's crickets on the wire.

Anybody have this problem? Is there something I'm missing, perhaps I've been looking at it for too long and need fresh eyes? I've had this working before on other platforms, Solaris and other distros of Linux, but this time it's kicking my butt...

Here's my syslog-ng.conf (with IP and port redacted):
#### BEGIN syslog-ng.conf ####
@version: 3.0

options {
};

source src {
internal();
unix-stream("/dev/log");
file("/proc/kmsg" program_override("kernel: "));
};

destination local {
file("/var/log/messages");
};
destination loghost {
tcp("IPADDR" port(PORT));
};

log {
source(src);
destination(local);
};
log {
source(src);
destination(loghost);
};
#### END syslog-ng.conf ####

Thanks,
Jarrett

Jarrett Lee, UNIX Administrator
OVERSIGHT SYSTEMS | www.oversightsystems.com