I am currently trying to test out a syslog server running on an RHEL AWS instance. The only edits I have made to the config file are uncommenting these sections for TCP/UDP port 514 as well as template for where to save the log files at the end of the config
# Provides UDP syslog reception
# for parameters see http://www.rsyslog.com/doc/imudp.html
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")
# Provides TCP syslog reception
# for parameters see http://www.rsyslog.com/doc/imtcp.html
module(load="imtcp") # needs to be done just once
input(type="imtcp" port="514")
$template PerHostLog,"var/log/syslog2/%HOSTNAME%.log"
if $fromhost-ip startswith '192.' then -?PerHostLog
& STOP
I also execute the syslog generator with the following script which generates the info when echo'd but does not create log files:
#!/bin/bash
# Path to netcat
NC="/bin/nc"
# Where are we sending messages from / to?
#ORIG_IP="192.168.190.11"
SOURCES=("192.168.190.2" "192.168.190.3" "192.168.190.4" "192.168.190.5" "192.168.190.6" "192.168.190.7")
#Destination network
DEST_IP="127.0.0.1"
# List of messages.
MESSAGES=("Error Event" "Warning Event" "Info Event")
# How long to wait in between sending messages.
SLEEP_SECS=1
# How many message to send at a time.
COUNT=1
FACILITIES=("kernel" "user" "mail" "system" "security" "syslog" "lpd" "nntp" "uucp" "time" "ftpd" "ntpd" "logaudit")
LEVELS=("emergency" "alert" "critical" "error" "warning" "notice" "info" "debug")
PRIORITIES=(0 1 2 3 4 5 6 7)
while [ 1 ]
do
for i in $(seq 1 $COUNT)
do
# Picks a random syslog message from the list.
RANDOM_MESSAGE=${MESSAGES[$RANDOM % ${#MESSAGES[@]} ]}
PRIORITY=${PRIORITIES[$RANDOM % ${#PRIORITIES[@]} ]}
SOURCE=${SOURCES[$RANDOM % ${#SOURCES[@]} ]}
FACILITY=${FACILITIES[$RANDOM % ${#FACILITIES[@]} ]}
LEVEL=${LEVELS[$RANDOM % ${#LEVELS[@]} ]}
$NC $DEST_IP -u 514 -w 1 <<< "<$PRIORITY>`env LANG=us_US.UTF-8 date "+%b %d %H:%M:%S"` $SOURCE [$FACILITY.$LEVEL] service: $RANDOM_MESSAGE"
echo $NC $DEST_IP -u 514 -w 1 "<$PRIORITY>`env LANG=us_US.UTF-8 date "+%b %d %H:%M:%S"` $SOURCE service: $RANDOM_MESSAGE"
done
sleep $SLEEP_SECS
done
Firewall rules are open on the host machine for TCP/UDP 514.
Is there something I am missing? Thanks in advance!