Re: Trouble with remote rsyslog

[vr <debian-user@iotk.net>]

On 30.11.2011 12:49, Camaleón wrote:
> On Wed, 30 Nov 2011 00:03:26 -0500, vr wrote:
>
> (...)
>
> > SENDING SERVER (99.30.25.3, Squeeze, up to date)
> >
> > /etc/rsyslog.conf
> > $ModLoad imudp
> > $UDPServerRun 514
> > main.info             @99.30.25.3
>                         ^^^^^^^^^^^
> (...)
>
> Just thinking out loud... shouldn't that IP be the one of the 
> receiver's
> host?
>
> Greetings,
>
> --
> Camaleón


oh crap... I had the SEND/RECEIVE IP's reversed in the email but 
they're right on the servers. Here's hopefully a clearer snip from each 
host, with the corrections mentioned so far, firewall confirmed off 
while testing to rule that out too, and rsyslog restarted at both nodes 
(and still not working):


mail:~# ifconfig | grep Bcast
          inet addr:99.30.25.2  Bcast:99.30.25.7  Mask:255.255.255.248

mail:~# grep RSYSLOGD /etc/default/rsyslog
RSYSLOGD_OPTIONS="-c4"

mail:~# grep @99 /etc/rsyslog.conf
main.info                      @99.30.25.3
mail.warn                     @99.30.25.3
mail.err                        @99.30.25.3

mail:~# egrep '(imudp|UDPServerRun)' /etc/rsyslog.conf
#$ModLoad imudp
#$UDPServerRun 514

mail:~# netstat -na | grep :514
mail:~#




RECEIVING SERVER
prod:~# ifconfig | grep Bcast
          inet addr:99.30.25.3  Bcast:99.30.25.7  Mask:255.255.255.248

prod:~# grep RSYSLOGD /etc/default/rsyslog
RSYSLOGD_OPTIONS="-c4"

prod:~# egrep '(imudp|UDPServerRun)' /etc/rsyslog.conf
$ModLoad imudp
$UDPServerRun 514

prod:~# grep @99 /etc/rsyslog.conf
prod:~#

prod:~# netstat -na | grep :514
udp        0      0 0.0.0.0:514             0.0.0.0:*
udp6       0      0 :::514                  :::*