Rsyslog not writing to file

File specifies, the path and name of the text file that should be monitored. The file name must be absolute. Tag will set a tag in front of each message pulled from the file.

If you want a colon after the tag you must set it as well, it will not be added automatically. StateFile will create a file where rsyslog keeps track of the position it currently is in a file. You only need to set the filename. This file is important so rsyslog will not pull messages from the beginning of the file when being restarted. Severity will give all log messages of a file the same severity. This is optional. Facility gives alle log messages of a file the same facility.

Further information about this issue may be found following that link. If file permissions are all good and logrotate is correctly configured, your next step will be to have a look at rsyslog system calls.

Funny thing was, since it was a ramdisk, I didn't have one to copy from in single-user mode, so I didn't know what the permissions and ownership were supposed to be! The rsyslog was pushing to a dedicated mount and was denying permissions. Restarted rsyslog and immediately saw the a successful run. Sign up to join this community. The best answers are voted up and rise to the top. Stack Overflow for Teams — Collaborate and share knowledge with a private group.

Create a free Team What is Teams? Learn more. Rsyslog is not working properly, it does not log anything Ask Question. Asked 8 years, 6 months ago. Active 1 year, 8 months ago.

Viewed 66k times. This is driving me crazy, any idea what is going on here? I solved it. It was a routing! Server could not reach the message originator, thus, the message was not processed from rsyslog Go figure I was having the same issue. Receiving logs from dozens of ASA devices but not from specific one. Tcpdump showed that the packets were arriving. My problem was that the kernel was filtering its packets.

I had to restart the server because sysctl -p was returning errors from a couple of keys that I didn't want to modify. I was having this exact same issue. However, when the other machine on the network would communicate log file information to port , it would not show up.

I tried everything here mentioned above and still it would not work. I had TCP port opened on the interface that these two machines communicate on. Just on a hunch I modified my firewall to allow UDP port as well and boom, it started working immediately.

My assumption here is that regular text immediately gets dumped into the file, no question. Apparently, both are required.

Just wanted to put this out there in case this trips up somebody else in the future. As stated above, it doesn't make sense that rsyslogd would have anything to communicate outbound to the host providing the log info to the server, but perhaps rsyslogd just makes sure the host is reachable and exists on the network via UDP before it processes a syslog-formatted string of data it just received. Here is my configuration:. I have scoured the bowels of the internets looking for help and no such luck.

I even tried running rsyslogd in debug mode and no dice. Anyone out there have any experience here? Now when I run my example program, the log message is showing up as expected.

How do I prevent it from being sent there? Need to make sure that this comes before any of the other facility rules. You would think that a simple use case like this would be easy to find examples for. In fact, you would think that the rsyslog docs would clearly cover this particular use case.

Stack Overflow for Teams — Collaborate and share knowledge with a private group. Create a free Team What is Teams?