Cisco – Syslog does not record logs received over TCP to a file

SELinux will prevent processes that are labeled syslogd_t to write to files that are (probably) labeled default_t. You need to label the file with something syslogd_t can write to. Files in /var/log are mostly labeled var_log_t, a type syslogd_t can surely write to.

You should not just relabel the files in /Testing to var_log_t, because that's bound to break at some point, when somebody executes an autorelabel at the next boot or runs restorecon -FvR /.

Instead, write a little policy that automatically and consistently labels your files in /Testing. Something to get your started. Your policy file could look similar to this:

/Testing(/.*)?    --    gen_context(system_u:object_r:var_log_t)

SELinux policy writing however, is a tad tricky. Which is why you should put stuff at the default location for that stuff.

However, I personally feel that logging should really go into /var/log. It's there for a reason. No matter how good you think your reason is for writing to /Testing, it's probably better to write to something like /var/log/testing.

Edit: no, no, no, no, no. That won't do. That was silly. You do not want to write a policy to allow syslogd_t to write to var_log_t, because that is already allowed by the default policy. You need to write filecontext rules (a .fc file), like my new snippet above, to label /Testing as var_log_t if you must...

It looks to me like you have a typo in your postgresql.conf file. Make sure that you're actually using

syslog_facility = 'local0'

Also, old syslogd required that hard tabs be used instead of spaces in your config file, so make sure that you aren't actually using spaces, or that your editor isn't converting tabs into spaces (such as the expandtab option in vim).

You also mention both old syslogd and rsyslog, so check to see which one you are actually using. Rsyslog's config file was designed to be backward compatible with syslogd, but does use a different file. So if you are using rsylog then add your logging line to /etc/rsyslog.conf instead.

In order to prevent those messages from also showing up in /var/log/messages you'll need to explicitly filter out that facility. In order to do that, modify your config for messages to this:

*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none;\
    local0.none          -/var/log/messages

That translates to, "Do not write any severity levels from the local0 facility to this file." Or, in effect, exclude anything local0.*.