i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check i followed the instructions in this article to set up another ec2 instance as the central server and found that messages are not being received. So I tried executing logger -p cron.info TEST
on the client machine and found nothing is added to /var/log/cron! Something is clearly not working! But rsyslogd is running:
ps aux | grep rsys
outputs
root 25362 0.0 0.0 183768 1328 ? Sl 14:27 0:00 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
for reference, here's the rsyslog.conf (removed the forwarding stuff for now until i get it working locally)
#### MODULES ####
$ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command)
$ModLoad imklog.so # provides kernel logging support (previously done by rklogd)
#$ModLoad immark.so # provides --MARK-- message capability
# Provides UDP syslog reception
#$ModLoad imudp.so
#$UDPServerRun 514
# Provides TCP syslog reception
#$ModLoad imtcp.so
#$InputTCPServerRun 514
#### GLOBAL DIRECTIVES ####
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
#### RULES ####
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
Best Answer
The only thing you need in
rsyslog.conf
to forward to a remote IP address isRegarding your other question...
Be sure you restart rsyslogd after changing the configuration; you also need to be sure that
/var/log/cron
exists.EDIT
To demonstrate what successful log entries look like, I started
rsyslogd
withrsyslogd -c4 -d
; this sends all debugging to my ssh session. I am loggingcron.info
to/var/log/syslog
. In a different ssh session, I ranlogger -p cron.info "my test again"
... this is what I see before it logs successfully to/var/log/syslog
...