Return
-
Title
How to troubleshoot not receiving logs -
Description
How to troubleshoot not receiving logs -
Cause
CAUSE 1: Configuration issue
CAUSE 2: SELinux/Firewall is blocking
CAUSE 3: Network issue
-
Resolution
RESOLUTION 1:
- Revise the IP and port and syslog protocol configuration on both the client and server side.
When the IP is missing from the source definition, then syslog-ng will listen on all interfaces. When there is any IP address, then the source will use that IP address found on the server. - Check the following knowledge base articles
RESOLUTION 2:
- Disable SELinux and/or Firewall temporarily.
- Check if syslog-ng receives logs.
- In case of yes, configure SELinux/Firewall to not block syslog-ng operations.
SELinux: Using syslog-ng with SELinux in enforcing mode
Firewall: Most probably the source port must be enabled in the firewall. For solution check the documentation of the firewall application.
RESOLUTION 3:
- Check the connection from the client to the server with ping and telnet.
- Send test message if possible. Sending test messages to Syslog-ng Premium Edition and Syslog-ng Store Box
- Revise the IP and port and syslog protocol configuration on both the client and server side.