I will give this a shot.
I noticed your config file is 70-obsirvium.conf, mine is 30-……. I don’t think that should matter because *.conf is included for the configuration, is that correct?

Also, I believe I need to change the path to syslog.php, is that also correct?
If those assumptions are correct, I will try this and report back

From: observium [mailto:observium-bounces@observium.org] On Behalf Of Adam Armstrong via observium
Sent: Wednesday, October 31, 2018 2:36 PM
To: David Rossi via observium <observium@observium.org>
Cc: Adam Armstrong <adama@memetic.org>
Subject: Re: [Observium] Observium Syslog issues

syslog is one of those things you set up once and never ever touch ever again, so it becomes sort of voodoo.

My dev install is running 8.16, so here are by config parts that might be useful : 

##############################

/etc/rsyslog.conf

module(load="imuxsock") # provides support for local system logging

module(load="imudp")

input(type="imudp" port="514")

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$RepeatedMsgReduction on

$FileOwner syslog

$FileGroup adm

$FileCreateMode 0640

$DirCreateMode 0755

$Umask 0022

$PrivDropToUser syslog

$PrivDropToGroup syslog

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

##################################

/etc/rsyslog.d/70-observium.conf

template(name="observium"

         type="string"

         string="%fromhost%||%syslogfacility%||%syslogpriority%||%syslogseverity%||%syslogtag%||%$year%-%$month%-%$day% %timereported:8:25%||%msg%||%programname%\n")

$ModLoad omprog

# rsyslog Input Modules

input(type="imudp"

      port="514"

      ruleset="observium")

# rsyslog RuleSets

ruleset(name="observium") {

    action(type="omprog"

           binary="/home/observium/dev/syslog.php"

           template="observium")

}

*.* stop

#########################################

Hope that helps! :D

adam.

On 2018-10-31 16:07:37, David Rossi via observium <observium@observium.org> wrote:

Yes, I have restarted multiple times, even booted the server.
I have uninstalled Rsyslog, reinstalled, reconfigured, still no go.
I am thinking about removing rsyslog again, and going to syslog-ng as a test.

Dave Rossi.

From: observium <observium-bounces@observium.org> On Behalf Of Simon Mousey Smith via observium
Sent: Wednesday, October 31, 2018 12:02 PM
To: Observium <observium@observium.org>
Cc: Simon Mousey Smith <simonsmith5521@gmail.com>
Subject: Re: [Observium] Observium Syslog issues

Have you tried restarting the rsyslog service?

I found, every time the PHP file changes (due to code changes or updates) I had to restart the service for it to start working again

Regards

Simon

On 31 Oct 2018, at 15:36, David Rossi via observium <observium@observium.org> wrote:

I have an installation of Observium that has been up and running perfectly for about 18 months.

Last Friday I ran updates and now syslog is no longer working.

I have found that prior to the upgrade, rsyslog was version 7, now I am at Version 8. In searching I found that a few configuration file changes, I did those, and still a no go.

Has anyone else come across this? I am a novice at Linux, and totally at a loss here. I can do a tcpdump and sure enough the syslog messages are hitting the server, but not displayed within Observium.
Any help would be appreciated, but, please keep in mind I am a Centos novice.

Dave Rossi.

_______________________________________________
observium mailing list
observium@observium.org
http://postman.memetic.org/cgi-bin/mailman/listinfo/observium