syslog is one of those things you set up once and never ever touch ever again, so it becomes sort of voodoo.
My dev install is running 8.16, so here are by config parts that might be useful :
##############################
/etc/rsyslog.conf
module(load="imuxsock") # provides support for local system logging module(load="imudp") input(type="imudp" port="514")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $RepeatedMsgReduction on
$FileOwner syslog $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 $PrivDropToUser syslog $PrivDropToGroup syslog
$WorkDirectory /var/spool/rsyslog $IncludeConfig /etc/rsyslog.d/*.conf
##################################
/etc/rsyslog.d/70-observium.conf
template(name="observium" type="string" string="%fromhost%||%syslogfacility%||%syslogpriority%||%syslogseverity%||%syslogtag%||%$year%-%$month%-%$day% %timereported:8:25%||%msg%||%programname%\n")
$ModLoad omprog
# rsyslog Input Modules input(type="imudp" port="514" ruleset="observium")
# rsyslog RuleSets ruleset(name="observium") { action(type="omprog" binary="/home/observium/dev/syslog.php" template="observium") }
*.* stop
#########################################
Hope that helps! :D
adam.
On 2018-10-31 16:07:37, David Rossi via observium observium@observium.org wrote: Yes, I have restarted multiple times, even booted the server. I have uninstalled Rsyslog, reinstalled, reconfigured, still no go. I am thinking about removing rsyslog again, and going to syslog-ng as a test. Dave Rossi. From: observium observium-bounces@observium.org On Behalf Of Simon Mousey Smith via observium Sent: Wednesday, October 31, 2018 12:02 PM To: Observium observium@observium.org Cc: Simon Mousey Smith simonsmith5521@gmail.com Subject: Re: [Observium] Observium Syslog issues Have you tried restarting the rsyslog service? I found, every time the PHP file changes (due to code changes or updates) I had to restart the service for it to start working again Regards Simon
On 31 Oct 2018, at 15:36, David Rossi via observium <observium@observium.org [mailto:observium@observium.org]> wrote: I have an installation of Observium that has been up and running perfectly for about 18 months. Last Friday I ran updates and now syslog is no longer working. I have found that prior to the upgrade, rsyslog was version 7, now I am at Version 8. In searching I found that a few configuration file changes, I did those, and still a no go. Has anyone else come across this? I am a novice at Linux, and totally at a loss here. I can do a tcpdump and sure enough the syslog messages are hitting the server, but not displayed within Observium. Any help would be appreciated, but, please keep in mind I am a Centos novice. Dave Rossi. _______________________________________________ observium mailing list observium@observium.org [mailto:observium@observium.org] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [http://postman.memetic.org/cgi-bin/mailman/listinfo/observium]