[Q&A] config for syslog

[hestiap]

What is a problem?

hi,
I'm very new using Fluentd, just installed!

Fluentd service is running with no error listening to the port 5140 for syslog from another server.

I've an error on the client (that send the syslog)

syslogd[10408]: cannot connect to 192.168.9.200:5140: Connection refused [v8.2102.0 try https://www.rsyslog.com/e/2027 ]

Without using Fluentd after stopping the service), with the following command, I could get the syslog w/o error

ls | nc -l -p 5140

rsyslogd[10408]: action 'action-14-builtin:omfwd' resumed (module 'builtin:omfwd') [v8.2102.0 try https://www.rsyslog.com/e/2359 ]
So, I'd say that the client is doing well (I already send the syslog on another server, but with 514)

Describe the configuration of Fluentd

@type syslog port 5140 tag syslog

match tag=syslog.** and write to file

@type file path /var/log/fluent/syslog @type stdout @id output_stdout

Describe the logs of Fluentd

2024-06-30 21:25:48 +0200 [info]: Received graceful stop
2024-06-30 21:25:48 +0200 [info]: #0 fluentd worker is now stopping worker=0
2024-06-30 21:25:48 +0200 [info]: #0 shutting down fluentd worker worker=0
2024-06-30 21:25:48 +0200 [info]: #0 shutting down input plugin type=:syslog plugin_id="object:8c0"
2024-06-30 21:25:48 +0200 [info]: #0 shutting down output plugin type=:stdout plugin_id="output_stdout"
2024-06-30 21:25:48 +0200 [info]: #0 shutting down output plugin type=:file plugin_id="object:870"
2024-06-30 21:25:49 +0200 [info]: Worker 0 finished with status 0
2024-06-30 21:29:14 +0200 [info]: init supervisor logger path="/var/log/fluent/fluentd.log" rotate_age=nil rotate_size=nil
2024-06-30 21:29:14 +0200 [info]: parsing config file is succeeded path="/etc/fluent/fluentd.conf"
2024-06-30 21:29:14 +0200 [info]: gem 'fluentd' version '1.16.5'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-calyptia-monitoring' version '0.1.3'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-elasticsearch' version '5.4.0'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-flowcounter-simple' version '0.1.0'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-kafka' version '0.19.2'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-metrics-cmetrics' version '0.1.2'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-opensearch' version '1.1.4'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-prometheus' version '2.1.0'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-prometheus_pushgateway' version '0.1.1'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-record-modifier' version '2.1.1'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-rewrite-tag-filter' version '2.4.0'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-s3' version '1.7.2'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-sd-dns' version '0.1.0'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-systemd' version '1.0.5'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-td' version '1.2.0'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-utmpx' version '0.5.0'
2024-06-30 21:29:14 +0200 [info]: gem 'fluent-plugin-webhdfs' version '1.5.0'
2024-06-30 21:29:14 +0200 [info]: using configuration file:

@type syslog port 5140 tag "syslog" @type file path "/var/log/fluent/syslog" path "/var/log/fluent/syslog" @type stdout @id output_stdout 2024-06-30 21:29:14 +0200 [info]: starting fluentd-1.16.5 pid=4792 ruby="3.2.3" 2024-06-30 21:29:14 +0200 [info]: spawn command to main: cmdline=["/opt/fluent/bin/ruby", "-Eascii-8bit:ascii-8bit", "/opt/fluent/bin/fluentd", "--log", "/var/log/fluent/fluentd.log", "--daemon", "/var/run/fluent/fluentd.pid", "--under-supervisor"] 2024-06-30 21:29:14 +0200 [info]: #0 init worker0 logger path="/var/log/fluent/fluentd.log" rotate_age=nil rotate_size=nil 2024-06-30 21:29:14 +0200 [info]: adding match pattern="syslog" type="file" 2024-06-30 21:29:14 +0200 [info]: adding match pattern="syslog" type="stdout" 2024-06-30 21:29:14 +0200 [info]: adding source type="syslog" 2024-06-30 21:29:14 +0200 [info]: #0 starting fluentd worker pid=4801 ppid=4798 worker=0 2024-06-30 21:29:14 +0200 [info]: #0 listening syslog socket on 0.0.0.0:5140 with udp 2024-06-30 21:29:14 +0200 [info]: #0 fluentd worker is now running worker=0 2024-06-30 21:45:25 +0200 [info]: Received graceful stop 2024-06-30 21:45:25 +0200 [info]: Received graceful stop 2024-06-30 21:45:26 +0200 [info]: #0 fluentd worker is now stopping worker=0 2024-06-30 21:45:26 +0200 [info]: #0 shutting down fluentd worker worker=0 2024-06-30 21:45:26 +0200 [info]: #0 shutting down input plugin type=:syslog plugin_id="object:8c0" 2024-06-30 21:45:26 +0200 [info]: #0 shutting down output plugin type=:stdout plugin_id="output_stdout" 2024-06-30 21:45:26 +0200 [info]: #0 shutting down output plugin type=:file plugin_id="object:870" 2024-06-30 21:45:27 +0200 [info]: Worker 0 finished with status 0

Environment

- Fluentd version:  fluentd-1.16.5 ruby="3.2.3"
- TD Agent version:
- Fluent Package version:
- Docker image (tag):
- Operating system:  Ubuntu 22.04.4 LTS
- Kernel version:

[hestiap]

After reading again the doc, I've made some changes

<source>
  @type syslog
  port 5140
  tag system
  <transport tcp>
  </transport>
</source>

<match system.**>
  @type stdout
</match>

*.* @@192.168.7.200:5140
on the remote server that collecte the log

and get the syslog in the log

time to improve...