Rsyslog Not Forwarding Logs to Remote Collector

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Local logs exist but SIEM or remote syslog server receives nothing from host.

Environment & Reproduction

Wrong target port/protocol, blocked firewalld egress, or rsyslog rule syntax errors.

Root Cause Analysis

Run: sudo systemctl status rsyslog and sudo rsyslogd -N1 for config validation.

Quick Triage

Test TCP/UDP connectivity to collector and confirm DNS resolution of target hostname.

Step-by-Step Diagnosis

Capture rsyslog logs showing queue growth or connection failure.

Solution – Primary Fix

Capture successful transmission after config reload.

Solution – Alternative Approaches

Fix forwarding rule in /etc/rsyslog.d/*.conf and validate using rsyslogd -N1.

Verification & Acceptance Criteria

Open required egress if restricted and confirm network path with nc or telnet test.

Rollback Plan

Restart rsyslog: sudo systemctl restart rsyslog.

Prevention & Hardening

Generate test message with logger and verify it appears on remote collector.

Related Errors & Cross-Refs

Include rsyslog config lint checks in deployment pipeline and monitor queue depth.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Restore last known-good rsyslog config and restart service.