I have trouble receive logs from router and other devices after migrating from CentOS 6.8 to CentOS 7.3. Could you please help take a look at it and show me how to fix it? These logs are very important to me since all my works are based on them. Thanks very much.
below info FYI
[user@host ~]$ rsyslogd -v
rsyslogd 7.4.7, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No uuid support: Yes [user@host ~]$ cat /etc/centos-release
CentOS Linux release 7.3.1611 (Core) [user@host ~]# ll -dZ /var/log/usb
drwxr-xr-x. root root system_u:object_r:var_log_t:s0 /var/log/usb [user@hosts ~]# nc -vu 192.168.0.111 514
Ncat: Version 6.40 ( http://nmap.org/ncat ) Ncat: Connected to 192.168.0.111:514. [user@host ~]# nc -vu 192.168.0.1 514
Ncat: Version 6.40 ( http://nmap.org/ncat ) Ncat: Connected to 192.168.0.1:514. [user@host ~]$ ip route sh
default via 192.168.0.1 dev enp3s0 proto static metric 100 192.168.0.0/24 dev enp3s0 proto kernel scope link src 192.168.0.111 metric 100 192.168.2.0/24 dev enp0s20u2c2 proto kernel scope link src 192.168.2.113 metric 100 [user@host ~]# journalctl --unit=rsyslog
-- Reboot -- Jan 07 01:46:49 host systemd[1]: Starting System Logging Service... Jan 07 01:46:49 host systemd[1]: Started System Logging Service. /etc/rsyslog.conf (only un-comment)
$ModLoad imuxsock $ModLoad imjournal # Provides UDP syslog reception $ModLoad imudp $UDPServerAddress 192.168.0.111 $UDPServerRun 514 $WorkDirectory /var/lib/rsyslog $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $IncludeConfig /etc/rsyslog.d/*.conf $OmitLocalLogging on $IMJournalStateFile imjournal.state /etc/rsyslog.d/networklog.conf
$template router, "/var/log/usb/router/router.%$year%%$month%%$day%.log" : fromhost-ip, isequal, "192.168.0.1" -?router & ~ $template nas, "/var/log/usb/qnap/qnap.%$year%%$month%%$day%.log" : fromhost-ip, isequal, "192.168.0.110" -?nas & ~ $template switch, "/var/log/usb/switch/switch.%$year%%$month%%$day%.log" : fromhost-ip, isequal, "192.168.0.2" -?switch & ~ $template bridge, "/var/log/usb/bridge/bridge.%$year%%$month%%$day%.log" : fromhost-ip, isequal, "192.168.5.3" -?bridge $ ~ $template ap, "/var/log/usb/ap/ap.%$year%%$month%%$day%.log" : fromhost-ip, isequal, "192.168.0.4" -?ap $ ~ /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Tue Jul 28 19:40:14 2015 *filter #:INPUT ACCEPT [229:17291] #:FORWARD ACCEPT [0:0] #:OUTPUT ACCEPT [133:14088] # ssh daemon -A INPUT -p tcp -i enp0s20u2c2 -d 192.168.2.113 -m state --state NEW,ESTABLISHED,RELATED -m tcp --dport 22 -j ACCEPT # syslog daemon -A INPUT -i enp3s0 -d 192.168.0.111 -p udp -m state --state NEW,ESTABLISHED,RELATED -m udp --dport 514 -j ACCEPT -A OUTPUT -o enp3s0 -s 192.168.0.111 -p udp -m state --state NEW,ESTABLISHED,RELATED -m udp --sport 514 -j ACCEPT # default DROP rule -A INPUT -j DROP COMMIT # Completed on Tue Jul 28 19:40:14 2015 [user@host network-scripts]# cat ifcfg-enp3s0
TYPE=Ethernet BOOTPROTO=static DEFROUTE=yes IPV4_FAILURE_FATAL=no IPV6INIT=yes IPV6_AUTOCONF=yes IPV6_DEFROUTE=yes IPV6_FAILURE_FATAL=no IPV6_ADDR_GEN_MODE=stable-privacy NAME=enp3s0 UUID=6201e661-dfc9-4c1a-aad9-3fc1330d79e4 DEVICE=enp3s0 ONBOOT=yes IPADDR=192.168.0.111 PREFIX=24 GATEWAY=192.168.0.1 DNS1=8.8.8.8 IPV6_PEERDNS=yes IPV6_PEERROUTES=yes IPV6_PRIVACY=no 