Troubleshooting log collection from syslog

Unable to see the syslog data on the Explorer page

Issue symptom

In BMC Helix Log Analytics, you cannot see any data on the Explorer page after creating and enabling a syslog collection policy.

Issue scope

This issue occurs if log data is directed to other ports.

Resolution

Configure the rsyslog.conf file to redirect rsyslog data to the BMC Helix Log Analytics connectors. 

Perform the following steps to configure the rsyslog.conf file:

1. Open the rsyslog.conf file by using the following command.

   vi to /etc/rsyslog.conf

2. Add the following bind address for the udp protocol.

   *.* @127.0.0.1:5140

3. Add the following bind address for the tcp protocol.

   *.* @@127.0.0.1:5140

4. Run the following commands to restart the rsyslog and td-agent services.

   systemctl restart rsyslog.service
   systemctl restart td-agent.service