The lab-orders application has just crashed. A colleague looks for its errors on the log collector — the server where machines send their journal lines — and cannot find them. On the training machine the collector runs next to the application: it is the lab-collector service, a second rsyslog instance on address 127.0.0.1, port 514. It keeps the machines' lines in /var/log/remote.
Look at the collector
Look at which machines' lines are on the collector in /var/log/remote, where this machine keeps the lab-orders errors and what this machine calls itself.
First, predict
The lab-orders errors are in this machine's syslog. Will they be on the collector?
Now start the exercise, run the command and compare your prediction with the output.
The collector has lines from web1 and db1 but none from this machine, although the lab-orders errors are in its /var/log/syslog. What follows from this?
-
The lab-orders lines are in /var/log/syslog — this machine's rsyslog wrote them.
-
The collector has lines from web1 and db1, and
systemctl status lab-collectorshows the service as active. It works — nobody sent it anything. -
The lab-orders errors are fresh, and the web1 lines on the collector are tens of minutes older — nobody removed them.
This machine's rsyslog writes lines to its own files and does not send them to the collector.