Hi All, We have configured rsyslog as such for port 9001 on two rsyslog server. when the UDP port sends directly to server it works. however , we use a F5 load balancer data is not coming. The health rule is configured as UDP but not working. below is the output which i see frequently Sep 22 11:13:10 default send string Sep 22 11:13:15 default send string Sep 22 11:13:15 default send string Sep 22 11:13:20 default send string Sep 22 11:13:20 default send string Sep 22 11:13:25 default send string Sep 22 11:13:25 default send string ----- rsyslog configuration [root@auvlud1prapp62 rsyslog.d]# cat 99-mainframe-port9001.conf # rsyslog configuration for central logging # Note: 'rsyslog-central' must be replaced to match your hostname # 'localhost' is expected to work, but some persistent cases shown that only # setting to the real value of the host name prevents from logging local log duplicated # in remote location # provides TCP syslog reception #$ModLoad imtcp #$InputTCPServerRun 9001 $ModLoad imudp $UDPServerRun 9001 # Set the global dynamic file $template PerHost, "/apps/log/mainframe/mainframe-%$YEAR%-%$MONTH%-%$DAY%.log" if ($hostname != 'hostname') then ?PerHost & stop ... View more

Hi All,   we have a LB behind two deployment server. we found that the forwarders are getting restart constantly. below is what i can see.  we have the same config in the two deployment servers.what could be the reason for this ?      WARN DC:DeploymentClient - Restarting Splunkd...     Regards ... View more