Rsyslog don't sent messages to Vector unix socket

[owirtifo]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

Problem when sending RSyslog logs when using source syslog mode=unix. There are no problems when using udp or tcp mode.

Configuration

#vector.toml

[sources.sys]
type = "syslog"
mode = "unix"
path = "/tmp/test.sock"

[sinks.click]
type = "console"
inputs = ["sys"]
encoding.codec = "json"

#rsyslog

# Load omuxsock module
$ModLoad omuxsock
# Set UDS socket path
$OMUxSockSocket /tmp/test.sock
*.* :omuxsock:

Version

vector 0.32.2 (x86_64-unknown-linux-gnu beb74c1 2023-09-20 19:46:02.271601143)

Debug Output

2023-09-22T07:20:09.677117Z DEBUG vector::app: Internal log rate limit configured. internal_log_rate_secs=10
2023-09-22T07:20:09.677237Z  INFO vector::app: Log level is enabled. level="vector=trace,codec=trace,vrl=trace,file_source=trace,tower_limit=trace,rdkafka=trace,buffers=trace,lapin=trace,kube=trace"
2023-09-22T07:20:09.677289Z  WARN vector::app: DEPRECATED The openssl legacy provider provides algorithms and key sizes no longer recommended for use. Set `--openssl-legacy-provider=false` or `VECTOR_OPENSSL_LEGACY_PROVIDER=false` to disable. See https://vector.dev/highlights/2023-08-15-0-32-0-upgrade-guide/#legacy-openssl for details.
2023-09-22T07:20:09.678850Z  INFO vector::app: Loaded openssl provider. provider="legacy"
2023-09-22T07:20:09.678963Z  INFO vector::app: Loaded openssl provider. provider="default"
2023-09-22T07:20:09.681259Z  INFO vector::app: Loading configs. paths=["/etc/vector/vector.toml"]
2023-09-22T07:20:09.685119Z DEBUG vector::config::loading: No secret placeholder found, skipping secret resolution.
2023-09-22T07:20:09.686917Z DEBUG vector::topology::builder: Building new source. component=sys
2023-09-22T07:20:09.688041Z DEBUG vector::topology::builder: Building new sink. component=click
2023-09-22T07:20:09.688742Z  INFO vector::topology::running: Running healthchecks.
2023-09-22T07:20:09.689053Z DEBUG vector::topology::running: Connecting changed/added component(s).
2023-09-22T07:20:09.689718Z DEBUG vector::topology::running: Configuring outputs for source. component=sys
2023-09-22T07:20:09.690152Z DEBUG vector::topology::running: Configuring output for component. component=sys output_id=None
2023-09-22T07:20:09.690534Z DEBUG vector::topology::running: Connecting inputs for sink. component=click
2023-09-22T07:20:09.690803Z DEBUG vector::topology::running: Adding component input to fanout. component=click fanout_id=sys
2023-09-22T07:20:09.691074Z DEBUG vector::topology::running: Spawning new source. key=sys
2023-09-22T07:20:09.691288Z DEBUG vector::topology::running: Registered new allocation group. component_kind="source" component_type="syslog" component_id="sys" group_id="2"
2023-09-22T07:20:09.691535Z TRACE vector::topology::running: Spawning new sink. key=click
2023-09-22T07:20:09.691734Z DEBUG vector::topology::running: Registered new allocation group. component_kind="sink" component_type="console" component_id="click" group_id="3"
2023-09-22T07:20:09.692028Z  INFO vector: Vector has started. debug="false" version="0.32.2" arch="x86_64" revision="beb74c1 2023-09-20 19:46:02.271601143"
2023-09-22T07:20:09.692233Z  INFO vector::app: API is disabled, enable by setting `api.enabled` to `true` and use commands like `vector top`.
2023-09-22T07:20:09.693718Z DEBUG source{component_kind="source" component_id=sys component_type=syslog component_name=sys}: vector::topology::builder: Source starting.
2023-09-22T07:20:09.694241Z  INFO source{component_kind="source" component_id=sys component_type=syslog component_name=sys}: vector::sources::util::unix_stream: Listening. path="/tmp/test.sock" type="unix"
2023-09-22T07:20:09.694801Z DEBUG source{component_kind="source" component_id=sys component_type=syslog component_name=sys}: vector::topology::builder: Source pump supervisor starting.
2023-09-22T07:20:09.695131Z DEBUG source{component_kind="source" component_id=sys component_type=syslog component_name=sys}: vector::topology::builder: Source pump starting.
2023-09-22T07:20:09.694854Z  INFO vector::topology::builder: Healthcheck passed.
2023-09-22T07:20:09.695328Z DEBUG sink{component_kind="sink" component_id=click component_type=console component_name=click}: vector::topology::builder: Sink starting.
2023-09-22T07:20:09.698786Z DEBUG sink{component_kind="sink" component_id=click component_type=console component_name=click}: vector::utilization: utilization=0.04730483827758747
2023-09-22T07:20:09.698946Z TRACE vector: Beep.
2023-09-22T07:20:10.696178Z TRACE vector: Beep.
2023-09-22T07:20:11.695531Z TRACE vector: Beep.
2023-09-22T07:20:12.695958Z TRACE vector: Beep.
2023-09-22T07:20:13.696240Z TRACE vector: Beep.
2023-09-22T07:20:14.695674Z TRACE vector: Beep.
2023-09-22T07:20:14.696933Z DEBUG sink{component_kind="sink" component_id=click component_type=console component_name=click}: vector::utilization: utilization=0.004730528304183289
2023-09-22T07:20:15.697177Z TRACE vector: Beep.
2023-09-22T07:20:16.696357Z TRACE vector: Beep.
2023-09-22T07:20:17.695584Z TRACE vector: Beep.
2023-09-22T07:20:18.695951Z TRACE vector: Beep.
2023-09-22T07:20:19.696178Z TRACE vector: Beep.
2023-09-22T07:20:19.697321Z DEBUG sink{component_kind="sink" component_id=click component_type=console component_name=click}: vector::utilization: utilization=0.0004730989066232802
2023-09-22T07:20:20.695994Z TRACE vector: Beep.

Example Data

No data

Additional Context

No response

References

No response

[dsmith3197]

By default rsyslog uses unix datagram sockets, rather than unix stream sockets. Unfortunately, Vector's syslog source currently only supports unix stream sockets.

However, you can use the socket source as an alternative (ref). You would set decoding.codec = syslog and mode = unix_datagram.

[dsmith3197]

The feature request here would be for the syslog source to support unix datagram sockets.

[dsmith3197]

This duplicates #8509.

Updated reference documentation here: #19399