RSYSLOG not creating tcp port

Question

At a certain point this was working and I do not know what could have changed. No logs are going to the TFTP folder and instead I just see the error message posted below. I tried rebooting the server. I can change the port number and it will start successfully but I won't receive any logs if I do.

Error when checking the status:

rsyslogd[19552]: Could not create tcp listener, ignoring port 514 bind-address (null). [v8.24.0-34.el7 try http://www.rsyslog.com/e/2077 ]

/etc/rsyslog.conf

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal

$ModLoad imudp
$UDPServerRun 514

$ModLoad imtcp
$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

$WorkDirectory /var/lib/rsyslog

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#$ActionFileEnableSync on

$IncludeConfig /etc/rsyslog.d/*.conf

$OmitLocalLogging on

$IMJournalStateFile imjournal.state

#### RULES ####

input(type="imudp" port="514" ruleset="f_remote_all")
input(type="imtcp" port="514" ruleset="f_remote_all")

template(name="d_catch_all" type="string" string="/TFTP/SwitchLogging-%$YEAR%-%$MONTH%-%$DAY%.log")

ruleset(name="f_remote_all") {
 action(type="omfile" DynaFile="d_catch_all") }

#kern.*                                                 /dev/console

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

authpriv.*                                              /var/log/secure

mail.*                                                  -/var/log/maillog

syslog.*                                                /TFTP/Syslog

ftp.*                                                   /TFTP/Syslog

cron.*                                                  /var/log/cron

*.emerg                                                 :omusrmsg:*

uucp,news.crit                                          /var/log/spooler

local7.*                                                /var/log/boot.log

# ### end of the forwarding rule ###

Open Ports:

tcp        0      0 0.0.0.0:8008            0.0.0.0:*               LISTEN      6261/nginx: master
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      6027/mysqld
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      6261/nginx: master
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      6261/nginx: master
tcp        0      0 127.0.0.1:5939          0.0.0.0:*               LISTEN      6031/teamviewerd
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      6930/dnsmasq
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      5585/sshd
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      5593/cupsd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      6130/master
tcp        0      0 0.0.0.0:514             0.0.0.0:*               LISTEN      19552/rsyslogd
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd
tcp6       0      0 :::22                   :::*                    LISTEN      5585/sshd
tcp6       0      0 ::1:631                 :::*                    LISTEN      5593/cupsd
tcp6       0      0 ::1:25                  :::*                    LISTEN      6130/master
tcp6       0      0 :::514                  :::*                    LISTEN      19552/rsyslogd
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           4961/avahi-daemon:
udp        0      0 192.168.122.1:53        0.0.0.0:*                           6930/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           6930/dnsmasq
udp        0      0 0.0.0.0:69              0.0.0.0:*                           5607/xinetd
udp        0      0 0.0.0.0:111             0.0.0.0:*                           1/systemd
udp        0      0 127.0.0.1:323           0.0.0.0:*                           4978/chronyd
udp        0      0 0.0.0.0:41449           0.0.0.0:*                           4961/avahi-daemon:
udp        0      0 0.0.0.0:514             0.0.0.0:*                           19552/rsyslogd
udp        0      0 0.0.0.0:514             0.0.0.0:*                           19552/rsyslogd
udp6       0      0 :::69                   :::*                                1/systemd
udp6       0      0 :::111                  :::*                                1/systemd
udp6       0      0 ::1:323                 :::*                                4978/chronyd
udp6       0      0 :::514                  :::*                                19552/rsyslogd
udp6       0      0 :::514                  :::*                                19552/rsyslogd

Answer 1

Extremely late answer, but I ran into this same problem.

The legacy directive in rsyslog.conf:

$InputTCPServerRun 514

was opening TCP port 514, which meant that the newer-style input() section in my individual config file, like this one:

input(type="imtcp" port="514" ruleset="f_remote_all")

couldn't open the port because it was already opened by the legacy directive.

I deleted the legacy $InputTCPServerRun 514 and stopped getting this error.