title: syslog measurement not appearing in influxdb
body: <p><strong>TL;DR Not able to see syslog logs in influxdb</strong></p>
  
  <p>Environment:</p>
  
  <pre><code>OS: mac os mojave
  telegraf version: 1.8
  influxdb version: 1.6.4
  </code></pre>
  
  <p>So I wanted to view logs in <code>chronograf</code> and figured out from the set of <a href="https://docs.influxdata.com/telegraf/v1.8/plugins/inputs/" rel="nofollow noreferrer">input plugins</a> offered in telegraf to use the <code>syslog</code> plugin. </p>
  
  <p>I have followed the instructions <a href="https://dzone.com/articles/get-your-syslog-on" rel="nofollow noreferrer">here</a>, but have added the steps here too for easy read.</p>
  
  <p>I installed rsyslog via <code>homebrew</code> as follows:</p>
  
  <pre><code>$ brew install rsyslog
  </code></pre>
  
  <p>Added the following in <code>/usr/local/etc/rsyslog.conf</code>:</p>
  
  <pre><code>$WorkDirectory /tmp/rsyslog # temporary directory for storing data 
  $ActionQueueType LinkedList # use asynchronous processing 
  $ActionQueueFileName srvrfwd # set file name, also enables disk mode 
  $ActionResumeRetryCount -1 # infinite retries on insert failure 
  $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down 
  $ModLoad imudp #loads the udp module 
  #listen for messages on udp localhost:514 
  $UDPServerAddress localhost 
  $UDPServerRun 514 
  *.* @@(o)127.0.0.1:6514;RSYSLOG_SyslogProtocol23Format
  </code></pre>
  
  <p>restarted rsyslog:</p>
  
  <pre><code>$ sudo brew services restart rsyslog
  </code></pre>
  
  <p>I configured telegraf as follows:</p>
  
  <pre><code># # Accepts syslog messages per RFC5425
   [[inputs.syslog]]
  #   ## Specify an ip or hostname with port - eg., tcp://localhost:6514, tcp://10.0.0.1:6514
  #   ## Protocol, address and port to host the syslog receiver.
  #   ## If no host is specified, then localhost is used.
  #   ## If no port is specified, 6514 is used (RFC5425#section-4.1).
   server = "tcp://localhost:6514"
  </code></pre>
  
  <p>and restarted telegraf as follows:</p>
  
  <pre><code>$ brew services restart telegraf
  </code></pre>
  
  <p>But my expectation was to see <code>syslog</code> measurement inside of <code>telegraf</code>database</p>
  
  <p>I wrote the following python script to log to <code>syslog</code> hoping that it would appear in the database:</p>
  
  <pre><code>import logging
  import logging.handlers
  
  my_logger = logging.getLogger('MyLogger')
  my_logger.setLevel(logging.DEBUG)
  
  handler = logging.handlers.SysLogHandler(address='/var/run/syslog')
  
  my_logger.addHandler(handler)
  
  my_logger.debug('this is debug')
  my_logger.critical('this is critical')
  </code></pre>
  
  <p>but to no avail.</p>
  
  <p>What could be wrong here? If so is there a log file I could check in?</p>
  
  <p><strong>EDIT 1:</strong></p>
  
  <p>So I troubleshooted rsyslog using the <code>rsyslogd -N1</code> command and found some issues:</p>
  
  <ul>
  <li>The configuration file must be in <code>/etc/rsyslog.conf</code>.</li>
  <li>The configuration file working directory i.e; <code>/tmp/rsyslog</code> wasn't found so created one.</li>
  <li>There were some errors in rsyslog.conf file (can be seen in edits of this question)</li>
  </ul>
  
  <p>After doing all the above I restarted rsyslog and also influxdb and telegraf and checked again if there were any errors by running the <code>rsyslogd -N1</code> command and the following is the output:</p>
  
  <pre><code>rsyslogd: version 8.37.0, config validation run (level 1), master config /etc/rsyslog.conf
  rsyslogd: End of config validation run. Bye.
  </code></pre>
  
  <p>Still the same issue persists.</p>
  
  <p><strong>EDIT 2:</strong>
  related post: <a href="https://community.influxdata.com/t/syslog-plugin-from-remote-server/6610/11" rel="nofollow noreferrer">syslog-plugin-from-remote-server</a></p>