Rsyslog not listening TCP on port 514?

Check if rsyslog's configuration has the following lines:

$ModLoad imtcp
$InputTCPServerRun 514
$PrivDropToUser syslog
$PrivDropToGroup syslog


As the user syslog cannot listen on ports below 1024 in TCP. Rsyslog will not fail and will silently run without any drawback.

You can fix it in two different ways:

• Change 514 for a port number above 1024 (10514 for example).
• Don't drop privileges and run as root.