I am using OpenBSD 3.6, everything works perfect except SYSLOG. I need help.

How can I open the UDP sockets so SYSLOG can get messages from Cisco equipment?

i don't undersatnd what your title has to do with the question... sounds like you need to configure the syslog server correctly and restart it. if you're getting that already in use message i'd assume that syslog is still running and you're trying to start another instance, which naturally isn't possible. not sure if it runs under bsd (no reason why not) but i would recommend syslog-ng for easier networked syslog reception. or even splunk to go to a whole new web 2.0 world of logging.

also openbsd is not linux... thread should shortly be moved to bsd forum.

Evidently, some other process is listening on that port. The first steps to solving your problem are to find out to which port the error refers, and which process is already listening, and then a determination can be made about a remedy. The tools lsof and/or netstat should allow you to locate the offending process. You will have to do a little sidebar research to determine which specific port is being referenced.
--- rod.

Here is the output of netstat -an

netstat -a
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp 0 0 LAXBCASTDNS01.2393 LAXBCASTDNS01.domain TIME_WAIT
tcp 0 0 LAXBCASTDNS01.smtp 10.11.50.1.59325 TIME_WAIT
tcp 0 116 LAXBCASTDNS01.ssh 10.6.50.1.2587 ESTABLISHED
tcp 0 0 LAXBCASTDNS01.ssh 10.6.50.1.2445 ESTABLISHED
tcp 0 0 *.ssh *.* LISTEN
tcp 0 0 *.submissi *.* LISTEN
tcp 0 0 *.smtp *.* LISTEN
tcp 0 0 *.time *.* LISTEN
tcp 0 0 *.daytime *.* LISTEN
tcp 0 0 *.auth *.* LISTEN
tcp 0 0 localhost.953 *.* LISTEN
tcp 0 0 LAXBCASTDNS01.domain *.* LISTEN
tcp 0 0 localhost.domain *.* LISTEN
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
udp 0 0 localhost.biff *.*
udp 0 0 *.38532 *.*
udp 0 0 LAXBCASTDNS01.domain *.*
udp 0 0 localhost.domain *.*
udp 0 0 *.syslog *.*
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp6 0 0 *.ssh *.* LISTEN
tcp6 0 0 *.submissi *.* LISTEN
tcp6 0 0 *.smtp *.* LISTEN
tcp6 0 0 *.time *.* LISTEN
tcp6 0 0 *.daytime *.* LISTEN
tcp6 0 0 *.auth *.* LISTEN
tcp6 0 0 localhost.953 *.* LISTEN
tcp6 0 0 *.domain *.* LISTEN
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
udp6 0 0 localhost.biff *.*
udp6 0 0 *.31202 *.*
udp6 0 0 *.domain *.*
Active UNIX domain sockets
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
0x6b6d648 dgram 0 0 0x0 0xe0e19040 0x0 0xe0e560c0
0x6b6dd50 stream 0 0 0x6a1d020 0x0 0x0 0x0 tabs/.sock
0x6b6dc88 dgram 0 0 0x0 0xe0e19040 0x0 0xe0e56040
0x80c0330 stream 0 0 0x6a2d580 0x0 0x0 0x0 /tmp/ssh-RxCmax5109/agent.5109
0x80c00d8 stream 0 0 0x6a29e10 0x0 0x0 0x0 /tmp/ssh-SjTMS25447/agent.25447
0x80c0010 stream 0 0 0x0 0xe0e6c880 0x0 0x0
0x6b6de18 stream 0 0 0x0 0xe0e6c840 0x0 0x0
0x60367d0 dgram 0 0 0x0 0xe0e19040 0x0 0xe0e4dd00
0x6036640 stream 0 0 0x0 0xe0e4d840 0x0 0x0
0x6036578 stream 0 0 0x0 0xe0e4da80 0x0 0x0
0x60364b0 dgram 0 0 0x0 0xe0e19040 0x0 0x0
0x60363e8 stream 0 0 0x0 0xe0e4d3c0 0x0 0x0
0x6036320 stream 0 0 0x0 0xe0e19400 0x0 0x0
0x6036258 dgram 0 0 0x6559a60 0x0 0x0 0x0 /var/empty/dev/log
0x6036190 dgram 0 0 0x6559998 0x0 0x0 0x0 /var/named/dev/log
0x60360c8 dgram 0 0 0x65598d0 0x0 0xe0e56c00 0x0 /dev/log
#

Thanks
Nbomr and acid_kewpie for your reply I posted the netstat command and as you can see UDP is not Listening.

and what's that ?

udp 0 0 *.syslog *.*

do 'lsof -i UDP:syslog'. It should show that syslogd is up and running correctly. You just need to tell your cisco stuff to send syslog info to your machine, choose a facility and point that facility to a logfile (in syslog.conf). If could be that you need to enable remote-logging, which is system-dependent I think (for debian it's in /etc/default/syslogd, don't know how to do it in bsd).

This is what I get with lsof: not found.

then maybe lsof is not installed. Try 'pgrep syslogd' or 'ps -A | grep syslogd' instead to verify that syslogd is running. The point is, that your problem is the configuration of syslogd, not the configuration of the network.

You are maybe irritated, that the udp lines in your output don't show the explicit 'LISTEN' but that's correct, it's not an error. udp does not know connection states such as listen or established, in fact it doesn't even use a connection. It's a fire-and-forget protocol, an application will send data and doesn't care if the receiver actually received them.
So you needn't (and can't) set udp ports to 'listen', all you need to do is configure syslogd.

Almatic

Thanks for your professinals advice. This is what I get from ps -a | grep syslogd

22960 p0 I+ 0:00.00 grep syslogd

you need to use capital A (ps -A, not ps -a). Probably that was your problem with lsof as well (capital UDP).
But I guess you have figured that out yourself in the meanwhile ...

I tried with -A. The result is not Found but "pgrep syslogd" is giving me this two numbers 13746 and 25622. Please explain this results