LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices



Reply
 
Search this Thread
Old 09-07-2007, 03:04 PM   #1
coreno
LQ Newbie
 
Registered: Sep 2007
Posts: 10

Rep: Reputation: 0
syslog-ng is not logging


This is basically what I have in the config file:

source s_network{
tcp(ip(0.0.0.0) port(514));
udp(ip(0.0.0.0) port(514));
unix-stream("/dev/log");
};


destination d_network { file("/var/log/network.log"); };

log {source(s_network); destination(d_network); };


All I want right now is to just get it logging syslog messages from the network. I know it's reciving them, because I can see them when I run tcpdump.

I also know I've got it somewhat right, because it does seem to be logging messages from unix-stream. What am I doing wrong/missing?
 
Old 09-07-2007, 03:29 PM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,415

Rep: Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968
a firewall would be the thing that would block this traffic... do you have one on the machine itself? you'll still see the packets hit the box, but nothign more. definitely try the tcp connectivity not the udp as udp is connectionless, so for udp syslog if it's dropped or accepted the network will look the same. can you telnet to port 514 from a client? that'll test the tcp completely, and you can even stick your own message directly in by typing it yourself.
 
Old 09-07-2007, 03:43 PM   #3
coreno
LQ Newbie
 
Registered: Sep 2007
Posts: 10

Original Poster
Rep: Reputation: 0
haha, why didn't i think of that... i suppose it could be a firewall...

I can't telnet to port 514, so I guess something is blocking it... now to find out what

(this is on fedora 7 btw)
 
Old 09-08-2007, 01:39 PM   #4
coreno
LQ Newbie
 
Registered: Sep 2007
Posts: 10

Original Poster
Rep: Reputation: 0
hmm, well, I think I allowed for syslog messages to come through in iptables, but either I didn't do it right, or it didn't work.

I tried this... iptables -A INPUT -p tcp --sport 1024:65535 --dport 514 --j ACCEPT

Any other ides?
 
Old 09-08-2007, 02:13 PM   #5
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,415

Rep: Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968
well just try temporarily disabling the firewall before you worry about specific iptables rules... i wouldn't bother about defining a source port range myself btw.
 
  


Reply

Tags
iptables, syslog, syslogng, tcpdump


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
syslog-ng and logging software gatsby Linux - Software 1 04-24-2007 12:15 PM
Centralized logging with syslog-ng jantman Suse/Novell 2 03-30-2007 09:57 PM
Logging/syslog s0n|k Linux - Newbie 2 03-13-2006 08:36 PM
Logging firewall with syslog-ng? RecoilUK Linux - Security 1 08-06-2005 05:28 PM
syslog running but not logging tantric Linux - Security 1 10-15-2003 08:24 AM


All times are GMT -5. The time now is 09:32 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration