[SOLVED] Centos Syslog Issue

felix001 · 03-03-2011, 11:21 AM

Im currently centos and im trying to stop syslogd from listening on port 514. Ive tried removing the -r option from the /etc/sysconfig/syslog file but it fails to work. Has anyone any ideas ???

Thanks in advance...

unSpawn · 03-03-2011, 12:00 PM

Did you 'kill -HUP' syslogd?

corp769 · 03-03-2011, 12:02 PM

Take a look in /etc/init.d/sysklogd.conf and see if the -r option is being used.

anomie · 03-03-2011, 12:27 PM

Which CentOS version? I browsed through the syslogd(8) manpages on RHEL 4 and 5. Apart from what you already tried, I don't see an obvious option for doing this. (FreeBSD has some baked-in options for just this sort of thing.)

I'd be curious to see which options your syslogd is currently running with:

Code:

$ ps -ef | grep [s]yslogd

unSpawn · 03-03-2011, 03:31 PM

Quote:

Originally Posted by anomie

Code:

$ ps -ef | grep [s]yslogd

You mean 'pgrep syslog'?

Quote:

Originally Posted by corp769

/etc/init.d/sysklogd.conf

You mean /etc/sysconfig/syslog? /etc(/rc.d)/init.d/ is for SysV init scripts.

anomie · 03-03-2011, 03:50 PM

Quote:

Originally Posted by unSpawn

You mean 'pgrep syslog'?

Nyet! I want to see the options (in the process table listing), not the PID.

unSpawn · 03-03-2011, 05:55 PM

Ah, 'pgrep -l syslog' :-]

unSpawn · 03-04-2011, 10:58 AM

Uh 'pgrep -lf syslog'!

felix001 · 03-10-2011, 11:57 AM

In the end I found that even when I ran syslogd without any options it still opened a listening socket on 514/udp.
To stop this I commented out the syslog line from the /etc/services file and restarted syslogd.

unSpawn · 03-10-2011, 12:30 PM

Quote:

Originally Posted by felix001

To stop this I commented out the syslog line from the /etc/services file and restarted syslogd.

As long as I have run Linux I have not ever seen any relation whatsoever between having /etc/service entries and enabling a service like that in syslogd:

Code:

]# getent services syslog
syslog          514/udp
syslog-conn     601/tcp                         # Reliable Syslog Service
syslog-conn     601/udp                         # Reliable Syslog Service
syslog-tcp      1514/tcp                        # TCP-based Rsyslog

]# netstat -anulpe|awk -F'/' '/:/ {print $NF}'|sort -u|xargs
dhclient ntpd pdnsd

so I strongly doubt that was the "solution".

felix001 · 03-10-2011, 02:53 PM

As soon as I removed that line and restarted the syslogd reported an error about not being able to assign a socket and started.
From what I have read the /etc/services file is used to determine the port of syslogd though normally I just remove the -r option from /etc/sysconfig/syslog to disable remote logging.

Either way I tested this on another server and it certainly does work :

Code:

[root@server ~]# netstat -an | grep 514
udp   108324      0 0.0.0.0:514                 0.0.0.0:*
[root@server ~]# sed -i 's/^syslog */#syslog/g' /etc/services
[root@server ~]# service syslog restart
Shutting down kernel logger:                               [  OK  ]
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
Starting kernel logger:                                    [  OK  ]
[root@server ~]# netstat -an | grep 514
[root@server ~]#

unSpawn · 03-10-2011, 04:45 PM

You haven't posted any 'pgrep -lf syslog' nor any 'cat /etc/*syslog*.conf' output to corroborate what you think you see. I remain one hundred percent unconvinced still.

felix001 · 03-10-2011, 07:15 PM

ok, i finally found what was causing the confusion. If you enable the @[host] statement within the /etc/syslog.conf file it enables remote logging.

Code:

[root@Fileserver ~]# cat /etc/*syslog*.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

*.*                                                       /var/log/messages
[root@Fileserver ~]# pgrep -lf syslog
21248 syslogd -x -m 0
[root@Fileserver ~]# netstat -an | grep 514
[root@Fileserver ~]# echo "*.* @10.1.1.203" >> /etc/syslog.conf
[root@Fileserver ~]# /etc/init.d/syslog restart
Shutting down kernel logger:                               [  OK  ]
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
Starting kernel logger:                                    [  OK  ]
[root@Fileserver ~]# netstat -an | grep 514
udp        0      0 0.0.0.0:514                 0.0.0.0:*                       
[root@Fileserver ~]# pgrep -lf syslog
21273 syslogd -x -m 0
[root@Fileserver ~]# cat /etc/*syslog*.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

*.*                                                       /var/log/messages
*.* @10.1.1.203