I have six Linux servers (and one Solaris server but I won't bother with this just yet) that need to send some type of notice to an OpenNMS server whenever a disk partition gets above say 75%. I was trying to do this via SNMP and traps but found this very complicated. So now I want to use syslog as OpenNMS has a syslogd. Anyways, this is really a syslog question. Is there a way to specify the port to use when sending a syslog message from a host to a remote syslogd?

For example I tried this in my /etc/syslog.conf file:


But no dice. Syslog will only send the message when I don't add the ":<port>" part. The problem here is that I don't want to run the OpenNMS syslogd on port 514 as I still want the regular syslogd to run. To get around this I have written an iptables script that alters the destination port from 514 to 10514 (the port where OpenNMS syslogd runs). This works but it is a cheap kind of hack and I'd rather not have to implement this on six servers (plus the Solaris server which I know almost nothing about). I have read a little about syslog-ng but I am loathe to use this as, again, I will have to implement it on six servers.

Any ideas?

Thanks

You say you don't want syslog-ng on each client which if solely for this function seems fair, but I'd suggest you're still taking the wrong approach by considering making changes like this on the client side. it seems that syslogd will always bind to udp:514, but if you change the central one to syslog-ng *ONCE* then you can either relay data *through* syslog-ng and onwards to opennms syslogd, OR just stop syslog-ng listneing on 514 in the first place. port 514 is for the syslog protocol, so it's much nicer for firewalling and practises in general to say that syslog traffic on your network is only on that one single port, and take a more detailed approach inside the server once it gets there. there's plenty of info about this on the opennms wiki actually, certianly their favoured approach.

Depending on which distro you run, rsyslog < http://www.rsyslog.com > might be a good alternativ e for you (it is the default on recent Fedora and RHEL, so you should be able to get it without much trouble on distros based on that). It supports the syntax you intended to use. Other than syslog-ng, it is a real drop-in replacement, meaning it works with the sysklogd config files.

Rainer
(Disclaimer: I am the rsyslog author)