-   Linux - Software (
-   -   syslog-ng is not logging (

coreno 09-07-2007 02:04 PM

syslog-ng is not logging
This is basically what I have in the config file:

source s_network{
tcp(ip( port(514));
udp(ip( port(514));

destination d_network { file("/var/log/network.log"); };

log {source(s_network); destination(d_network); };

All I want right now is to just get it logging syslog messages from the network. I know it's reciving them, because I can see them when I run tcpdump.

I also know I've got it somewhat right, because it does seem to be logging messages from unix-stream. What am I doing wrong/missing?

acid_kewpie 09-07-2007 02:29 PM

a firewall would be the thing that would block this traffic... do you have one on the machine itself? you'll still see the packets hit the box, but nothign more. definitely try the tcp connectivity not the udp as udp is connectionless, so for udp syslog if it's dropped or accepted the network will look the same. can you telnet to port 514 from a client? that'll test the tcp completely, and you can even stick your own message directly in by typing it yourself.

coreno 09-07-2007 02:43 PM

haha, why didn't i think of that... i suppose it could be a firewall...

I can't telnet to port 514, so I guess something is blocking it... now to find out what :p

(this is on fedora 7 btw)

coreno 09-08-2007 12:39 PM

hmm, well, I think I allowed for syslog messages to come through in iptables, but either I didn't do it right, or it didn't work.

I tried this... iptables -A INPUT -p tcp --sport 1024:65535 --dport 514 --j ACCEPT

Any other ides?

acid_kewpie 09-08-2007 01:13 PM

well just try temporarily disabling the firewall before you worry about specific iptables rules... i wouldn't bother about defining a source port range myself btw.

All times are GMT -5. The time now is 11:10 PM.