This is basically what I have in the config file:

source s_network{
tcp(ip(0.0.0.0) port(514));
udp(ip(0.0.0.0) port(514));
unix-stream("/dev/log");
};


destination d_network { file("/var/log/network.log"); };

log {source(s_network); destination(d_network); };


All I want right now is to just get it logging syslog messages from the network. I know it's reciving them, because I can see them when I run tcpdump.

I also know I've got it somewhat right, because it does seem to be logging messages from unix-stream. What am I doing wrong/missing?

a firewall would be the thing that would block this traffic... do you have one on the machine itself? you'll still see the packets hit the box, but nothign more. definitely try the tcp connectivity not the udp as udp is connectionless, so for udp syslog if it's dropped or accepted the network will look the same. can you telnet to port 514 from a client? that'll test the tcp completely, and you can even stick your own message directly in by typing it yourself.

haha, why didn't i think of that... i suppose it could be a firewall...

I can't telnet to port 514, so I guess something is blocking it... now to find out what

(this is on fedora 7 btw)

hmm, well, I think I allowed for syslog messages to come through in iptables, but either I didn't do it right, or it didn't work.

I tried this... iptables -A INPUT -p tcp --sport 1024:65535 --dport 514 --j ACCEPT

Any other ides?

well just try temporarily disabling the firewall before you worry about specific iptables rules... i wouldn't bother about defining a source port range myself btw.