LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 12-03-2014, 05:51 AM   #1
Santoshkb
Member
 
Registered: Sep 2007
Posts: 56

Rep: Reputation: 15
Question Unable to specify remote syslog server with port on Linux client


Hi

configuring /etc/syslog.conf to send all syslog messages to remote syslog server running on non default port is not working.

*.* @10.102.77.118:514

I also verified from tcpdump didn't see any syslog messages sent


Whereas , It works well on "*.* @10.102.77.118 "

Went through etc/syslog.conf man page also.

Request for your help, Am i missing some configuration?
 
Old 12-03-2014, 06:26 AM   #2
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: Fedora
Posts: 4,179

Rep: Reputation: 1272Reputation: 1272Reputation: 1272Reputation: 1272Reputation: 1272Reputation: 1272Reputation: 1272Reputation: 1272Reputation: 1272
How did you configure the server to listen on that port?
 
Old 12-03-2014, 07:51 AM   #3
Habitual
LQ Veteran
 
Registered: Jan 2011
Location: Abingdon, VA
Distribution: Catalina
Posts: 9,374
Blog Entries: 37

Rep: Reputation: Disabled
Quote:
Originally Posted by Santoshkb View Post
Request for your help, Am i missing some configuration?
Code:
/etc/rsyslog.conf:
...
$ModLoad imudp 
...
### Listener
$UDPServerRun 514
...
### Basic Security
$AllowedSender UDP, IP_0, IP_1
$AllowedSender is not in a stock rsyslog.conf so you can add it.
It is Basic Security only to keep unqualified senders from doing mischief to your system.

Is there a firewall activated? It may need port 514 opened if there is.
Code:
Example:
    *.* @192.168.0.1 
In the example above, messages are forwarded via UDP to the machine 192.168.0.1, the destination port defaults to 514
so the 514 is NOT required.
*.* @10.102.77.118 is perfectly valid.

but
Code:
$ModLoad imudp 
...
### Listener
$UDPServerRun 514
are required to have the sending directive *.* @10.102.77.118 work.

Reference: http://linux.die.net/man/5/rsyslog.conf

Version on the client and OS/release too please.
Code:
rsyslogd -version | head -1

Last edited by Habitual; 12-03-2014 at 08:02 AM.
 
Old 12-06-2014, 06:14 AM   #4
Santoshkb
Member
 
Registered: Sep 2007
Posts: 56

Original Poster
Rep: Reputation: 15
syslog version is of syslogd 1.4.1
yes the host is centos5


if i specify just
*.* @IPAddress in /etc/syslog.conf , it works and sends syslog messages to IPAddress : 514 port.


if i specify
*.* @IPAddress:514 (default port) OR *.* @IPAddress:SyslogserverPort , it doesn't work.


Is it due to older syslogd doesn't facilitate this option?

Can it be achieved in syslogd, rsyslod is not available in the host?

Last edited by Santoshkb; 12-06-2014 at 06:42 AM. Reason: .
 
Old 12-06-2014, 06:43 AM   #5
Santoshkb
Member
 
Registered: Sep 2007
Posts: 56

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by smallpond View Post
How did you configure the server to listen on that port?

I'm running tcpdump to verify with filter for the dest port on remote server,
 
Old 01-06-2015, 12:07 AM   #6
Santoshkb
Member
 
Registered: Sep 2007
Posts: 56

Original Poster
Rep: Reputation: 15
Issue is solved after updating to rsyslogd

After updating with rsyslogd was able to see it working.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
remote syslog server in linux harshaabba Linux - Server 8 04-05-2011 05:08 PM
C under Linux -Trying to write two port server and 2 port client application NancyT Linux - Server 3 04-17-2009 02:05 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 06:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration