[SOLVED] Unable to specify remote syslog server with port on Linux client

Santoshkb · 12-03-2014, 05:51 AM

Hi

configuring /etc/syslog.conf to send all syslog messages to remote syslog server running on non default port is not working.

*.* @10.102.77.118:514

I also verified from tcpdump didn't see any syslog messages sent

Whereas , It works well on "*.* @10.102.77.118 "

Went through etc/syslog.conf man page also.

Request for your help, Am i missing some configuration?

smallpond · 12-03-2014, 06:26 AM

How did you configure the server to listen on that port?

Habitual · 12-03-2014, 07:51 AM

Quote:

Originally Posted by Santoshkb

Request for your help, Am i missing some configuration?

Code:

/etc/rsyslog.conf:
...
$ModLoad imudp 
...
### Listener
$UDPServerRun 514
...
### Basic Security
$AllowedSender UDP, IP_0, IP_1

$AllowedSender is not in a stock rsyslog.conf so you can add it.
It is Basic Security only to keep unqualified senders from doing mischief to your system.

Is there a firewall activated? It may need port 514 opened if there is.

Code:

Example:
    *.* @192.168.0.1 
In the example above, messages are forwarded via UDP to the machine 192.168.0.1, the destination port defaults to 514

so the 514 is NOT required.
*.* @10.102.77.118 is perfectly valid.

but

Code:

$ModLoad imudp 
...
### Listener
$UDPServerRun 514

are required to have the sending directive *.* @10.102.77.118 work.

Reference: http://linux.die.net/man/5/rsyslog.conf

Version on the client and OS/release too please.

Code:

rsyslogd -version | head -1

Santoshkb · 12-06-2014, 06:14 AM

syslog version is of syslogd 1.4.1
yes the host is centos5

if i specify just
*.* @IPAddress in /etc/syslog.conf , it works and sends syslog messages to IPAddress : 514 port.

if i specify
*.* @IPAddress:514 (default port) OR *.* @IPAddress:SyslogserverPort , it doesn't work.

Is it due to older syslogd doesn't facilitate this option?

Can it be achieved in syslogd, rsyslod is not available in the host?

Santoshkb · 12-06-2014, 06:43 AM

Quote:

Originally Posted by smallpond

How did you configure the server to listen on that port?

I'm running tcpdump to verify with filter for the dest port on remote server,

Santoshkb · 01-06-2015, 12:07 AM

After updating with rsyslogd was able to see it working.