Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have added the remote option to the /etc/sysconfig/syslog SYSLOGD_OPTIONS="-m0 -r " and restarted and its definitely listening on the syslog port;

# netstat -lnu | grep 514
udp        0      0 0.0.0.0:514                 0.0.0.0:*  

I can even intercept incoming syslog with tcpdump dst port 514;

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
19:57:34.626128 IP 07701.com.syslog > i1106.com.syslog: SYSLOG user.critical, length: 75
19:57:56.254679 IP 07701.com.syslog > i1106.com.syslog: SYSLOG local5.critical, length: 76

However the syslog alerts never make it into the log file, tail -f /var/log/message /var/log/remote

at the top of the syslogger machine I have;

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console
*.*                                     /var/log/remote.log

and the file has been created and there are local entries in it.

Any suggestions on what I am doing wrong?

EDIT: it seems that stopping the firewall allows the messages to get through, so there i clearly something weird with the iptables config that is blocking these messages;

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I wasn't clear if you configured syslog on all of your clients or not. Your tcpdump seems to show inbound syslog traffic, but you might want check that you aren't simply seeing traffic from one remote syslog client. Be sure that Syslogd is configured on each client machine as well. You need to add a line which looks something like this, where syslog.example.org is your syslog server:

# Log all messages to central syslog server
*.*     @syslog.example.org

To verify this is working, use the logger(1) utility. I run a command like this on all of my machines in one window, often in a loop like for HOST in ALLOFMYHOSTS; do ssh $HOST 'logger'.....

logger -t stefantest stefantest1

Then in a separate window connected to the syslog, I do a tail -f /var/log/YOURLOGFILE |grep stefantest. This will confirm if syslog itself is working from each host or not. Then, go from there.

share|improve this answer
    
hi, thanks for the reply. Yes I have configured my clients with a syslog line similar to your example above. and using the the logger tool I can generate syslog alerts that are forwarded by the client to the remote server. which is what you can see in the tcpdump. However the syslog doesn't appear to see the syslog messages. also if I enable "SYSLOGD -m0 -x -r -d" the debug output does not print anything when the message arrives. so something weird is going on. –  Tom H Jul 9 '10 at 5:17
    
using iptables -vL showed that one of the REJECT lines was catching the incoming syslog packets :-( –  Tom H Jul 9 '10 at 6:02
    
Glad you figured it out. –  Stefan Lasiewski Jul 9 '10 at 16:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.