my central syslog server appears to discard remote messages

Question

I have added the remote option to the /etc/sysconfig/syslog SYSLOGD_OPTIONS="-m0 -r " and restarted and its definitely listening on the syslog port;

# netstat -lnu | grep 514
udp        0      0 0.0.0.0:514                 0.0.0.0:*  

I can even intercept incoming syslog with tcpdump dst port 514;

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
19:57:34.626128 IP 07701.com.syslog > i1106.com.syslog: SYSLOG user.critical, length: 75
19:57:56.254679 IP 07701.com.syslog > i1106.com.syslog: SYSLOG local5.critical, length: 76

However the syslog alerts never make it into the log file, tail -f /var/log/message /var/log/remote

at the top of the syslogger machine I have;

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console
*.*                                     /var/log/remote.log

and the file has been created and there are local entries in it.

Any suggestions on what I am doing wrong?

EDIT: it seems that stopping the firewall allows the messages to get through, so there i clearly something weird with the iptables config that is blocking these messages;

Answer 1

I wasn't clear if you configured syslog on all of your clients or not. Your tcpdump seems to show inbound syslog traffic, but you might want check that you aren't simply seeing traffic from one remote syslog client. Be sure that Syslogd is configured on each client machine as well. You need to add a line which looks something like this, where syslog.example.org is your syslog server:

# Log all messages to central syslog server
*.*     @syslog.example.org

To verify this is working, use the logger(1) utility. I run a command like this on all of my machines in one window, often in a loop like for HOST in ALLOFMYHOSTS; do ssh $HOST 'logger'.....

logger -t stefantest stefantest1

Then in a separate window connected to the syslog, I do a tail -f /var/log/YOURLOGFILE |grep stefantest. This will confirm if syslog itself is working from each host or not. Then, go from there.