I have added the remote option to the /etc/sysconfig/syslog SYSLOGD_OPTIONS="-m0 -r " and restarted and its definitely listening on the syslog port;
# netstat -lnu | grep 514 udp 0 0 0.0.0.0:514 0.0.0.0:*
I can even intercept incoming syslog with tcpdump dst port 514;
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 19:57:34.626128 IP 07701.com.syslog > i1106.com.syslog: SYSLOG user.critical, length: 75 19:57:56.254679 IP 07701.com.syslog > i1106.com.syslog: SYSLOG local5.critical, length: 76
However the syslog alerts never make it into the log file, tail -f /var/log/message /var/log/remote
at the top of the syslogger machine I have;
# Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console *.* /var/log/remote.log
and the file has been created and there are local entries in it.
Any suggestions on what I am doing wrong?
EDIT: it seems that stopping the firewall allows the messages to get through, so there i clearly something weird with the iptables config that is blocking these messages;