1

I'm trying to setup log forwarding with rsyslog. I have the line below in my rsyslog.conf file just to test sending logs over.

*.* @<remoteserverIP>:514

I'm trying to send the logs over UDP port 514. However, when I do a netstat, it appears the logs are going over a random port like 6023. The port is different every time I restart the rsyslog daemon. I've checked the firewall and IP tables rules, but I can't find anything setup that would be changing the outbound port. I have another server sending to the same remote syslog server that is working just fine. I'd appreciate any ideas of what I might check to get this working.

Improve this question
1
  • 2
    The local port changes, the remote port should not.
    – Barmar
    Apr 20, 2017 at 19:20

1 Answer 1

Reset to default
1

It is expected for a client to change, that is, to be an ephemeral port. It is the remote server which should not. There a few services for which this is not the case, most notably ntp, but such is not the case for syslog.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .