On 2008-01-12 15:50, Jeffrey Goldberg <[EMAIL PROTECTED]> wrote: > On Jan 11, 2008, at 9:51 AM, Andy Greenwood wrote: >> I have recently set up a Fortigate-60 to run as a firewall/vpn on my >> home network. I have a FreeBSD 7.0-prerelease machine sitting behind >> it in the DMZ which is running ssh/web/etc. I'm trying to get the FG >> to log to the BSD box's syslog. I have set up the necessary stuff on >> the FG, and can send test logs from there to the bsd box. Running >> tcpdump on the bsd [...] >> >> So I know that the packets are getting to the machine. I've set up >> syslogd to accept packets from 10.10.10.1/32 in rc.conf, and >> confirmed that the FG's IP should be accepted [...] >> >> I've restarted syslogd after every change I've made, but no dice. Can >> anyone shed some light on why these messages aren't logging and what >> I need to do to fix it? > > I'm sure that there is a simple answer for getting syslogd to work > properly. But after similar experiences to yours (on other systems), I now > use syslog-ng (in ports) for any system that is going to be a remote syslog > server.
To the original poster, since I missed the message which started the thread... Andy, the default mode of syslogd in FreeBSD is `secure mode', because the -s option is enabled in `/etc/defaults/rc.conf': % [EMAIL PROTECTED]:/root# grep '^syslogd_' /etc/defaults/rc.conf % syslogd_enable="YES" # Run syslog daemon (or NO). % syslogd_program="/usr/sbin/syslogd" # path to syslogd, if you want a different one. % syslogd_flags="-s" # Flags to syslogd (if enabled). % [EMAIL PROTECTED]:/root# The -s flag in the default options means that syslogd will *not* log messages from remote hosts. Quoting the syslogd manpage: -s Operate in secure mode. Do not log messages from remote machines. If specified twice, no network socket will be opened at all, which also disables logging to remote machines. I'm using the following in `/etc/rc.conf': % [EMAIL PROTECTED]:/root# grep '^syslogd_' /etc/rc.conf % syslogd_enable="YES" % syslogd_flags="" % [EMAIL PROTECTED]:/root# and the syslogd on the system where this message is typed properly logs messages from my DSL modem: % [EMAIL PROTECTED]:/root# fgrep ' fire ' /var/log/messages | head -1 % Jan 12 22:04:26 fire kernel: Intrusion -> IN=ppp_8_35_1 OUT= MAC= \ % SRC=184.108.40.206 DST=220.127.116.11 LEN=48 TOS=0x00 PREC=0x00 \ % TTL=126 ID=39175 DF PROTO=TCP SPT=2213 DPT=445 WINDOW=16384 \ % RES=0x00 SYN URGP=0 % [EMAIL PROTECTED]:/root# NOTE: If you are also using a firewall, you will have to make sure that incoming UDP messages for the `syslog' service are allowed. This is the `pf.conf' snippet from my home network setup: pass in proto udp from 18.104.22.168/24 to any port = syslog HTH, Giorgos _______________________________________________ email@example.com mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"