Just one quick answer (on the leave) > > RFC3164 actually > > recommends that port 514 is used as the source port, and we had a > > lengthy discussion at the IETF about this recommendation. The bottom > > line is that you cannot reuse the receive socket on a highly parallel > > syslogd because each thread needs its own (or you have even more > sync). > > Rsyslog creates a new (set of) send sockets *per action*. > > if you don't do a bind on the socket you can't specify the source port. > if > you do bind on the socket and set the source port to 514 aren't you > generating a conflict between the multiple send sockets?
I am ignoring the RFC recommendation. It is also removed from the soon-to-appear RFC5424. I should have mentioned this... Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
