On Mon, Feb 22, 2010 at 9:25 AM, Harry Putnam <[email protected]> wrote:
> Also what is needed in the server to make rsyslog listen to port 514?
> As I've mentioned, that (server) instance of rsyslog is being started
> with -t514.
You loaded the module but I don't see anything explicitly starting
inputTCP (not sure if this is required or not). In my config I have:
$ModLoad imtcp.so # load module
$InputTCPMaxSessions 1000 # Maximum TCP sessions (default 200)
$InputTCPServerRun 514 # start up TCP listener at port 514
I also have:
# UDP Syslog Server:
$ModLoad imudp.so # provides UDP syslog reception
$UDPServerRun 514 # start a UDP syslog server at standard port 514
Generally - there's not much harm running both afaik and it makes it
easier when you have a device that doesn't do TCP (network gear).
> I'm not sure if it means anything but trying:
> telnet server_host 514
>
> from the client machine does fail to connect. And the attempt does
> not show up in the catchall ouput on server either.
Yeah, that's. bad. Try the above, and if you still cannot connect
remotely run this on the syslog server:
sudo netstat -alnp | grep 514
You may get some other stuff but you should get a line that looks like this:
tcp 0 0 0.0.0.0:514 0.0.0.0:*
LISTEN 29233/rsyslogd
That tells you rsyslogd is listening on port 514 - if you did all of
the above you should also see:
udp 0 0 0.0.0.0:514 0.0.0.0:*
29233/rsyslogd
Which tells you it's listening on udp 514.
Hope this helps,
Aaron
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
