<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="Generator" content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang="EN-US" link="blue" vlink="purple"><div class="WordSection1"><div><p class="MsoNormal">Hello,</p></div><div><p class="MsoNormal">I am new to syslog-ng. I have set up a syslog-ng ose 3.2.2 server and configured syslog on 64-bit RHEL 5 client servers to send all messages to the syslog-ng server over udp/11514 (client's syslog.conf: *.* @syslog-ngIP:11514) but no packet is received. </p>
</div><div><p class="MsoNormal"> </p><p class="MsoNormal">When I change the port on the syslog-ng server and on the client's syslog from udp/11514 to udp/514 all works. Verified that firewalls passing packets for both udp/514 and 11514 on the server and RHEL client and the port is not used by any other app.<br>
I cannot figure out why the logs are not happening when changing the port to udp/11514 from default? Is there any global options I should set or any change to my source statements? </p><p class="MsoNormal"> </p><p class="MsoNormal">
Here are the global options and sources definitions:<br><b>options</b> {<br> time_reopen (10);<br> long_hostnames (off);<br> owner("root");<br> group("root");<br> perm(0600);<br>
dir_perm(0755);<br> use_dns (yes);<br> use_fqdn (no);<br> create_dirs (yes);<br> keep_hostname (no);</p><p class="MsoNormal" style="text-indent:.5in">};</p></div><div><p class="MsoNormal">
</p></div><div><p class="MsoNormal"><b>source:</b></p></div><div><p class="MsoNormal">########### Define Sources</p><p class="MsoNormal"> </p><p class="MsoNormal"><b>### Internal </b></p><p class="MsoNormal">source s_local_sys {</p>
<p class="MsoNormal"> file ("/proc/kmsg" program_override("kernel: "));</p><p class="MsoNormal"> unix-stream ("/dev/log");</p><p class="MsoNormal"> internal();};</p><p class="MsoNormal">
<b>### External or remote:</b></p><p class="MsoNormal"># For Server Groups</p><p class="MsoNormal">source s_RHEL5_udp { udp(port(11514));};</p><p class="MsoNormal"> </p><p class="MsoNormal"><b># For all other single hosts:</b></p>
<p class="MsoNormal">source s_remote_udp { udp(port(514));};</p><p class="MsoNormal"><br>Thanks in advance for your help.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Medi<br clear="all"></p></div>
</div></body></html>