<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EstiloDeEmail17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="PT-BR" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><b>Hello Everyone,<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>I installed syslog-ng on a new machine, however in initial tests, there was no collection of UDP packages by syslog-ng.<o:p></o:p></b></p>
<p class="MsoNormal"><b><o:p> </o:p></b></p>
<p class="MsoNormal"><b>Here are some points I checked:<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">sudo netstat -plunt | grep -e PID -e syslog<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">tcp 0 0 0.0.0.0:601 0.0.0.0:* LISTEN 16169/syslog-ng<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">udp 0 0 10.96.145.42:514 0.0.0.0:* 16169/syslog-ng<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">netstat -anu | grep 514<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">udp 0 0 10.96.145.42:514 0.0.0.0:*<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">[cgnat@mgalnxa01 etc]$ sudo systemctl status syslog-ng -l<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">● syslog-ng.service - System Logger Daemon<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: enabled)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> Active: active (running) since Wed 2020-03-25 12:38:08 -03; 5min ago<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> Process: 114207 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">Main PID: 16169 (syslog-ng)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> CGroup: /system.slice/syslog-ng.service<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> └瘢雹─16169 /opt/syslog-ng/libexec/syslog-ng -F --enable-core<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">Mar 25 12:38:08 mgalnxa01 systemd[1]: Starting System Logger Daemon...<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>Here is an example of the package received via tcpdump, but it was not captured by syslog-ng:<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">10:46:13.529331 IP (tos 0x20, ttl 251, id 33055, offset 0, flags [none], proto UDP (17), length 243)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 10.96.145.98.syslog > mgalnxa01.9514: [udp sum ok] SYSLOG, length: 215<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> Facility user (1), Severity info (6)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> Msg: Mar 24 13:46:13 2020 RTCGNMGA0103 RT_NAT: RT_SRC_NAT_PBA_ALLOC: Subscriber 100.64.1.6 used/maximum [2/2] blocks, allocates port block [47104-47167] from 177.51.116.146 in source pool
PUBLIC-NAT-POOL-1 lsys_id: 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x0000: 3c31 343e 4d61 7220 3234 2031 333a 3436<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x0010: 3a31 3320 3230 3230 2052 5443 474e 4d47<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x0020: 4130 3130 3320 5254 5f4e 4154 3a20 5254<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x0030: 5f53 5243 5f4e 4154 5f50 4241 5f41 4c4c<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x0040: 4f43 3a20 5375 6273 6372 6962 6572 2031<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x0050: 3030 2e36 342e 312e 3620 7573 6564 2f6d<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x0060: 6178 696d 756d 205b 322f 325d 2062 6c6f<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x0070: 636b 732c 2061 6c6c 6f63 6174 6573 2070<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x0080: 6f72 7420 626c 6f63 6b20 5b34 3731 3034<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x0090: 2d34 3731 3637 5d20 6672 6f6d 2031 3737<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x00a0: 2e35 312e 3131 362e 3134 3620 696e 2073<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x00b0: 6f75 7263 6520 706f 6f6c 2050 5542 4c49<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x00c0: 432d 4e41 542d 504f 4f4c 2d31 206c 7379<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""> 0x00d0: 735f 6964 3a20 30<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>What I need to analyze / verify, for syslog-ng will capture this type of package and convert it to a file.<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Courier New";color:#1F497D;mso-fareast-language:PT-BR">Atenciosamente,<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Courier New";color:#1F497D;mso-fareast-language:PT-BR"><img width="255" height="3" style="width:2.6562in;height:.0312in" id="Imagem_x0020_1" src="cid:image001.gif@01D602A2.A0B9D8A0" alt="Descrição: Descrição: cid:image001.gif@01CB8646.7E0C9E60"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New";color:#333333;mso-fareast-language:PT-BR">WILLIAM LUIZ R V SILVA
</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New";color:#333333;mso-fareast-language:PT-BR"><br>
Mediation</span><span lang="EN-US" style="font-family:"Courier New";color:#333333;mso-fareast-language:PT-BR"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Courier New";color:#333333;mso-fareast-language:PT-BR"><br>
</span><b><span style="font-size:10.0pt;font-family:"Courier New";color:#333333;mso-fareast-language:PT-BR">Ericsson</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:#333333;mso-fareast-language:PT-BR"><br>
Rua Maria Preste Maia, 300<br>
02879-130, Brazil<br>
Phone +55 11 </span><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:PT-BR">2760-3785<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:#333333;mso-fareast-language:PT-BR">Mobile +55 11 97979-9886<br>
<a href="mailto:wsilva_ericsson@timbrasil.com.br"><span style="color:blue">wsilva_ericsson@timbrasil.com.br</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#333333;mso-fareast-language:PT-BR"><a href="http://www.ericsson.com/"><span style="color:blue">www.ericsson.com</span></a>
</span><span style="color:#333333;mso-fareast-language:PT-BR"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><a href="http://www.ericsson.com/" target="_blank"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:PT-BR;text-decoration:none"><img border="0" width="68" height="60" style="width:.7083in;height:.625in" id="Imagem_x0020_2" src="cid:image002.gif@01D602A2.A0B9D8A0" alt="Descrição: Descrição: Ericsson"></span></a><span style="mso-fareast-language:PT-BR"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<font size="-2">Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos
que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo.
<p>This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure,
copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents
</p>
<p>Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo
utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto
</font></p>
</body>
</html>