Hey guys,
Are there any known bugs for syslog-ng v2.09 that won't allow a
cisco router to send logs over tcp?
I can see a connection established in syslog-ng.
I also see the message come in via tcpdump, but nothing in
syslog-ng's output.
If I change the router from tcp to udp, messages come in as
expected.
Router config:
logging source-interface Loopback0
syslog-ng config:
source s_all {
udp();
tcp(ip(11.31.130.99) port(8002) max-connections(300));
tcp(ip(172.18.224.190) port(601) max-connections(300));
};
debug output:
I commented out the line above for the other interface
(11.31.130.99), restarted and this is all I see:
tcpdump:
14:13:46.914566 IP (tos 0x0, ttl 251, id 4303, offset 0, flags
[none], proto TCP (6), length 134)
14.3.23.50.63845 > xxx.com.601: Flags [.], seq 230:324,
ack 1, win 4128, length 94
Router debug:
*Aug
17
17:34:25
.775:
TCP: Random local port generated
63845,
network 1
*Aug
17
17:34:25
.775:
Reserved port
63845
in Transport Port Agent for TCP IP type 1
______________________________________________________________
Clayton Dukes
______________________________________________________________
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html