Hi, do you use the source in a log statement? Is syslog-ng really listening on the specified port? Robert On 06/04/2012 08:08 AM, C. L. Martinez wrote:

On Fri, Jun 1, 2012 at 3:39 PM, C. L. Martinez<carlopmart@gmail.com> wrote:

...

Hi all,

I am trying to configure syslog-ng to receive syslog messages as syslog structured (IETF). To accomplish I have configured:

source s_ietfsyslog { syslog (port(20514) transport(tcp)); };

but not messages are processed by syslog-ng (but messages arrives from third devices).

Any idea??

Nothing?? ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

On Mon, Jun 4, 2012 at 12:27 PM, C. L. Martinez <carlopmart@gmail.com> wrote:

On Mon, Jun 4, 2012 at 12:23 PM, Gergely Nagy <algernon@balabit.hu> wrote:

...

"C. L. Martinez" <carlopmart@gmail.com> writes:

...

 I am trying to configure syslog-ng to receive syslog messages as syslog structured (IETF). To accomplish I have configured:

 source s_ietfsyslog {       syslog (port(20514) transport(tcp)); };

 but not messages are processed by syslog-ng (but messages arrives from third devices).

Can you post the full config? The source itself is correct, but there are many possibilities within other parts of the config where things could go wrong.

@version:3.3

# # options # options {        perm(0644);        chain_hostnames(off);        flush_lines(100);        keep_hostname(yes); };

source s_ietfsyslog {        syslog(ip(172.24.50.2) port(20514) transport(tcp)); };

destination d_ietflog {        file("/tmp/test_corr.log"); };

log {       source(s_ietfsyslog);       destination(d_ietflog);       flags(flow-control,final); };

 .. and that's all ...

Extrange: changin tcp transport by udp, works ... but I didn't see any difference between a normal log and using syslog driver ... Somebody knows why?