[syslog-ng]Can't receive syslog by UDP protocol
"Manuel Joćo S. Costa Amaro"
syslog-ng@lists.balabit.hu
Tue, 07 Dec 2004 21:58:46 +0000
This is a multi-part message in MIME format.
--------------060904090802000902050000
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<font size="-1">It works with udp() also.<br>
<br>
Maybe your UDP port is closed (firewall ?) ....<br>
<br>
<br>
<br>
<br>
</font><br>
Xiaodong Lin wrote:
<blockquote
cite="midAB32304A99D1B849929D0FB8B8D8F2E103B3578D@VS2.EXCHPROD.USA.NET"
type="cite">
<meta http-equiv="Content-Type" content="text/html; ">
<meta content="MSHTML 6.00.2800.1476" name="GENERATOR">
<style>@font-face {
font-family: SimSun;
}
@font-face {
font-family: SimSun;
}
@page Section1 {size: 595.3pt 841.9pt; margin: 72.0pt 90.0pt 72.0pt 90.0pt; layout-grid: 15.6pt; }
P.MsoNormal {
TEXT-JUSTIFY: inter-ideograph; FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"; TEXT-ALIGN: justify
}
LI.MsoNormal {
TEXT-JUSTIFY: inter-ideograph; FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"; TEXT-ALIGN: justify
}
DIV.MsoNormal {
TEXT-JUSTIFY: inter-ideograph; FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"; TEXT-ALIGN: justify
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.EmailStyle17 {
COLOR: windowtext; FONT-FAMILY: Arial; mso-style-type: personal-compose
}
DIV.Section1 {
page: Section1
}
</style>
<div align="left" dir="ltr"><span class="913000318-07122004"><font
color="#0000ff" face="Arial" size="2">I think you should use the
following:</font></span></div>
<div align="left" dir="ltr"><span class="913000318-07122004"><font
color="#0000ff" face="Arial" size="2">udp(ip(0.0.0.0) port(514));</font></span></div>
<div align="left" dir="ltr"><span class="913000318-07122004"></span> </div>
<div align="left" dir="ltr"><span class="913000318-07122004"><font
color="#0000ff" face="Arial" size="2">instead of udp();</font></span></div>
<div align="left" dir="ltr"><span class="913000318-07122004"></span> </div>
<div align="left" dir="ltr"><span class="913000318-07122004"><font
color="#0000ff" face="Arial" size="2">Xiaodong</font></span></div>
<br>
<div class="OutlookMessageHeader" align="left" dir="ltr" lang="en-us">
<hr tabindex="-1"><font face="Tahoma" size="2"><b>From:</b>
<a class="moz-txt-link-abbreviated" href="mailto:syslog-ng-admin@lists.balabit.hu">syslog-ng-admin@lists.balabit.hu</a>
[<a class="moz-txt-link-freetext" href="mailto:syslog-ng-admin@lists.balabit.hu">mailto:syslog-ng-admin@lists.balabit.hu</a>] <b>On Behalf Of </b>wei<br>
<b>Sent:</b> Tuesday, December 07, 2004 3:29 AM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>
<b>Subject:</b> [syslog-ng]Can't receive syslog by UDP protocol<br>
</font><br>
</div>
<div class="Section1" style="">
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">Greeting!<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">I have set up
my syslog-ng environment by the default syslog-ng.conf file. By the
linux default logger command, I can generate syslog to file. <o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">But when I
use a syslog client send out syslog to the syslog-ng server, I can’t
receive the log by UDP protocol. But I can get TCP protocol syslog.
Could anyone tell me why?<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">Thanks!<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">My system is
RedHat 9.0. The syslog client is Kiwi Syslog Gen in windows. The
following is part of my syslog.conf file:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">source src { <o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">
pipe("/proc/kmsg"); <o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">
unix-stream("/dev/log"); <o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">
internal(); <o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">
udp();<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">
tcp(port(5140) keep-alive(yes)); <o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">};<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">log { <o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">
source(src); <o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">
destination(file); <o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="1"><span
style="font-size: 9pt; font-family: Arial;" lang="EN-US">};<o:p></o:p></span></font></p>
</div>
</blockquote>
</body>
</html>
--------------060904090802000902050000
Content-Type: text/x-vcard; charset=utf-8;
name="ashes.vcf"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="ashes.vcf"
begin:vcard
fn:Manuel Joao S. Costa Amaro
n:Amaro;Manuel Joao S. Costa
email;internet:joao@joane.org
tel;cell:351 917 833 551
version:2.1
end:vcard
--------------060904090802000902050000--