[syslog-ng] udp 514 collision?

[K K]

On Jan 24, 2008 4:53 PM, Richard Morgan <richard at northerncrown.com> wrote:
> On RHEL4, it seems that the generic syslogd is showing as bound to
> 514/udp and any messages that the local syslogd would send on to syslog-ng are
> lost.

The usual suggestion for this issue is to disable the local
OS-supplied syslogd, and instead have syslog-ng handle the local logs
as well as remote logs.


> Any ideas?

I have a somewhat similar issue with OpenBSD; Even though the
OS-supplied syslogd defaults to not accepting events from remote
sources,  the local syslogd wants to bind to UDP/514 to use as the
*source* port when forwarding log events to a "remote" logger, and the
two do not get along.

My solution was to modify OpenBSD's source code for the local syslogd
so it no longer insists on binding UDP/514 even when not accepting
remote messages.  Ugly, but effective.

Kevin