[syslog-ng] Re : Re : Re : Syslogd + Syslog-ng

[Christopher Cashell]

Leandro Ferreira da Silva did thus speak on 7/23/2008 7:14 AM:
> The configuration is the standart, I only do the follow changes.
> 
> # sources
> source src { unix-dgram("/var/run/log");
>              unix-dgram("/var/run/logpriv" perm(0600));
>              udp(); internal(); file("/dev/klog"); };
> 
> I add this,
> source r_src { udp(ip("*client.domain*") port(514));  };

Here's your problem.  For src, you define 'udp()' as one of your log 
sources, without including any specific options for it.  This will cause 
syslog-ng to go with its defaults for udp(), which is bind to *all* IP 
addresses assigned to the box, on port 514.

Then, for r_src, you are telling syslog-ng to bind to a specific IP 
address on the box and port 514.  When syslog-ng attempts to start, it 
will fail with the error message you received because that ip/port is 
already in use (by the source src, which is bound to all IP's).

Unless you have a need to bind to a specific IP address on the box, I'd 
recommend removing 'udp();' from src, and replacing the current 
'udp(ip("*client.domain*") port(514));' in r_src with 'udp();'.

-- 
Christopher Cashell