[syslog-ng] Re : Re : Re : Syslogd + Syslog-ng

[Leandro Ferreira da Silva]

Christopher Cashell wrote:
> Leandro Ferreira da Silva did thus speak on 7/23/2008 7:14 AM:
>> The configuration is the standart, I only do the follow changes.
>>
>> # sources
>> source src { unix-dgram("/var/run/log");
>>              unix-dgram("/var/run/logpriv" perm(0600));
>>              udp(); internal(); file("/dev/klog"); };
>>
>> I add this,
>> source r_src { udp(ip("*client.domain*") port(514));  };
>
> Here's your problem.  For src, you define 'udp()' as one of your log 
> sources, without including any specific options for it.  This will 
> cause syslog-ng to go with its defaults for udp(), which is bind to 
> *all* IP addresses assigned to the box, on port 514.
>
> Then, for r_src, you are telling syslog-ng to bind to a specific IP 
> address on the box and port 514.  When syslog-ng attempts to start, it 
> will fail with the error message you received because that ip/port is 
> already in use (by the source src, which is bound to all IP's).
>
> Unless you have a need to bind to a specific IP address on the box, 
> I'd recommend removing 'udp();' from src, and replacing the current 
> 'udp(ip("*client.domain*") port(514));' in r_src with 'udp();'.
>
It worked!!
The real problem was udp () at src.
Thank you very much for all the help...
Now I'll go complete my rules..

See you!! =P