[syslog-ng] Error in documentation on syslog() source port

[Patrick H.]

Why?
This is a documentation issue, not a config issue.

modules/afsocket/afsocket-grammar.y:899
source_afsyslog_params
    :
      {
        (*last_driver) = afinet_sd_new(last_addr_family,
          NULL, 601,
          AFSOCKET_STREAM | AFSOCKET_SYSLOG_PROTOCOL);
        last_reader_options = &((AFSocketSourceDriver *) 
(*last_driver))->reader_options;
        last_sock_options = &((AFInetSourceDriver *) 
(*last_driver))->sock_options.super;
      }
      source_afsyslog_options  { $$ = (*last_driver); }
    ;

The third argument to afinet_sd_new is the port number, notice the 601?


source_afinet_option
    : KW_LOCALIP '(' string ')'      { 
afinet_sd_set_localip((*last_driver), $3); free($3); }
    | KW_IP '(' string ')'        { 
afinet_sd_set_localip((*last_driver), $3); free($3); }
    | KW_LOCALPORT '(' string_or_number ')'   { 
afinet_sd_set_localport((*last_driver), $3, 
afinet_sd_get_proto_name((*last_driver))); free($3); }
    | KW_PORT '(' string_or_number ')'  { 
afinet_sd_set_localport((*last_driver), $3, 
afinet_sd_get_proto_name((*last_driver))); free($3); }
    | source_reader_option
    | inet_socket_option
    ;

See the KW_PORT? This tells it to change the port number of the socket 
when it encounters port() in the config. Thus if it never sees a 
KW_PORT, it never changes it from 601.


Sent: Mon Oct 03 2011 08:05:55 GMT-0600 (MST)
From: Frank Collette <FCollette at trustmark.com>
To: Syslog-ng users' and developers' mailing list 
<syslog-ng at lists.balabit.hu>
Subject: Re: [syslog-ng] Error in documentation on syslog() source port
> Post your source config.. feel free to mask your ip/hostname.
>
>
> Thanks,
>
> Frank E. Collette IV
> Technical Services
> Systems Administrator II
> Trustmark National Bank
> Office: 601-208-7517
> Fax: 601-208-6105
> fcollette at trustmark.com
>
>
>
> From: "Patrick H." <syslogng at feystorm.net>
> To: cdukes at cdukes.com, Syslog-ng users' and developers' mailing list 
> <syslog-ng at lists.balabit.hu>
> Cc: Clayton Dukes <cdukes at gmail.com>
> Date: 10/03/2011 08:58 AM
> Subject: Re: [syslog-ng] Error in documentation on syslog() source port
> Sent by: syslog-ng-bounces at lists.balabit.hu
> ------------------------------------------------------------------------
>
>
>
> Actually I'm using both protocols, and I get the same behavior with both.
>
> -Patrick
>
> Sent: Mon Oct 03 2011 07:55:46 GMT-0600 (MST)
> From: Clayton Dukes _<cdukes at gmail.com>_ <mailto:cdukes at gmail.com>
> To: Syslog-ng users' and developers' mailing list 
> _<syslog-ng at lists.balabit.hu>_ <mailto:syslog-ng at lists.balabit.hu>
> Subject: Re: [syslog-ng] Error in documentation on syslog() source port
> Are you by chance using tcp? If so, the default is 601:
> _http://www.ietf.org/rfc/rfc3195.txt_
>
> ______________________________________________________________
>
> Clayton Dukes
> ______________________________________________________________
>
>
> On Sun, Oct 2, 2011 at 9:44 PM, Patrick H. <_syslogng at feystorm.net_ 
> <mailto:syslogng at feystorm.net>> wrote:
> The syslog-ng admin guide for 3.2 says the default port for syslog() 
> sources is 514. This isnt the observed behavior. When a syslog() 
> source is configured without specifying the port, it listens on 601
>
> ______________________________________________________________________________
> Member info: _https://lists.balabit.hu/mailman/listinfo/syslog-ng_
> Documentation: 
> _http://www.balabit.com/support/documentation/?product=syslog-ng_
> FAQ: _http://www.balabit.com/wiki/syslog-ng-faq_
>
>
>
>
>
> ______________________________________________________________________________
> Member info: _https://lists.balabit.hu/mailman/listinfo/syslog-ng_
> Documentation: 
> _http://www.balabit.com/support/documentation/?product=syslog-ng_
> FAQ: _http://www.balabit.com/wiki/syslog-ng-faq_
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: 
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20111003/75af3d65/attachment.htm