[syslog-ng] Syslog-no Question
robert.fekete at balabit.com
Wed Feb 22 13:57:37 UTC 2017
No, you can't have both listen on the same port.
Basically, the network() driver is for RFC3164-formatted messages, while
the syslog() driver is for RFC5424-formatted messages. (To complicate
things, the network() driver has a syslog-protocol flag to receive
RFC5424-formatted messages, but the on-wire format is not entirely the same
(no framing, AFAIK), so they are not compatible.)
Basically, using matching drivers between the clients-server works best,
To receive different types of messages on the server, it is usually best to
send the different messages to separate ports.
On Wed, Feb 22, 2017 at 2:44 PM, 'Miah Lang' via SYSLOG-NG <
syslog-ng at balabit.com> wrote:
> I’m having trouble determining when you would use the network() source vs
> the syslog() source?
> We have logs coming in on TCP port 514 from network devices, would it be
> best to use the network() source for this? Can you setup both the network()
> and syslog() sources to listen on TCP port 514 or would that cause issues?
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the syslog-ng