similar to: rsyslog listening on high port

On Thu, 2018-09-06 at 15:10 -0400, Mike Burger wrote: > On 2018-09-06 14:06, Adam Tauno Williams wrote: > > Attempting to lookup why rsyslogd is listening on the high port > > UDP/51427.????Have not succeeded in what this port is used for and > > what directive controls what interface it binds to. > > [root at bedrock ~]# netstat --listen --inet --program --numeric |

On Thu, Sep 06, 2018 at 02:06:37PM -0400, Adam Tauno Williams wrote: > > Attempting to lookup why rsyslogd is listening on the high port > UDP/51427. Have not succeeded in what this port is used for and what > directive controls what interface it binds to. > > [root at bedrock ~]# netstat --listen --inet --program --numeric | grep syslog > udp??0??0

On 2018-09-06 14:06, Adam Tauno Williams wrote: > Attempting to lookup why rsyslogd is listening on the high port > UDP/51427. Have not succeeded in what this port is used for and what > directive controls what interface it binds to. > > [root at bedrock ~]# netstat --listen --inet --program --numeric | grep > syslog > udp??0??0 0.0.0.0:51427??0.0.0.0:*???66655/rsyslogd?

Hello everyone, We have some chrooted sftp-only users on a CentOS release 6.6 server. The server had been logging their actions, but after recent updates the logs have stopped. The server correctly logs non-chrooted users: Sep 14 17:47:24 vsecure4 sshd[1981]: Accepted publickey for jcours from 192.168.10.166 port 42545 ssh2 Sep 14 17:47:24 vsecure4 sshd[1981]: pam_unix(sshd:session):

centos 6.4, setup to be syslog server. Doing remote syslog using tcp works fine, so now want to add relp. I installed the rsyslog-relp package and told rsyslog.conf to use it: # RELP Syslog Server: $ModLoad imrelp # provides RELP syslog reception $InputRELPServerRun 20514 when I restart rsyslog I am told it does not like my InputRELPServerRun line: Oct 28 13:43:54 scan rsyslogd: [origin

Hi, My rsyslog is not working as expected. I have some thing in rsyslog.d that do well, like this: # Log all iptables stuff separately :msg, contains, "iptables: " { action(type="omfile" file="/var/log/iptraf/info") } No problems with that. Bu what's in /etc/rsyslog.conf like: mail.* /var/log/mail/info don't do anything at all. Rsyslogd -N1 is OK,

Package: logcheck-database Severity: wishlist Tags: patch Hi, ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: imklog 3\.18\.6, log source = /proc/kmsg started\.$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="3.18.6" x-pid="[[:digit:]]+" x-info="http://www.rsyslog.com"\] restart$ Hendrik -- Hendrik Jaeger

I've setup my rsyslog server to forward traffic to another rsyslog server on my network. It's using gTLS to encrypt the messages in transit. selinux is not allowing rsyslogd to read the certificates. They are world readable, so I don't think that is the problem. When I turn selinux mode to permissive, it works fine. What context should the ssl certificates be in for rsyslog to be

The system is an AWS Instance based on a community CentOS 6.4 AMI snapshot. The vdisk is as follows as shown below [1] The root LVM contains /var/log/ I have attached another block device with ext4 FS. I copied the files from /var/log to this device (mounted on /mnt) and then changed /etc/fstab to mount this device on /var/log on boot. However, I do not see anything being logged in

And no sooner do I send the email than I spot the problem. Oops! Sorry about that. The sshd_config needed to contain a different internal-sftp line: Match User test-sftp-only ChrootDirectory /home/sftp/mcsosftp ForceCommand internal-sftp -f AUTHPRIV -l INFO PasswordAuthentication no AuthorizedKeysCommand /usr/local/bin/get_sftp_key That's gotten

I have an rsyslog server which is running Debian Stable, and its version of rsyslog is 4.6.4-2. All of my Debian Stable server can send log to it now. and run both nc $IP $PORT <<< "HELLO" and echo "HELLO" | nc $IP $PORT on client, I can get log on the server. While for my CentOS 5.7 server, nc $IP $PORT <<< "HELLO" works well, but echo

Hello All, Does the rsyslog version in CentOS 5 support expression based filters? I'm asking because a filter I believe should be working, isn't and I cannot figure out why. I'm trying to get the following expression working (might wrap): if $source == 'astappsrv2' and $programname == 'asterisk' then /var/log/asterisk/astappsrv2.log Every time I restart rsyslog, I

I have several recently-installed CentOS 7 servers that keep having systemd-journald corruption (which stops ALL logging, including syslog). Interestingly, they are all spam-scanning servers running amavisd-new (so could be some particular pattern is triggering it). Is there a "supported" way to just cut systemd-journald out of the picture and have log entries go straight to rsyslogd?

I just noticed that on one CentOS 5 server the logs messages, maillog and a couple of others have been blank for a couple of weeks! I tracked down the error to /etc/sysconfig/rsyslogd There was a line SYSLOGD_OPTIONS="-c3" I googled that -c3 defines the "version" or "compatibility mode", and with 3 it means "rsyslog v3 native interface". When I removed

Hi there, I am slightly confused by the RHEL release notes and an earlier thread here about rsyslogd, so I hope someone can clear this up for me; I see that rsyslog is included in RHEL as of 5.2 (and so will be available in CentOS when 5.2 is ready) however there is no indication of whether it has been made the default syslogger or not - is it an optional package or installed by default on a

Dear All I am using a centos server for cdr billing and mediation device on a remote network. I am experiencing problem that I am suspicious it comes from main supply power cut at the remote site. The power supply to the remote site comes from battery charger that will be automatically switched in circuit under main supply power cut but cannot provide adequate power for more than 2 hours . I am

So I was having an issue with rsyslog in one of my centos 6.6 hosts: [root at scan ~]# /etc/init.d/rsyslog start Starting system logger: *** glibc detected *** /sbin/rsyslogd: double free or corruption (fasttop): 0x00007f80cc3da880 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x75e66)[0x7f80c9210e66] /usr/lib64/librelp.so.0(relpTcpDestruct+0x5f)[0x7f80c7f1a9bf]

Hello, I recently upgraded a server from CentOS 6.2 to 6.3 I found a change in the behavior of rsyslog's configuration file that I found particularly interesting. The "$PreserveFQDN on" directive was not being recognized as the config remained unchanged during the upgrade. This incorrect behavior caused the host to syslog with only the host name and not it's fully qualified

This is a similar post to one I've made on the rsyslog list that has received no responses after four days, so I figured I'd try here since the problem seems to be CentOS specific. This is also my second attempt to send it to this list as the first seems to have never showed up. I am trying to test remote logging between two CentOS 6.3 systems and unable to get the client logs to show up

All, Running dovecot 2.3.10 on a CentOS 7.x and logging via syslog seems to stop when i restart rsyslog process. Reload doesnt get it working again only a dovecot restart. Tested this with dovecot 2.2.36 and this did not exhibit the same behaviour. systemctl restart dovecot rsyslog ----- this gets a working state systemctl restart rsyslog ------------- this restarts syslog other processes