Bug 137205

Summary:	syslogd opens a socket on UDP port 514 even when receipt of remote log messages is disabled
Product:	Red Hat Enterprise Linux 3	Reporter:	David Lehman <dlehman>
Component:	sysklogd	Assignee:	Jason Vas Dias <jvdias>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.0	CC:	russ.starr, tao
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-05-19 23:19:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Lehman 2004-10-26 18:01:04 UTC

Description of problem:
syslogd opens a socket on UDP port 514 even when receipt of remote log messages
is disabled, as long as any forwarding entries exist in /etc/syslog.conf. If
it's not listening on port 514 why does it need to have the socket open at all.
In this case, a customer is also doing logging with syslog-ng, and whenever
syslogd is started last it blocks syslog-ng from receiving messages on the port.

Version-Release number of selected component (if applicable):
sysklogd-1.4.1-12.3

How reproducible:
Always

Steps to Reproduce:
1. Add any forwarding host entry to syslog.conf
2. Restart syslogd
3. Observe open socket via 'netstat -uln | grep 514'
  
Actual results:
A UDP connection exists on port 514

Expected results:
No connection on port 514 since we're not accepting remote messages

Additional info:

Comment 1 Jason Vas Dias 2004-10-27 14:58:54 UTC

 This problem is fixed in sysklogd-1.4.1-22 (FC3 & RHEL-4) .
 Sorry this missed getting into RHEL-3 updates - I'll issue
 an errata and get it into RHEL-3-U5 .
 If your customer is running syslog-ng, why do they need to
 run sysklogd ?  I'm currently evaluating the complete
 replacement of sysklogd with syslog-ng for Fedora, as it 
 has been requested by many customers. 
 Meanwhile, you can download  sysklogd-1.4.1-22 built for
 RHEL-3-U4 i386 (or src.rpm) from :
  http://people.redhat.com/~jvdias/sysklogd/RHEL-3

Comment 2 David Lehman 2004-10-27 16:40:52 UTC

I'm not sure if your question about using both sysklogd and syslog-ng
was a rhetorical one or not, but here's the closest thing to an
explanation I have:

"...I've installed syslog-ng and configured it to handle UDP port 514
messages only... Of course I can just use syslog-ng to handle all
syslog messages, local and remote, then disable syslogd, but I like
the idea of leaving the standard stuff alone as much as possible and
simply forward messages from syslogd to @localhost so syslog-ng can
handle them, too."

Comment 3 Tim Powers 2005-05-19 23:19:11 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2005-087.html

Comment 4 RussStarr 2010-06-28 18:17:46 UTC

I am able to reproduce this on sysklogd-1.4.1-44.el5.  I have a third party syslog server that I need to listen on that port but I also need to use syslogd for the OS and forwarding to a log host.

Can someone point me in the right direction?