Description of problem: syslogd opens a socket on UDP port 514 even when receipt of remote log messages is disabled, as long as any forwarding entries exist in /etc/syslog.conf. If it's not listening on port 514 why does it need to have the socket open at all. In this case, a customer is also doing logging with syslog-ng, and whenever syslogd is started last it blocks syslog-ng from receiving messages on the port. Version-Release number of selected component (if applicable): sysklogd-1.4.1-12.3 How reproducible: Always Steps to Reproduce: 1. Add any forwarding host entry to syslog.conf 2. Restart syslogd 3. Observe open socket via 'netstat -uln | grep 514' Actual results: A UDP connection exists on port 514 Expected results: No connection on port 514 since we're not accepting remote messages Additional info:
This problem is fixed in sysklogd-1.4.1-22 (FC3 & RHEL-4) . Sorry this missed getting into RHEL-3 updates - I'll issue an errata and get it into RHEL-3-U5 . If your customer is running syslog-ng, why do they need to run sysklogd ? I'm currently evaluating the complete replacement of sysklogd with syslog-ng for Fedora, as it has been requested by many customers. Meanwhile, you can download sysklogd-1.4.1-22 built for RHEL-3-U4 i386 (or src.rpm) from : http://people.redhat.com/~jvdias/sysklogd/RHEL-3
I'm not sure if your question about using both sysklogd and syslog-ng was a rhetorical one or not, but here's the closest thing to an explanation I have: "...I've installed syslog-ng and configured it to handle UDP port 514 messages only... Of course I can just use syslog-ng to handle all syslog messages, local and remote, then disable syslogd, but I like the idea of leaving the standard stuff alone as much as possible and simply forward messages from syslogd to @localhost so syslog-ng can handle them, too."
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2005-087.html
I am able to reproduce this on sysklogd-1.4.1-44.el5. I have a third party syslog server that I need to listen on that port but I also need to use syslogd for the OS and forwarding to a log host. Can someone point me in the right direction?