Bugzilla will be upgraded to version 5.0 on December 2, 2018. The outage period for the upgrade will start at 0:00 UTC and have a duration of 12 hours
Bug 137205 - syslogd opens a socket on UDP port 514 even when receipt of remote log messages is disabled
syslogd opens a socket on UDP port 514 even when receipt of remote log messag...
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: sysklogd (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Jason Vas Dias
Brian Brock
Depends On:
  Show dependency treegraph
Reported: 2004-10-26 14:01 EDT by David Lehman
Modified: 2010-06-28 14:17 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-05-19 19:19:11 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2005:087 low SHIPPED_LIVE sysklogd bug fix update 2005-05-19 00:00:00 EDT

  None (edit)
Description David Lehman 2004-10-26 14:01:04 EDT
Description of problem:
syslogd opens a socket on UDP port 514 even when receipt of remote log messages
is disabled, as long as any forwarding entries exist in /etc/syslog.conf. If
it's not listening on port 514 why does it need to have the socket open at all.
In this case, a customer is also doing logging with syslog-ng, and whenever
syslogd is started last it blocks syslog-ng from receiving messages on the port.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Add any forwarding host entry to syslog.conf
2. Restart syslogd
3. Observe open socket via 'netstat -uln | grep 514'
Actual results:
A UDP connection exists on port 514

Expected results:
No connection on port 514 since we're not accepting remote messages

Additional info:
Comment 1 Jason Vas Dias 2004-10-27 10:58:54 EDT
 This problem is fixed in sysklogd-1.4.1-22 (FC3 & RHEL-4) .
 Sorry this missed getting into RHEL-3 updates - I'll issue
 an errata and get it into RHEL-3-U5 .
 If your customer is running syslog-ng, why do they need to
 run sysklogd ?  I'm currently evaluating the complete
 replacement of sysklogd with syslog-ng for Fedora, as it 
 has been requested by many customers. 
 Meanwhile, you can download  sysklogd-1.4.1-22 built for
 RHEL-3-U4 i386 (or src.rpm) from :
Comment 2 David Lehman 2004-10-27 12:40:52 EDT
I'm not sure if your question about using both sysklogd and syslog-ng
was a rhetorical one or not, but here's the closest thing to an
explanation I have:

"...I've installed syslog-ng and configured it to handle UDP port 514
messages only... Of course I can just use syslog-ng to handle all
syslog messages, local and remote, then disable syslogd, but I like
the idea of leaving the standard stuff alone as much as possible and
simply forward messages from syslogd to @localhost so syslog-ng can
handle them, too."
Comment 3 Tim Powers 2005-05-19 19:19:11 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

Comment 4 RussStarr 2010-06-28 14:17:46 EDT
I am able to reproduce this on sysklogd-1.4.1-44.el5.  I have a third party syslog server that I need to listen on that port but I also need to use syslogd for the OS and forwarding to a log host.

Can someone point me in the right direction?

Note You need to log in before you can comment on or make changes to this bug.