Red Hat Bugzilla – Bug 137205
syslogd opens a socket on UDP port 514 even when receipt of remote log messages is disabled
Last modified: 2010-06-28 14:17:46 EDT
Description of problem:
syslogd opens a socket on UDP port 514 even when receipt of remote log messages
is disabled, as long as any forwarding entries exist in /etc/syslog.conf. If
it's not listening on port 514 why does it need to have the socket open at all.
In this case, a customer is also doing logging with syslog-ng, and whenever
syslogd is started last it blocks syslog-ng from receiving messages on the port.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Add any forwarding host entry to syslog.conf
2. Restart syslogd
3. Observe open socket via 'netstat -uln | grep 514'
A UDP connection exists on port 514
No connection on port 514 since we're not accepting remote messages
This problem is fixed in sysklogd-1.4.1-22 (FC3 & RHEL-4) .
Sorry this missed getting into RHEL-3 updates - I'll issue
an errata and get it into RHEL-3-U5 .
If your customer is running syslog-ng, why do they need to
run sysklogd ? I'm currently evaluating the complete
replacement of sysklogd with syslog-ng for Fedora, as it
has been requested by many customers.
Meanwhile, you can download sysklogd-1.4.1-22 built for
RHEL-3-U4 i386 (or src.rpm) from :
I'm not sure if your question about using both sysklogd and syslog-ng
was a rhetorical one or not, but here's the closest thing to an
explanation I have:
"...I've installed syslog-ng and configured it to handle UDP port 514
messages only... Of course I can just use syslog-ng to handle all
syslog messages, local and remote, then disable syslogd, but I like
the idea of leaving the standard stuff alone as much as possible and
simply forward messages from syslogd to @localhost so syslog-ng can
handle them, too."
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
I am able to reproduce this on sysklogd-1.4.1-44.el5. I have a third party syslog server that I need to listen on that port but I also need to use syslogd for the OS and forwarding to a log host.
Can someone point me in the right direction?